Nancy Guthrie’s alleged kidnapper may have revealed a key clue by including a real Bitcoin address in the ransom note.
Bezalel Ehsan Labib, CEO and founder of Lionsgate Network, a cryptocurrency recovery service with expertise in blockchain forensics, spoke to Page Six about how to track down criminals with the right resources.
“He showed everyone who understands blockchain forensics his Achilles heel,” Labib told Page Six on Monday about Guthrie’s kidnapping suspect.
The ransom note reportedly demanded $6 million in Bitcoin be sent to a real Bitcoin address in exchange for Nancy’s release.
“When a cybercriminal provides their wallet address, that’s basically where they reveal themselves in a number of ways,” Labib said.
With his own customers facing fraud, the Israeli tech entrepreneur explained that his strategy was to transfer small amounts to a cryptocurrency wallet to “see where it lands.”
“This is a very simple tactic among many that we utilize when we want to be able to intercept the crypto assets of a criminal network,” he said, adding, “This is from our perspective based on past cases that have been incredibly successful.”
Labib said there is a widespread misconception among investigators and criminals that cryptocurrencies cannot be traced.
“There’s a lot of incredibly mushy conversation around blockchain technology…Even in 2026, most people don’t believe that cryptocurrencies will be traceable. And even in 2026, many people still don’t believe that cryptocurrencies will be unrecoverable,” he said. “And these are all nonsense ideas because we’ve changed so much.”
Labib explained that there is data that can be gleaned from “one simple transaction” that can yield a wealth of useful information for investigations.
“This is exactly what blockchain forensics is all about: tracking the blocks that are produced with every transaction,” he said.
Labib also believes the culprits may be relying on the ignorance of investigators.
“I think the vulnerability for law enforcement is the lack of ability to understand cryptocurrencies and blockchain, and that’s why it’s taking longer than it should,” he said, noting that Guthrie has been missing for more than a week.
“We need to train law enforcement officers in blockchain forensics and cryptocurrencies, or find the right people for the job,” he said.
Labib explained that while cryptocurrencies can be transferred to wallets, criminals will ultimately want to “enjoy that money.”
“This is the beauty of cryptocurrencies. In the bigger picture, when you send cryptocurrency, you’re sending a code. You’re not sending a suitcase full of cash that you can use to pay for gas, bills, clothes, and food, right?
“We send a code from one wallet to another,” he continued. “Even if you send us a code, you can’t use it to eat. You can’t buy things from your code… If you want to cash out, you have to use a cryptocurrency exchange.”
This interaction is where criminals can expose themselves, he shared.
Labib also said the $6 million ransom demand was a “very predictable number.”
“If you were to bring it to ChatGPT based on a prompt and say, ‘If we were to do this and this, how much would you ask for? It would be somewhere between $5 million and $10 million,'” he said. “These are random requests from various historical events.”
Asked if he thought Guthrie might still be alive, Labib, who has offered to cooperate with investigators, said he could only hope.
“I hope she returns to her family and loved ones and this nightmare ends,” he said.
Savannah Guthrie’s 84-year-old mother was last seen alive on the evening of January 31st, after having dinner with her family. She was reported missing the next day.
The Pima County Sheriff’s Office determined she was removed from her Tucson-area home against her will and confirmed the home is being treated as a crime scene.
Last week, DNA tests confirmed that bloodstains left outside the home belonged to Nancy.
A ransom note from the alleged kidnapper reportedly requested that $6 million in Bitcoin be sent to an address in exchange for Nancy’s return.
The memo lists two deadlines: one on February 5th local time and one on Monday, February 9th at 5pm local time.
Savannah shared a video on Saturday begging for her mother’s return, offering to pay the ransom.
