Why would Nancy Guthrie’s alleged captors prefer to deal in crypto rather than cash?
Northeastern University cryptocurrency expert Ravi Sarathy said that Bitcoin’s global reach, ease of use and “pseudo-anonymous” nature make it attractive in ransom schemes.
There are few known leads pointing to potential suspects in the case involving the disappearance of Nancy Guthrie, the mother of American news anchor Savannah Guthrie. A person of interest was detained briefly this week, according to the Pima County Sheriff’s Department, then released.
But one detail about the case that stands out is an alleged ransom note sent to local media outlets in the days immediately after Guthrie’s disappearance that purportedly requested payment in bitcoin, the world’s largest cryptocurrency.
Multiple media outlets have reported activity associated with a bitcoin account connected to the alleged ransom note, according to details first reported by TMZ, a celebrity news and entertainment tabloid.
Why would Guthrie’s would-be captors prefer to deal in crypto rather than cash? Northeastern University cryptocurrency expert Ravi Sarathy said bitcoin’s global reach, ease of use and “pseudo-anonymous” nature make it attractive in ransom schemes.
“I think one of the reasons is that bitcoin has been around for a long time,” Sarathy told Northeastern Global News. “It’s a global network, and so there are longstanding wallets that have been around for up to 15 years, since its inception.”
Authorities say 84-year-old Nancy Guthrie has not been seen since Feb. 1 and is believed to have been abducted from her home in Oro Valley, a suburb of Tucson in Pima County, Arizona.
As cryptocurrencies have matured in recent years, Sarathy noted that bitcoin in particular has become a “highly liquid, highly tradeable 24-hour market” with relative anonymity, which suits criminals and everyday users alike.
Transacting in bitcoin, which uses a public blockchain ledger to record every transaction, is not fully anonymous but rather pseudo-anonymous, meaning users initiate or receive payments through unique digital wallet addresses. Those addresses need not correspond to actual real-world addresses or residences, just as users need not create those addresses under their own names, Sarathy said.
Still, the movement of funds remains permanently visible and traceable on the network. That is because every transfer of bitcoin is publicly logged and immutable, meaning users cannot alter or erase network information, he said. But users can create numerous wallet addresses and route funds through layers of transactions so as to muddy the tracks.
In the crypto space, this technique is called “chain hopping.” It has been linked to transnational crime networks, he said.
“What you’re trying to do is obfuscate as much as possible which wallet the currency is actually ending up in,” Sarathy said.
Editor’s Picks
Another tactic, Sarathy said, is known as “mixing,” in which users rely on specialized software to bundle their transaction together with dozens of others, making it harder to distinguish who sent what. Rather than processing a single transfer, a mixer pools funds from multiple digital wallets and redistributes them, obscuring the original source of the cryptocurrency.
One such service, Tornado Cash, drew federal scrutiny and was later sued over allegations that it enabled money laundering. In August 2022, the U.S. Treasury Department’s sanctions office blacklisted the company, alleging it had been used to launder billions of dollars in stolen digital assets by obscuring the origin and destination of transactions on the Ethereum blockchain. Federal officials lifted the sanctions on the company in 2025.
How might investigators locate a suspect involved in any of these — or other — kinds of activities?
“They look for patterns like what are the common wallets that are used by certain addresses,” Sarathy said.
Investigators will use what are called transaction graph techniques to look for so-called clustering patterns. Those methods help them identify address reuse, where the same address is being used over and over by certain parties; locate any associations between wallets and addresses; and spending patterns.
“All of this is probabilistic. But over time, you get closer and closer to identifying these people, these various bad actors,” Sarathy said.
Investigators increasingly rely on blockchain forensics firms that analyze transaction patterns in an effort to link digital wallets to real-world identities, Sarathy said.
A third ransom note was reportedly sent to TMZ on Wednesday that the outlet said contained “a legitimate bitcoin address.” But TMZ noted it was a different address than the one provided in a ransom note reportedly received by two Tucson, Arizona-based news stations.
