A former FBI agent received four cryptocurrency ransom emails about missing 84-year-old Nancy Guthrie, messages the bureau said did not match wallets tied to notes it viewed as potentially authentic.
Jennifer Coffindaffer, a former FBI agent and NewsNation law-and-justice contributor, got the four disturbing emails at her personal address in April, roughly two months after Nancy Guthrie vanished from her Arizona home. One message included an image that appeared to show the missing woman in distress. Coffindaffer did not engage the senders. She forwarded the traffic straight to the FBI.
Realtor.com reported that she kept quiet for months, then spoke publicly after learning another person near the Guthrie home had received a nearly identical communication. More than eight months after the disappearance, the episode underlines a hard fact of high-profile cases: predators try to cash in while a family still searches for answers.
The senders demanded cryptocurrency. The amounts were relatively small beside multimillion-dollar sums tied to other ransom traffic in the case. Coffindaffer treated the messages as a law-enforcement matter, not a negotiation.
The FBI later told her the cryptocurrency wallet address in those emails did not match wallets linked to ransom notes investigators considered potentially authentic. That finding cut against any claim the April traffic was a real channel to Nancy’s captors.
Coffindaffer has cast doubt on the messages’ authenticity. She believes the senders tried to exploit a widely watched investigation and may have targeted her because of her public commentary and advice on the case. She has also voiced concern about how strangers obtained her personal email and noted that personalization can signal a coordinated effort rather than a random blast.
Lauren Serpa, who lives near Nancy’s home in the Catalina Foothills area outside Tucson, received a similar message. She shared details on Facebook, including a photograph that looked nearly identical to the image sent to Coffindaffer.
That overlap is what moved Coffindaffer to discuss the April emails. Two separate inboxes. Same kind of pitch. Same kind of picture. The pattern fit a hustle built on public fear, not a verified proof-of-life channel.
The Pima County Sheriff’s Department has faced the same problem from another direction. On Sept. 29, the department confirmed it had information about a new communication and was weighing whether it had any credibility. Officials later determined that message was not credible and warned the public about attempts to exploit the investigation for financial gain.
In plain terms: people are trying to turn a missing-person case into a payday. Authorities have said so out loud. Paying strangers in bitcoin on the strength of an unsolicited email is how families and bystanders get burned twice, once by the crime, again by the grift.
Nancy Guthrie, mother of “Today” show anchor Savannah Guthrie, was 84 when she disappeared from her residence in the Catalina Foothills near Tucson. Savannah has issued repeated public pleas for her mother’s return.
Pima County Sheriff Chris Nanos said in a Feb. 5 media briefing that the times are approximate and that investigators pieced together the sequence from available evidence. The reconstructed clock runs as follows.
On Jan. 31 at 5:32 p.m., Nancy took an Uber to Annie’s house for dinner and games with family. At 9:48 p.m., a garage door at Nancy’s property opened when her daughter dropped her off. Two minutes later the door closed, a sign she had gone inside.
Early on Feb. 1, the picture changed. At 1:47 a.m., her doorbell security camera disconnected. At 2:12 a.m., a camera registered movement; no footage of that moment is available. At 2:28 a.m., her pacemaker app showed the device had disconnected from her phone.
By mid-morning the absence was obvious. Around 11:00 a.m., Nancy failed to arrive at a friend’s home to watch a church service livestream. At 11:56 a.m., family members went to her house and found it empty. They called 911 at 12:03 p.m. Officers arrived at 12:14 p.m. She was reported missing around noon local time, about 14 hours after the drop-off. Friends had already flagged that she missed her usual Sunday church gathering.
FBI-related material in the public record has included footage from the home showing a masked intruder. Tip lines remain open: 1-800-CALL-FBI, tips.fbi.gov, 520-351-4900, and 88-CRIME.
Coffindaffer’s choice was the professional one: do not feed the senders, route the traffic to the bureau, and let investigators test the wallets and the claims. Serpa’s matching photo made the April batch harder to dismiss as a one-off oddity aimed at a single commentator.
The sheriff’s September warning fits the same pattern. When a case draws national attention, copycat ransom notes and fake “proof” become a secondary industry. Small bitcoin asks can look easier to swallow than huge demands. That is part of the con.
None of the Step 1 reporting establishes that the Coffindaffer or Serpa senders had any real role in the disappearance. The FBI wallet mismatch and the sheriff’s non-credible finding point the other way. The open wound is still Nancy’s whereabouts. The emails were noise attached to that wound.
High-profile investigations attract two kinds of attention: people who want to help, and people who want a cut. The second group counts on panic and decency. The only safe answer is the one Coffindaffer gave, hand it to the FBI and refuse to play.
