Nancy Guthrie Case Reframed by Crypto Firm’s “Wrench Attack” Label as Police Confirm Motive Pending

More than four months after 84-year-old Nancy Guthrie vanished from her Tucson, Arizona, home, a retired FBI agent says a leading cybersecurity company has publicly classified the case as a cryptocurrency-motivated kidnapping — what the industry calls a “wrench attack by proxy.” If the designation holds up, it would reframe the disappearance of Today co-anchor Savannah Guthrie’s mother as part of a documented and growing pattern of violent crimes targeting people connected to digital-currency wealth.

What CertiK Said

Jennifer Coffindaffer, a retired FBI agent and NewsNation contributor, posted on X on Saturday, June 13, sharing a screenshot from cybersecurity firm CertiK. In it, CertiK described Nancy Guthrie’s kidnapping as part of a “$6 million bitcoin ransom demand” and tied it to what the company called “the documented trend of proxy target selection already identified in our 2025 report.”

CertiK published a broader report documenting 34 verified wrench attacks between January and April 2026, a 41% increase from the 24 incidents recorded during the same period in 2025. Total losses from these attacks exceeded $101 million in just four months. Among the cases flagged in the report was the suspected abduction of Nancy Guthrie, which CertiK categorized as a potential “wrench attack by proxy.” Ransom notes demanding $6 million in Bitcoin were reportedly sent to multiple media outlets, including KGUN9 and TMZ.

What a “Wrench Attack” Means

The term “wrench attack” comes from the cryptocurrency world. It refers to a physical assault or threat, sometimes literally with a wrench or other weapon, aimed at forcing someone to hand over digital assets. A “proxy” variation targets not the crypto holder directly but a family member or associate, using the threat against that person as leverage. The term traces back to a satirical XKCD webcomic first published in 2009, built on the joke that it’s easier to beat someone with a wrench until they give up their password than it is to hack a cryptocurrency wallet.

Coffindaffer characterized the development in stark terms in her post. “Nancy Guthrie: It’s the biggest public break in Nancy’s Case as CertiK, arguably the Leading Crypto Security company in the World, has designated Nancy’s abduction as a Wrench attack by Proxy,” she wrote. “Does CertiK have knowledge as to (whether) Savannah has a Bitcoin account? This is a huge breakthrough. Times have changed. And how these networks operate is new to LE. Unless LE knows who took Nancy, then a Wrench by Proxy Is on the Table.”

An Important Caveat

Despite the attention generated by Coffindaffer’s post, the designation remains, at this stage, an outside assessment rather than a confirmed law enforcement finding. Nothing in the public domain confirms CertiK’s internal knowledge beyond the screenshot Coffindaffer shared, and the assessment remains speculative rather than established fact. The Pima County Sheriff’s Department, which is leading the inquiry, says detectives are still examining DNA and pursuing leads, but no suspect has been identified. The FBI is assisting, yet there has been no confirmation that agents accept the “wrench attack” label or see the case as part of a wider crypto-crime pattern.

Authorities have not officially confirmed any motive in the case, despite the various theories that have circulated publicly in recent weeks.

A Pattern Beyond This Single Case

CertiK’s broader research frames the Guthrie case as one example of an accelerating trend rather than an isolated incident. The blockchain security firm’s data shows wrench attacks are not slowing down. As the report notes, hardware wallets, multisig setups, and time-locked transactions were designed to protect against digital threats, but they do very little when someone threatens a person’s family. The Guthrie case illustrates that wealth proximity, not just wealth ownership, creates risk — meaning a person doesn’t need to hold Bitcoin to become a target, only to be connected to someone who does, or who is perceived to.

The Broader Investigation

The case has remained under intense investigation since Guthrie’s disappearance from her home in the Catalina Foothills area near Tucson. She was last seen at her home on January 31, according to reports, and was reported missing by family the following day. Since then, the Pima County Sheriff’s Department and the FBI have been processing DNA evidence, following up tips, and reviewing ransom letters connected to the case.

The investigation was formally upgraded from a missing persons case to a homicide investigation earlier this year, even as no official suspect has been named. A masked individual captured on Guthrie’s doorbell camera around the time of her disappearance remains a central, unidentified focus of the inquiry.

Savannah Guthrie’s Continued Absence

Savannah Guthrie has continued to navigate her role at Today amid the ongoing search for her mother, periodically stepping away from her anchor duties. She returned to the broadcast earlier this year following an extended leave of absence after her mother’s disappearance, though she has continued to take intermittent breaks from the show as the investigation has stretched on.

What Comes Next

With CertiK’s assessment now circulating widely but still unconfirmed by the FBI or Pima County investigators, the central question facing the case remains the same one that has persisted for months: whether law enforcement can convert the various competing theories — cryptocurrency ransom, the unidentified masked suspect, or other leads — into an actual identified perpetrator. Coffindaffer’s post suggests the crypto angle may open investigative doors that traditional law enforcement has been slow to walk through, but until the FBI or Pima County Sheriff’s Department issues an official statement addressing CertiK’s designation directly, the “wrench attack” theory remains one competing explanation among several in a case that has now stretched well past the four-month mark without a confirmed suspect or a resolution for the Guthrie family.

Anyone with information related to Nancy Guthrie’s disappearance is urged to contact the FBI at 1-800-CALL-FBI. The family’s $1 million reward and the FBI’s $100,000 reward for information remain active.