Cryptocurrency experts say authorities now have the upper hand against Nancy Guthrie’s alleged kidnapper.
Bezalel Ehsan Labib, CEO and founder of Lionsgate Network, a cryptocurrency recovery service with expertise in blockchain forensics, spoke to Page Six late Tuesday after a deposit was made to a Bitcoin wallet associated with Guthrie’s ransom note.
“If the reported $150 transaction to a ransom-bound Bitcoin wallet is accurate, it is consistent with known investigative tactics,” Labib said. “Small ‘test’ transfers may be used to verify that the wallet is active and trigger blockchain monitoring tools.”
The Israeli technology entrepreneur said that despite misconceptions, Bitcoin is “not anonymous” and is highly traceable.
“When funds move, they leave a permanent digital footprint,” Labib says. “Especially if the wallet interacts with exchanges or custodial services that require identity verification, that activity can provide valuable information to investigators.”
His company follows the so-called “Cowsbell” when monitoring criminal activity in cryptocurrencies.
“Once wallets are identified and tagged, any movement can trigger an alert, no matter how many times funds are split, merged, or moved back and forth between wallets. Every step leaves a signal,” he said.
Labib believes authorities may have had an advantage in the investigation after the funds were transferred to the Bitcoin wallet.
“If this wallet receives funds, the situation changes,” Labib explained. “Those demanding the ransom may believe they are in control, but once the transaction is made, they are on the receiving end of surveillance.
“Ransom seekers are no longer just making demands; they are now the subject of forensic tracking.”
Labib acknowledged that investigators may follow their own procedures in such ransom cases.
“That said, ransom strategy decisions should always be guided by law enforcement and professional negotiators,” Labib said. “Mistakes occur during movement, so the key step now is real-time monitoring.”
Savannah’s 84-year-old mother was last seen alive on January 31 at her home in the Tucson area. The mother was reported missing the next day after the Pima County Sheriff’s Department determined she had been dragged from her home against her will.
Several news organizations received ransom demands demanding $6 million in Bitcoin be sent to a Bitcoin address in exchange for Nancy’s release. The memo lists two deadlines: one on February 5th at 5 p.m. ET, and one at the same time this Monday.
Savannah and her brother released a statement saying they were willing to pay but needed the alleged kidnapper to provide proof of survival before they could send the money.
As of Tuesday morning, Page Six confirmed that the balance in the Bitcoin wallet remained at $0, meaning no transactions were taking place. However, on Tuesday night, approximately $152 worth of Bitcoin was deposited into the wallet.
It’s unclear whether the FBI or another party controlled the exchange, but Labib told Page Six earlier this week that sending small amounts of funds could lead to the perpetrator’s arrest.
“This is very simple among the many tactics we use when we want to be able to intercept the crypto assets of a criminal network,” Labib said. “This is our view based on past examples that have been incredibly successful.”
Labib believes Nancy’s kidnappers revealed their true identity when they provided her Bitcoin address.
“He showed everyone who understands blockchain forensics his Achilles heel,” Labib said.
Authorities have not yet identified a suspect in the case, but police have released horrifying security footage of an armed and masked person outside Nancy’s home the night she disappeared.
A few hours later, a man named Carlos was taken into custody in connection with the investigation, but was quickly released.
On Wednesday, TMZ reported that the outlet had received a third Bitcoin request. This time, it was in exchange for information about the alleged kidnapper.
FBI Phoenix released a statement saying, “We are conducting extensive searches along multiple roads in the Catalina Foothills area in connection with the Nancy Guthrie investigation.”
