Six months after Nancy Guthrie was kidnapped from her Tucson-area home, a dormant bitcoin wallet connected to a ransom demand could still yield crucial evidence for investigators, according to Bezalel Eithan Raviv, CEO and founder of Lionsgate Network, a crypto recovery service.
Raviv explained that an unused wallet address can be valuable because investigators can examine its potential connections to other known wallets, past criminal investigations, darknet activity, or scam infrastructure. "An unused wallet can still be valuable," Raviv stated. "Investigators examine whether the address has any relationship to other known wallets, whether it appears in previous criminal investigations, darknet activity, or scam infrastructure, or blockchain clustering databases."
Even without incoming funds, the wallet address can connect to a broader network through accumulated attribution intelligence. Raviv emphasized that the strength of blockchain intelligence often lies in the relationships between wallets, infrastructure, and actors, rather than solely in the movement of funds. He cautioned that bitcoin demands should not be analyzed in isolation, noting that the timing of the demand, the wording, delivery method, and communication infrastructure often provide more intelligence than the wallet itself.
A wallet that remains completely unused might indicate it was created solely for communication purposes, that the sender anticipated payment through an alternative method, or that the demand was never intended to be fulfilled. "The absence of activity is itself a data point, although it should never be interpreted in isolation," Raviv said.
Digital investigations extend beyond blockchain transactions. Raviv noted that investigators can analyze how the wallet address was generated, the devices or services used to create it, its presence elsewhere online, associated metadata, communication channels, linguistic patterns, timestamps, and any operational security mistakes made by the sender. "In digital investigations, what did not happen can sometimes be just as significant as what did," he said.
Raviv also theorized that the ransom demand could have been intended as a distraction. "Criminal actors sometimes introduce cryptocurrency into high-profile cases because it immediately attracts public attention and creates the perception of technical sophistication," he explained. "In some investigations, ransom communications are genuine. In others, they may serve to misdirect investigators, exploit media attention, or complicate the investigative timeline."
Regarding the passage of time, Raviv stated that "time can work both ways." While some evidence may degrade or records expire, blockchain data is permanent, and attribution intelligence continues to grow. "Exchanges cooperate with law enforcement, new sanctions are issued, additional criminal infrastructure is identified, and intelligence databases expand over time," he said. He believes investigators will continue to monitor the ransom wallet indefinitely due to the high-profile nature of the case.
Nancy Guthrie, mother of “Today” show host Savannah Guthrie, was reported missing from her Tucson-area home on February 1. Several ransom notes have since surfaced, including one demanding $6 million in bitcoin. Approximately $152 worth of bitcoin was deposited into a publicly viewable account, but the funds have not been moved. No suspect has been arrested, though authorities released security footage of an armed, masked individual outside Guthrie's home on the night she disappeared.
Ahead of the six-month anniversary of her mother's disappearance, Savannah Guthrie shared a plea for information on Instagram, describing her family's ongoing anguish and their feeling of being in a "nightmare that will not end."