AT THIS HOUR, AUTHORITIES IN ARIZONA ARE ASKING FOR ANY KIND OF VIDEO THAT COULD LEAD THEM TO NANCY GUTHRIE. ONE QUESTION IN THIS INVESTIGATION IS, WAS SHE KIDNAPED FOR RANSOM? THERE HAVE BEEN REPORTS OF RANSOM NOTES, BUT IT’S NOT CLEAR IF THE GUTHRIE FAMILY HAS PAID ANYTHING AT THIS POINT. WESH 2’S LINDSEY TALKED WITH A FORMER FBI AGENT ON HOW THAT COULD BE A CRITICAL PART OF THE INVESTIGATION. VERY VALUABLE TO US, AND WE WILL PAY THE MAJORITY OF US. WATCH THAT VIDEO POSTED BY SAVANNAH GUTHRIE AND HER SIBLINGS SATURDAY. AND ALL WE COULD THINK IS THAT POOR FAMILY. BUT LAW ENFORCEMENT AND TECH EXPERTS LIKE KYLE ARMSTRONG ALSO SEE AN OPPORTUNITY THERE TO BRING NANCY GUTHRIE HOME. THE PAYMENT IS MADE AND IT GOES THE BLOCKCHAIN WORLD. AT SOME POINT IT WILL BE CASHED OUT FOR FIAT CURRENCY. AND THAT’S THE OPPORTUNITY THAT LAW ENFORCEMENT WILL LOOK FOR. WHAT IS THE BLOCKCHAIN? ARMSTRONG, A FORMER FBI AGENT, NOW WORKS FOR TRM LABS, WHICH SPECIALIZES IN BLOCKCHAIN INTELLIGENCE. ANYTIME THERE’S A BITCOIN TRANSACTION, THAT TRANSACTION IS PUBLISHED ON THE OPEN INTERNET, AND THE BLOCKCHAIN IS ESSENTIALLY THE RECORDING OF THAT TRANSACTION. TRANSACTIONS ARE FROM ONE ADDRESS TO ANOTHER. AND ANONYMOUS, OFTEN 20 PLUS CHARACTERS ALPHANUMERIC THAT ARE HARD TO CRACK. THEY ARE COMPANY WORKS TO US TO FOLLOW THOSE TRANSACTIONS, TO MAKE IT EASY TO GRAPH THOSE TRANSACTIONS, AND SIMPLER TO EXPLAIN. BUT HOW QUICKLY CAN YOU TRACK IT? ONCE A TRANSACTION IS HAS BEEN MADE AND THERE IS A RECIPIENT ADDRESS, THEN YOU CAN BASICALLY FLAG THAT ADDRESS. AND THEN ANYTIME THE ASSETS MOVE, THAT FLAG WILL CARRY WITH THEM IN THE IN OUR INTERNAL SOFTWARE. AND SO EVEN IF IT MOVES TEN TIMES IN A CIRCUITOUS MANNER, WHEN THE FUNDS EVENTUALLY HIT ONE OF THESE EXCHANGES, THEY WILL KNOW. SO KYLE ARMSTRONG SAYS IF A SUSPECT DOES TRY TO WITHDRAW THAT MONEY, THE EXCHANGE WOULD THEN FREEZE IT AND IMMEDIATELY CONTACT POLICE. THAT IS REALLY INTERESTING. BUT WHAT HAPPENS IF THEY DON’T TRY TO WITHDRAW IT AND THEY TRY TO DO SOMETHING ELSE, OR BUY SOMETHING ELSE? REALLY GOOD QUESTION. BUT THINK ABOUT THIS. YOU CAN’T REALLY GO OUT RIGHT NOW AND BUY A CAR OR A HOME WITH BITCOIN. MAYBE THAT COULD HAPPEN IN THE FUTURE. EVENTUALLY YOU HAVE TO CASH SOMETHING OUT. AND IN FACT, ARMSTRONG POINTED TO A 2016 NEW YORK CASE WHERE IT’S BELIEVED A COUPLE STOLE CRYPTO BUT COULD NOT ACTUALLY SPEND IT. SO THEY STARTED BUYING UP GIFT CARDS. THE MOMENT THEY DID THAT, THERE WAS A RECORD. AND HE SAYS, YOU WILL BE
Nancy Guthrie disappearance: Former FBI agent weighs in on tracking ransom money
Updated: 4:49 PM PST Feb 12, 2026
A former FBI agent who worked 14 years investigating illicit finance cases said the ransom note could be the opportunity to find “Today” show anchor Savannah Guthrie’s mother, Nancy.It’s unclear if the Guthrie family has agreed to pay anyone, but there were reports of two ransom notes demanding payment in Bitcoin. Kyle Armstrong, who worked for the FBI, now works for a blockchain intelligence company called TRM Labs. “If a ransom is paid, I’m certain that there will be several investigators,” Armstrong said. “When money goes in, there’s not a lot of retail use of cryptocurrency, especially a sizable amount. You really can’t buy cars. You can’t go to fancy vacations. You can’t do a lot of retail things with crypto. Ultimately, you have to exchange the cryptocurrency, primarily for fiat currency, for regular U.S. dollars, euros, whatever it is. That presents, usually, the opportunity for law enforcement to learn who is controlling this account.”When there’s a transaction, it’s from one address to another that is anonymous, but TRM Labs has a tool that can help law enforcement decipher that. “Anytime there’s a Bitcoin transaction, that transaction is published on the open Internet, and the blockchain is essentially the recording of that transaction. Our company works to follow those transactions, to make it easy to graph those transactions and simpler to explain. And then ultimately, we try to identify who’s controlling the addresses,” Armstrong said. He said there are cases where they can even flag the transaction so it can follow multiple movements. “Anytime the assets move, that flag will carry with them in the internal software. So even if it moves 10 times in a circuitous manner, when the funds eventually hit one of these exchanges, and they will know those funds have been identified by law enforcement as illicit,” Armstrong said.
A former FBI agent who worked 14 years investigating illicit finance cases said the ransom note could be the opportunity to find “Today” show anchor Savannah Guthrie’s mother, Nancy.
It’s unclear if the Guthrie family has agreed to pay anyone, but there were reports of two ransom notes demanding payment in Bitcoin.
Kyle Armstrong, who worked for the FBI, now works for a blockchain intelligence company called TRM Labs.
“If a ransom is paid, I’m certain that there will be several investigators,” Armstrong said. “When money goes in, there’s not a lot of retail use of cryptocurrency, especially a sizable amount. You really can’t buy cars. You can’t go to fancy vacations. You can’t do a lot of retail things with crypto. Ultimately, you have to exchange the cryptocurrency, primarily for fiat currency, for regular U.S. dollars, euros, whatever it is. That presents, usually, the opportunity for law enforcement to learn who is controlling this account.”
When there’s a transaction, it’s from one address to another that is anonymous, but TRM Labs has a tool that can help law enforcement decipher that.
“Anytime there’s a Bitcoin transaction, that transaction is published on the open Internet, and the blockchain is essentially the recording of that transaction. Our company works to follow those transactions, to make it easy to graph those transactions and simpler to explain. And then ultimately, we try to identify who’s controlling the addresses,” Armstrong said.
He said there are cases where they can even flag the transaction so it can follow multiple movements.
“Anytime the assets move, that flag will carry with them in the internal software. So even if it moves 10 times in a circuitous manner, when the funds eventually hit one of these exchanges, and they will know those funds have been identified by law enforcement as illicit,” Armstrong said.