More than four months after 84-year-old Nancy Guthrie vanished from her Tucson, Arizona, home, a retired FBI agent says a leading cybersecurity company has publicly classified the case as a cryptocurrency-motivated kidnapping, what the industry calls a "wrench attack by proxy." If the designation holds up, it would reframe the disappearance of Savannah Guthrie's mother as part of a documented and growing pattern of violent crimes targeting people connected to digital-currency wealth.
Jennifer Coffindaffer, a retired FBI agent and NewsNation contributor, posted on X on Saturday, June 13, sharing a screenshot from cybersecurity firm CertiK. In it, CertiK described Nancy Guthrie's kidnapping as part of a "$6 million bitcoin ransom demand" and tied it to what the company called "the documented trend of proxy target selection already identified in our 2025 report."
Coffindaffer did not hold back about the significance. In her post, she wrote:
"It's the biggest public break in Nancy's Case, as CertiK, arguably the leading crypto security company in the world, has designated Nancy's abduction as a wrench attack by proxy."
She followed up with a pointed question: "Does CertiK have knowledge as to if Savannah has a Bitcoin account?"
No suspect has been publicly named. Nancy Guthrie, the mother of Today co-anchor Savannah Guthrie, was last seen at her Catalina Foothills home on January 31. Her family reported her missing the next day, February 1. The Pima County Sheriff's Department and the FBI have been working the case since, sorting through tips and, more recently, processing DNA evidence.
The term "wrench attack" comes from the cryptocurrency world. It refers to a physical assault or threat, sometimes literally with a wrench or other weapon, aimed at forcing someone to hand over digital assets. A "proxy" variation targets not the crypto holder directly but a family member or associate, using the threat against that person as leverage.
CertiK's screenshot, as shared by Coffindaffer, stated plainly that Nancy Guthrie "was kidnapped as part of a $6 million bitcoin ransom demand, illustrating the documented trend of proxy target selection already identified in our 2025 report." That language ties the case to a broader pattern CertiK says it has been tracking.
The FBI has been exploring new technology and forensic data in the case, but Coffindaffer's post suggests the crypto angle may open investigative doors that traditional law enforcement has been slow to walk through.
In a separate part of her X thread, Coffindaffer elaborated on why she considered the CertiK designation so important:
"This is a huge breakthrough. Times have changed. And how these networks operate is new to LE [law enforcement]. Unless LE knows who took Nancy, then a wrench by proxy is on the table. CertiK seems to know."
That last line, "CertiK seems to know", raises as many questions as it answers. It implies the cybersecurity firm may possess intelligence about the case that has not been made public. Whether CertiK has shared that information with federal investigators, or whether it arrived at its designation independently using open-source data, remains unclear.
The Nancy Guthrie investigation has been marked by frustration. Tips have come and gone. Authorities have processed evidence at a pace that has drawn public criticism.
The Pima County Sheriff's Department has pointed to lab backlogs and procedural hurdles as reasons for the slow progress. DNA evidence collection has been underway, but the timeline has tested the patience of a family, and a public, desperate for answers.
The FBI's involvement has not been without friction, either. Questions about coordination between federal and local authorities surfaced early in the investigation, with the FBI accusing the Pima County sheriff of blocking the bureau from the case for four critical days at the outset. Those lost days, in any missing-persons case, can be the difference between a trail that's warm and one that's cold.
Meanwhile, at least one anonymous tip sent search teams across the border. That effort, too, came up empty. An anonymous tip directed searchers into the Mexican desert looking for Nancy Guthrie's remains, but they found nothing.
Forensic work has continued. The FBI obtained DNA results from a hair sample collected at the Tucson home, though the significance of those results has not been publicly disclosed.
Through it all, Savannah Guthrie has kept her public statements spare but unmistakable. On June 7, the Today co-anchor shared an Instagram Stories update featuring religious artwork and two brief messages.
"Oh my, my soul it cries out, soul, it cries out."
And then, simply: "Bring her home."
Savannah Guthrie has also offered a $1 million reward for information leading to her mother's return. That sum, combined with the national media attention the case has drawn, has not yet produced the break the family needs.
If CertiK's classification is accurate, the Nancy Guthrie case sits at the intersection of two disturbing trends: the physical targeting of individuals connected to cryptocurrency wealth, and the willingness of criminal networks to go after elderly family members as leverage.
A $6 million bitcoin ransom demand is not a petty crime. It suggests planning, knowledge of the target's financial connections, and a degree of operational sophistication that goes well beyond a random abduction. Coffindaffer's question about whether Savannah Guthrie holds a Bitcoin account points directly at the motive theory, that someone believed they could extract digital currency by seizing the person closest to the perceived holder.
Traditional law enforcement, as Coffindaffer noted, may not be fully equipped to trace these networks. Cryptocurrency transactions are pseudonymous by design. Tracing ransom demands through blockchain analysis requires specialized tools and expertise that local sheriff's departments rarely possess. The FBI has those capabilities, but the early coordination failures in this case raise legitimate concerns about whether the right resources reached the investigation in time.
CertiK, for its part, is a well-known name in the crypto security space. Its decision to publicly classify the Guthrie abduction in its reporting lends weight to the theory, though it is worth noting that the firm's designation, as reported, has not been independently confirmed by law enforcement. Whether CertiK reached its conclusion through proprietary blockchain analysis, open-source intelligence, or some combination remains an open question.
The list of unanswered questions in the Nancy Guthrie case is long and growing. No suspect has been named. The source, timing, and full context of the CertiK report that Coffindaffer shared have not been independently verified. It is not clear whether CertiK has communicated directly with the FBI or the Pima County Sheriff's Department.
The DNA evidence being processed has not been publicly linked to any individual. The ransom demand, $6 million in bitcoin, has not been attributed to a specific person or group. And Nancy Guthrie, at 84 years old, remains missing.
Coffindaffer's post has injected new energy into a case that had begun to feel stalled. But energy and answers are not the same thing. The crypto angle, if confirmed, would represent a genuine shift in the investigation's direction. It would also underscore a grim reality: that the explosion of digital wealth has created a new class of violent crime, one that law enforcement is still learning to confront.
Four months is a long time for an 84-year-old woman to be missing. If the people who took Nancy Guthrie thought cryptocurrency would make them untraceable, the growing scrutiny from firms like CertiK and retired agents like Coffindaffer suggests they may have miscalculated. The question is whether that scrutiny translates into action before it's too late.