ANALYZING EVIDENCE
Processing case files...
Processing case files...

Tucson-area elderly abduction
CLASSIFICATION: Kidnapping
LOCATION
Catalina Foothills, Arizona, US
TIME PERIOD
February 1, 2026
VICTIMS
1 confirmed
An 84-year-old woman was taken from her home in the Catalina Foothills in the early hours of February 1, 2026; evidence at the residence indicates she did not leave voluntarily. Law enforcement, led by the Pima County Sheriff's Department with FBI assistance, has recovered the victim's blood and video showing a masked, armed individual tampering with a doorbell camera. Multiple ransom notes claiming custody and one claiming the victim died have been received and partially assessed; several leads and forensic samples remain under analysis. The victim's whereabouts and condition remain unknown and the investigation is ongoing.
Some believe Nancy Guthrie was abducted by an opportunistic intruder — the masked figure seen tampering with the doorbell camera and the blood inside the home are pointed to as evidence of a forced kidnapping and a ransom-motivated scheme. Investigators and armchair sleuths have debated whether the crypto ransom note and the follow‑up note claiming she died are authentic — the language in the letters has prompted speculation that the writer might be an acquaintance or someone recognizable to the family, while others treat the notes as potential hoaxes or deliberate misdirection. Cross‑border theories also persist after tips suggested she could be deceased and taken toward Nogales, Mexico, though searches have been unsuccessful and several early leads (including a detained person, a Range Rover, and gloves with trace DNA) were later discounted or called red herrings.
Sometime in the early hours of Sunday, February 1, 2026, someone came to the low-slung brick house at the end of a gravel drive in Tucson’s Catalina Foothills and took 84‑year‑old Nancy Guthrie out of her life. [1][2]
© Mapbox © OpenStreetMap
By midday, deputies would be staring at blood outside her front door, a missing doorbell camera, and a home that did not look like a place an elderly woman with limited mobility simply decided to walk away from. [1][3]
Within days, ransom notes demanding millions in Bitcoin, and then claiming she was dead and “buried in nature,” would land in media inboxes and in the hands of her family. [4][5]
Investigators quickly called it what it appeared to be: a kidnapping from a bed in the middle of the night. [1][2][6]
Nancy Guthrie has not been seen since.
Nancy Guthrie was, first, not a headline but a grandmother and the longtime Tucson mother of NBC Today co‑anchor Savannah Guthrie, her brother Camron, and sister Annie. [1][7][8]
At 84, she lived alone in the Catalina Foothills outside Tucson. [1][3] She had “very limited” mobility — family told Sheriff Chris Nanos she “couldn't walk 50 yards” — and investigators stressed she was a vulnerable adult who would not have left on her own. [1][3][9]
Latest Updates: Nancy Guthrie's Family Cleared in Her Disappearance, Sheriff Says - The New York Times
Her mind, everyone agreed, was sharp. Nanos repeatedly emphasized that she had no cognitive impairment and that this was “not dementia related,” calling her “as sharp as a tack.” [3][7][9]
What made her most fragile, and what ratcheted up the urgency when she vanished, was the medicine. Nancy took daily, essential medications for a heart condition, and both family and law enforcement said going without them for 24 hours could be fatal. [1][3][10]
“This is not somebody that just wandered off,” Nanos told reporters. [9]
On Saturday, January 31, Nancy spent the evening with family. Sheriff Nanos later laid out the timeline: around 5:32 p.m., an Uber driver brought her to one of her daughters’ homes for dinner. [11]
After the visit, family members drove her back. Security data show the garage door at her Catalina Foothills house opening at 9:48 p.m. and closing two minutes later. [11]
Nanos and later accounts put her final sighting by family around 9:30–9:45 p.m., when she was dropped off at home. [3][12][13] A New York Post report, echoing what authorities had said, noted that her son‑in‑law, Tommaso Cioni — married to Annie — was the last person known to have seen her and that he ensured she got inside before leaving. [14]
Inside, investigators would later find her car and cellphone still at the house. [1] That detail, paired with her physical limitations, helped convince detectives that whatever happened to her, it didn’t involve a voluntary stroll into the desert. [1][3]
If no neighbor heard a scream, the electronic infrastructure around Nancy’s home recorded a quieter story.
An official timeline released days later showed that at 1:47 a.m. on Sunday, February 1, her doorbell camera disconnected. [11] Shortly afterward, at 2:12 a.m., software detected a person on the device — but there is no video available from that detection. [11]
At 2:28 a.m., Guthrie’s bedside pacemaker monitor stopped communicating with her phone, a missed transmission that would later loom large in investigators’ understanding of when she was taken. [6][11]
Those timestamps drew a tight window for what detectives were increasingly certain was an abduction in her sleep. [2]
The first sign something was wrong came from church. On Sunday morning, when Nancy failed to arrive for services or to watch a virtual church gathering with a friend, someone from her church called her family. [2][4][7]
Family members went to her house late that morning, around 11–12 o’clock, and searched for her themselves. [1][2][7] When they couldn’t find her, a relative called 911 just after noon. [11][15] Deputies were on scene by about 12:15 p.m. [11]
Why Annie Guthrie, Tommaso Cioni got home surveyed day before Nancy's disappearance? 'Investigator' asks shock question | Hindustan Times
Whatever they saw inside and on the porch alarmed them. Nanos later said deputies “saw some things at the home that were concerning to us” and quickly treated the house as a crime scene. [2][3][7]
Outside, news cameras would soon capture images of dried droplets of blood leading away from Nancy’s front door. [1] A separate report noted that the blood on the porch matched her DNA. [11][16]
Investigators also found that the Ring doorbell camera had been removed from its mount by the time police arrived. [1] Nanos said they were examining whether it had been intentionally taken. [1]
Inside, her cellphone and car remained at the property, and deputies collected DNA samples from the home. [1][17]
By Monday, homicide detectives were on the case — something the sheriff’s office acknowledged was “not standard protocol” for a missing‑person report. [1][15]
“We believe now, after we’ve processed that crime scene, that we do, in fact, have a crime,” Nanos told reporters. [7]
At first, the Pima County Sheriff’s Department threw everything it had at the idea that Nancy might still be somewhere nearby. [15] Search‑and‑rescue teams worked through Sunday night with drones, helicopters, heat‑sensing cameras, dogs, and volunteers combing the surrounding desert. [1][3][7]
Neighbors described law enforcement going door to door, asking to see Ring footage and to search backyards. [7] Helicopters equipped with infrared cameras swept the area. [7] Border Patrol joined in. [1]
But as the hours passed, the focus shifted. By February 2, Nanos was blunt: “Right now we don't see this as a search mission so much as we do a crime scene.” [2][3][7]
Investigators said they did not believe Nancy left willingly and believed she had been abducted in her sleep from her home. [2]
State and federal agencies, including the FBI, joined the investigation. [2][6][11] The sheriff’s office confirmed the case was a joint investigation with the bureau, and that certain details were being withheld at the FBI’s request. [18]
Inside the house, detectives pulled security‑camera footage from the system and began a forensic review of Nancy’s cellphone and other electronic devices, including pacemaker‑related data. [2][3]
Outside, they canvassed neighboring homes and license‑plate readers and urged residents to check any camera footage captured between 1 and 4 a.m. Sunday. [1][3][17]
All the while, Nanos kept circling back to the same grim arithmetic: Nancy’s medications, her frail heart, and the time ticking by. [2][3][6]
The day after Nancy was reported missing, the story took a turn that would define it in the public imagination.
On February 2, Tucson CBS affiliate KOLD received a handwritten ransom note referring to Nancy’s abduction. [1][19] The note, which CBS reported investigators were taking seriously and had shared with the FBI, contained specific details about the Guthrie home: the layout of Nancy’s bedroom, what she’d been wearing the night she disappeared, and descriptions of the property. [5][19]
That same note, or a version of it, also landed at TMZ, the Hollywood‑based outlet that broke the first story of a ransom demand. [19] TMZ said the letter was sent to them on Tuesday morning, February 3, and demanded “millions” in Bitcoin, specifying a particular cryptocurrency address, a deadline, and an “or else.” [19][20]
The Pima County Sheriff’s Department publicly acknowledged it was “aware of reports circulating about possible ransom note(s)” and stressed that all tips and leads were being sent directly to detectives coordinating with the FBI. [1][19][20]
That first note — later released with redactions — began, “Hello Savannah, we have your mother Nancy. She is safe but scared.” [4][5] It demanded $4 million in Bitcoin by 5 p.m. Thursday, February 5, with a threat that the ransom would escalate to $6 million if not paid by 5 p.m. Monday the 9th. [4]
“If payment is not received by the final deadline… we will kill your mother,” the writer warned, adding, “Your mother is aware of this and her life is in your hands.” [4]
The writer told the family they could not contact the kidnappers and that “law enforcement will not be able to help you.” [4] The note closed with a detail intended to prove firsthand knowledge: that Nancy had left “a white smart watch on the floor at the foot of her bed” and that “the white flood light in [the] backyard was destroyed.” [4][20]
Authorities treated that first communication as “apparently credible” in the early days, and NBC News reported investigators believed two initial notes were potentially written by the abductor. [4][21]
Four days after the first letter, a second arrived. [4] This one did not demand money. Instead, it said the kidnappers “did not fully grasp the seriousness of her physical condition” and that they had “never intended to hurt her.” [4][5]
“She perished shortly after she was taken. We believe it was heart related. She is buried in nature now,” the writer claimed. [4][5][22]
The note apologized to the family and said Nancy was “with nature now,” but offered no location, no body, and no proof she had in fact died. [4][5][23]
For investigators, the second note changed almost nothing in public. NBC News, which later disclosed its contents, reported that the letter included no apology for kidnapping, no request for payment, but did “express regret over her passing.” [21] The Pima County Sheriff’s Office said it could not verify that Nancy was dead and that the case remained an active investigation. [4][5]
Inside the family, though, it landed like a separate kind of blow.
By February 4, Savannah Guthrie had stepped off the Today show set and into the role of a daughter speaking to whoever might have her mother. [5][8]
In a tense Instagram video, she sat flanked by her siblings, Annie and Camron, and spoke directly to the kidnapper. [6][13] She said the family was “ready to talk” and “ready to listen” but needed proof of life, noting that in a world of increasingly sophisticated AI, images and even video could be faked. [6][13]
“We live in a world where voices and images are easily manipulated,” she warned. [13] FBI Phoenix special agent in charge Heith Janke echoed that caution, telling reporters that with AI, investigators could no longer automatically treat a video as genuine proof a victim was alive. [13]
After word of the second note filtered to her, Savannah released a second, shorter video. “We received your message and we understand,” she said, holding her siblings’ hands. “This is very valuable to us, and we will pay.” [21]
She begged whoever had Nancy — or knew where she was — to “do the right thing” and to send information that would allow the family to bring her home or, if the worst had happened, to say goodbye with dignity. [4][21]
Seeking Information – Nancy Guthrie Video Footage - 01.webm
Wikimedia Commons· Public domain
Her public anguish became a recurring feature of a case that was starting to feel national: she stepped away from her show for more than two months, turned down plans to host the 2026 Winter Olympics opening ceremony, and used her platform to keep her mother’s name in the news while asking viewers to check security footage and submit tips. [5][12][21]
On February 24, with no proof of life and no suspect publicly identified, the family went further, offering a $1 million reward for information leading to Nancy’s return. [5][17] The FBI added $100,000. [5][18]
“Our hearts are in ruins,” Savannah later said, as investigators released full copies of the two ransom notes that summer and asked the public to study the writer’s “distinct linguistic characteristics.” [4]
The swirl of ransom communications eventually produced at least one clear criminal case — but not against Nancy’s kidnapper.
On February 5, federal investigators in Arizona announced charges against a California man they said had sent text messages to the Guthrie family posing as the abductor and demanding Bitcoin. [13][24]
Court documents described two texts, sent within minutes of each other to Annie Guthrie and her husband, Tommaso Cioni: “Did you get the bitcoin were [sic] waiting on our end for the transaction.” [24]
Agents traced the messages to a VOIP phone line registered to the man’s Gmail account and determined they’d been sent from his home in California. [24] When confronted, he admitted sending them. [24]
Prosecutors were careful to draw a line. There was “no indication” that the man — later identified in other coverage as Derrick Callella — had any role in Nancy Guthrie’s disappearance. [13] The FBI said the phony texts were not linked to the primary ransom demand reported by TMZ and KOLD. [24]
It was a grim illustration of how high‑profile kidnappings attract not just media attention, but opportunists willing to exploit desperate families.
For months, law enforcement would say almost nothing concrete about who they believed had taken Nancy. The closest thing to a suspect came from the very device someone had tried to disable.
Ten days after Nancy was reported missing, FBI agents recovered doorbell‑camera video from her home that had previously been thought lost. [10][21] Tech experts had managed to restore the footage. [10]
What it showed, and what federal agents released as stills and video on February 10, was an armed, masked man outside her front door, tampering with the camera in the hours before her disappearance. [5][21][25]
The FBI described him as a man of average build, about 5'9" to 5'10", wearing a black Ozark Trail 25‑liter hiker backpack. [21]
Pima County authorities called him a suspect and said they believed Nancy had been taken from her home in the early hours of February 1 by this masked man. [21][26]
The release of the footage triggered a burst of law‑enforcement activity. On the same day, a man in Rio Rico, Arizona, was detained during a traffic stop and questioned but released without charges after investigators determined he was not involved. [10][17]
Three days later, on February 13, the sheriff’s department announced “law enforcement activity… at a residence near E Orange Grove Rd & N First Ave related to the Guthrie case.” [18] Two people were removed from the home; one was taken in for questioning and released the next day. [17]
Authorities emphasized that detentions were not arrests and declined to identify any suspects. [18]
The next night, the investigation moved into a Culver’s restaurant parking lot roughly two miles from Nancy’s home.
In the early hours of February 14, FBI agents and Pima County deputies converged on a gray Range Rover SUV in the lot. [18] They photographed and searched the vehicle, sealed its trunk, and then had it towed away. [18]
Sheriff Confirms Tommaso Cioni Dropped Off Nancy Guthrie Safely Before Her Disappearance
Newsweek reported that the seizure was part of a broader operation that included SWAT teams and multiple detentions in the same area, near a neighborhood that had been sealed off earlier in the evening. [18]
But officials would not say who owned the SUV, why it had been taken, or whether it was linked to Nancy Guthrie’s abduction. [18]
As with the second note, the Range Rover was a jarring, concrete image that offered no corresponding clarity.
From the start, investigators understood that whatever happened at Nancy’s house had left physical traces.
Beyond the blood on the porch, which the sheriff confirmed matched Nancy’s DNA, detectives collected additional biological material from inside the home. [1][11][16]
That material included hair and a mixed DNA sample now at the center of a complicated forensic race. [26]
Six months into the investigation, Nanos told ABC News that testing on hair found at the home was complete and “there was nothing” — the results did not point to any suspect. [26]
The mixed DNA sample, he said, contained genetic material from as many as four people and had not been affirmatively linked to anyone. [26]
“At least five, maybe six, labs across the country,” including the FBI lab in Quantico and facilities in Kansas, Florida, California, and Arizona, were working to untangle the mixture. [26] He admitted it was not clear whether current technology could fully separate and identify all contributors. [26]
Other forensic leads fizzled. A glove found in Nancy’s neighborhood yielded no DNA. [4]
Still, Nanos has insisted he is confident the trove of DNA and video evidence will ultimately crack the case. [17][25][26]
As the investigation dragged on with no suspects publicly named, online speculation filled the vacuum.
Social‑media sleuths poured over sparse public details, circulated photos of blood on Nancy’s porch, and posted videos of themselves walking her neighborhood. [16] Some accused people connected to the case of looking “sus.” [16]
On her podcast, NewsNation host Ashleigh Banfield went further, telling listeners that a law‑enforcement source had said a Guthrie family member was a “prime suspect.” [16] She later softened the assertion to say the person “may be a prime suspect,” but the name spread quickly across platforms. [16]
Reporting in The Hollywood Reporter and The New York Post identified that person as Tommaso Cioni, Annie Guthrie’s husband — the son‑in‑law who had dropped Nancy off the night she vanished. [8][14]
FBI agents were seen at the home Cioni shared with Annie, meeting with family and local deputies. [8] They offered no public comment as they left. [8]
Sheriff Nanos responded with unusual force. He issued a note admonishing media outlets that had labeled Cioni a suspect or “person of interest” without confirmation, and he reiterated at a news conference that authorities did not have any suspects or persons of interest. [8][16]
He also warned that reckless online conjecture could damage both individuals and the investigation itself. [16]
Publicly, Nanos has continued to describe the three Guthrie adult children as cooperative and “leaning on each other.” [8] He has emphasized that the family remains central to the search for Nancy, not the hunt for a perpetrator.
If there is a single unresolved fault line running through the case, it is the question of whether the ransom communications came from the real kidnapper.
Early on, multiple outlets reported that investigators believed at least two notes — the Bitcoin-demand letter and the later message claiming Nancy had died — were potentially credible and likely from the abductor. [17][21]
Yet USA TODAY made a point of noting that it had not substantiated the validity of either note, and the Pima County Sheriff’s Office repeatedly declined to confirm their authenticity while acknowledging their existence. [19]
By June, skepticism was mounting. Retired FBI profiler James Fitzgerald reviewed a later communication sent to TMZ, in which a self‑described insider claimed to know the location of a phone containing a video of Nancy with her “main kidnapper,” along with names, addresses, and other identifying details of those involved — all supposedly for sale for one Bitcoin. [23]
Fitzgerald flatly said he did not believe the sender was legitimate. “This guy, I don’t think he’s legit,” he said. “I’m gonna say that upfront.” [23] He questioned why someone with that kind of evidence would risk approaching a media outlet instead of law enforcement, and why they would trade their safety for a single Bitcoin. [23]
Former FBI agent Jennifer Coffindaffer, speaking as a TV analyst, took a darker view of the original notes. She suggested the author might be framing the narrative to avoid harsher charges — specifically, the death penalty — if caught. [22]
Coffindaffer has said she believes Nancy is dead and that the second note, with its claim that Nancy “perished shortly after she was taken” and was “buried with nature,” sounded more like a self‑serving apology than a genuine ransom demand. [22]
In late July, when Pima County finally released full copies of the first two notes and asked the public to scrutinize the language, the sheriff’s office still would not say whether they considered the letters authentic — only that they hoped someone might recognize the author’s “distinct linguistic characteristics.” [4]
The FBI, for its part, has declined to comment on whether any ransom communication has been conclusively tied to the person who took Nancy. [5]
What remains, then, is a mess of contradictions: some investigators treating early letters as possibly genuine, former profilers dismissing later ones as hoaxes, and no public confirmation that any note — including the one that declared Nancy dead — came from the person who entered her home that night. [4][21][23]
Nancy Guthrie: Chilling final video from night of disappearance emerges; dinner at Annie, Tommaso Cioni's home in focus | Hindustan Times
By late summer 2026, the investigation into Nancy Guthrie’s disappearance had stretched past its seventh month. [25] She was still missing. No one had been arrested or publicly named as a suspect. [6][13][23]
Authorities continued to say they believe Nancy was taken against her will from her home and that the case is being treated as a kidnapping‑for‑ransom. [4][18][25]
Rewards totaling $1.1 million remain on the table: $1 million from the Guthrie family, $100,000 from the FBI, for information leading to Nancy’s location or her recovery and an arrest. [5][10][25]
Labs around the country are still working on the mixed DNA sample. [25][26] Investigators are still fielding tips and urging anyone who knows something — or who recognizes the masked man in the doorbell footage, or the cadence of the ransom letters — to call the Pima County Sheriff’s Department or the FBI. [3][21][25]
Sheriff Nanos has admitted he has no proof that Nancy is still alive, even as he says he is “holding out hope” that she is “still out there.” [11][13][24]
This case file is an original Bloody Likely narrative synthesis based on the cited sources. Article © Bloody Likely. All rights reserved. Source materials remain the property of their respective owners. Facts, public records, quotations, and cited references are used for reporting, research, commentary, and documentation. Bloody Likely content license
Audio narration © Bloody Likely. All rights reserved. The audio player is provided for personal streaming/listening only.
No recent news articles found for this case. Check back later for updates.
No evidence found for this case. Be the first to submit evidence in the comments below.
Join the discussion
Loading comments...
Nancy Guthrie was dropped off at her Catalina Foothills home by her son-in-law at approximately 9:50 p.m., the last known person to see her.
At 2:12 a.m. motion was detected at the residence and later-released footage showed an armed individual tampering with the device.
At 2:28 a.m. the victim's bedside pacemaker monitor failed to send its scheduled transmission.
Family discovered Guthrie missing around 11:56 a.m. and called 9-1-1 at 12:03 p.m.; deputies arrived shortly thereafter.
Authorities announced the search shifted to a criminal investigation after evidence at the home suggested a crime had occurred.
At 1:47 a.m. a masked and gloved individual disconnected the home's doorbell camera, according to recovered footage.
A person of interest was briefly detained after a Rio Rico traffic stop and subsequent searches, then released without charges.
Law enforcement executed an operation at a nearby home, removed two people for questioning, and seized a Range Rover for analysis.
A ransom-related note received earlier in February that claimed Guthrie had died was publicly reported by news outlets.