The dormant bitcoin ransom wallet could still lead investigators to “valuable” evidence in their search for Nancy Guthrie — even six months after she was kidnapped, according to a cryptocurrency expert.
Bezalel Eithan Raviv, the CEO and founder of Lionsgate Network — a crypto recovery service with expertise in blockchain forensics — spoke with Page Six about the deposit that was made into a bitcoin wallet related to Guthrie’s ransom note in February.
“An unused wallet can still be valuable,” Raviv said. “Investigators examine whether the address has any relationship to other known wallets, whether it appears in previous criminal investigations, darknet activity, scam infrastructure, or blockchain clustering databases.”
Even without incoming funds, Raviv explained that the address can “connect to a broader net worth” through attribution intelligence accumulated over time.
“This illustrates one of the biggest strengths of blockchain intelligence,” he said. “The value often lies in the relationships between wallets, infrastructure, and actors, not simply in the movement of funds.”
The financial fraud investigator warned that bitcoin demands should never be examined “in isolation.”
“In modern investigations, a cryptocurrency wallet is only one artifact among many,” he said. “The timing of the demand, the wording, the delivery method, the infrastructure used to communicate it, and the broader behavioral pattern often provide more intelligence than the wallet itself.”
An unused wallet could also signal that the transaction was used as a vehicle for communication.
“A wallet that remains completely unused may indicate that it was generated solely for a single communication, that the sender anticipated payment through another mechanism, or that the demand itself was never intended to reach the payment stage,” he said, before pointing out, “The absence of activity is itself a data point, although it should never be interpreted in isolation.”
“In digital investigations, what did not happen can sometimes be just as significant as what did,” he said.
Even in the absence of activity, Raviv said investigators can “absolutely” continue to obtain new information.
“Digital investigations extend far beyond blockchain transactions,” he said. “Investigators analyze how the address was generated, the devices or services used to create it, whether it appears elsewhere online, associated metadata, communication channels, linguistic characteristics, timestamps, and operational security mistakes made by whoever distributed it.”
Raviv also theorized the possibility of the ransom demand being designed as a distraction.
“Criminal actors sometimes introduce cryptocurrency into high-profile cases because it immediately attracts public attention and creates the perception of technical sophistication,” he said.
“In some investigations, ransom communications are genuine. In others, they may serve to misdirect investigators, exploit media attention, or complicate the investigative timeline.”
As for whether the passage of six months can make the crypto investigation more complicated, Raviv said, “time can work both ways.
“Some evidence becomes more difficult to obtain as records expire or digital services change,” he said. “However, blockchain data is permanent. More importantly, attribution intelligence continues to grow.
“Exchanges cooperate with law enforcement, new sanctions are issued, additional criminal infrastructure is identified, and intelligence databases expand over time.”
Due to the high-profile nature of Guthrie’s case, Raviv believes investigators will continue to monitor the ransom wallet indefinitely.
“A wallet that appears dormant today may become operational months later, creating new intelligence opportunities and potentially revealing connections that were previously impossible to establish,” he said.
Savannah Guthrie’s 84-year-old mom was reported missing from her Tucson-area home on Feb. 1.
Several alleged ransom notes have since surfaced, including one demanding that $6 million in bitcoin be sent to a digital address in exchange for Nancy’s release. Shortly after, about $152 worth of bitcoin was deposited in the account’s publicly viewable logs.
However, those funds have yet to be transferred out of the account.
No suspect has been arrested in the case, though authorities did release terrifying security footage of an armed and masked individualstanding outside of Nancy’s Arizona home on the night she went missing.
Ahead of the six-month anniversary of Nancy’s disappearance, the “Today” show host took to Instagram to share a heartbreaking message begging for more informationabout her mom.
“I’m coming to today with a very specific message. It has been months since our mom was taken from us. Our family is in agony,” she said in the Instagram video Monday.
“We are in a nightmare that will not end — nothing about our situation has changed.”
The post How bitcoin ransom in Nancy Guthrie case could still hold ‘valuable’ evidence 6 months after kidnapping appeared first on Page Six.
