Sheriff Releases Nancy Guthrie Ransom Notes Demanding $4 Million

The mother of a network TV anchor vanished from her Arizona home in the middle of the night. Six months later, nobody has been arrested. Now investigators are trying something they usually don't.

On Friday, July 31, the Pima County Sheriff's Department released two ransom notes tied to the disappearance of Nancy Guthrie, the 84-year-old mother of TODAY co-host Savannah Guthrie. Nancy was last seen at her house in the Catalina Foothills neighborhood near Tucson on the evening of January 31, 2026. The notes had been private for months. Now they are out in the open, and the reason is simple. The sheriff wants someone to recognize the way the writer talks.

The First Note Asked for $4 Million in Bitcoin

The first note landed February 2 at the tip line for KOLD-TV, the CBS affiliate in Tucson. It was addressed straight to Savannah Guthrie. It read: "We have your mother Nancy. She is safe but scared. She will be held for ransom and once payment is received she will be released unharmed."

The writer wanted $4 million in Bitcoin, sent to a crypto wallet before 5 p.m. on Thursday, February 5. Miss that deadline, and the price jumped to $6 million by 5 p.m. on February 9. The note also carried a warning: "Do not play games, law enforcement will not be able to help you." It claimed Nancy would be handed back within 12 hours of payment, and it added a line meant to twist the knife: "Your mother is aware of this and her life is in your hands."

Two Details Nobody Outside the House Should Have Known

The first note ended with two specifics that got investigators' attention. The writer described a white smartwatch on the floor near Nancy's bed and a busted floodlight in the backyard. Neither detail had been shared with the public at that point. That is what gave investigators confidence the note might be real, and not the work of some random person chasing headlines. The station turned both letters over to the sheriff's office and the FBI as soon as they came in, and the crime scene details are a big part of why these two notes are the ones getting attention.

The Second Note Claimed She Was Already Gone

Four days later, on February 6, a second note showed up. The tone was completely different. It opened: "Guthrie Family, We did not fully grasp the seriousness of her physical condition. We never intended to hurt her, that was not our intention."

Then came the part the family had feared. "She perished shortly after she was taken. We believe it was heart related. She is buried in nature now. Nothing you could have done could have changed the outcome. We want your family to know this and hope you all can find peace. We are truly sorry." Both notes came from the same IP address, according to investigators. Savannah Guthrie said back in March that she believed the notes were real, and that the family had responded to them.

Why Release the Notes Now

The sheriff's department isn't hoping you can crack a code. They want you to recognize a person by the way they write. In its release, the department said the notes "reveal distinctive patterns of word choice, syntax, and phraseology that reflect the writer's unique linguistic style." The messages also offer "valuable insight into the person's mindset, motives, and the evolution of their tone over time."

In plain English: somebody out there texts, emails, or talks exactly like this. A coworker. A cousin. An old classmate. The kind of person who writes "perished" instead of "died," or "buried in nature" instead of anything a normal person would say. Investigators think a friend, family member, coworker, or acquaintance might read these words and feel a jolt of recognition.

The Unabomber Playbook

Investigators pointed to a case that actually worked this way. When the FBI pushed newspapers to print Ted Kaczynski's manifesto in 1995, his brother David and his sister-in-law read it and recognized the writing style and the anti-technology arguments. They tipped off the FBI, and that ended a manhunt that had gone on for nearly two decades.

Pima County is betting on the same thing. "We believe these distinctive linguistic characteristics may be recognizable to someone who knows or has interacted with the notes' writer," the department said in a statement drawing that comparison. It is an old trick, but it is one of the few that has actually closed a case like this.

The Behavior They Want You to Think About

Along with the writing, investigators listed the kind of behavior that might matter. They asked people to think back to the days around Nancy's disappearance and whether anyone they know showed changes in mood or appearance, unexplained injuries, a sudden departure from the area, unusual cleaning or repairing of a vehicle, or a strange interest (or a pointed lack of interest) in Nancy's neighborhood and the investigation itself.

The department also spoke directly to people who have stayed quiet out of loyalty or fear. "Relationships and loyalties change over time," they wrote, all but inviting someone close to the writer to reconsider.

How Far Investigators Have Gone

This has not been a quiet case. The FBI released photos of a masked person walking up to Nancy's front door in the middle of the night. Investigators say the suspect visited her home before the abduction, and they believe the kidnapping was planned.

The tech side is its own story. Nancy's doorbell camera, a Nest device, was physically missing, and she did not have a cloud subscription. Even so, the FBI and Google worked together to recover footage from it. Two videos pulled from the camera may be from two separate days, and investigators called them "critical" to understanding the unidentified man's behavior. Hair found inside the home has been tested for DNA, but so far it does not point to a suspect.

The Fake Notes Problem

Not every note in this case is treated as real. In July, a man from Hawthorne, California, pleaded guilty to sending a fake ransom note to the Guthrie family. The FBI has said it received several ransom notes over the course of the investigation, and some could be legitimate. The two released July 31 are the ones investigators are focused on, partly because of those crime scene details and the shared IP address.

There is also an odd side note. Two men who were briefly detained in the case are reportedly seeking more than $3 million in damages, a reminder of how many people have been pulled into this and cleared.

What the Family Is Saying

Savannah Guthrie stepped away from the TODAY anchor desk after her mother vanished and returned about two months later. In the days around the release of the notes, she shared a message about her family's "agony and despair," writing that they are "begging for help" and hoping "someone recognizes the writing in the ransom demand notes."

Earlier she called the whole thing "an unending nightmare" and pleaded with whoever took her mother to "tell us where to look for her." The family has been clear about one thing the entire time. They want Nancy home.

What to Do If Something Clicks

If any of this rings a bell, the writing style, the behavior, a person who dropped off the map around early February, there are two numbers to call. The FBI tip line is 1-800-CALL-FBI (1-800-225-5324). Locally, 88-CRIME takes anonymous tips.

There is real money attached. The Guthrie family is offering a $1 million reward for information that leads to Nancy's recovery, and the FBI is offering up to $100,000 on top of that. Six months in, with surveillance images, DNA testing, and recovered video, no suspect has been named and no arrest has been made. A task force of Pima County investigators and FBI agents is still working the case. This time, they are counting on a stranger reading two notes and thinking, I know exactly who wrote that.