Nancy Guthrie's disappearance from her Tucson home has taken on a darker and more specific shape, with former FBI agent Jennifer Coffindaffer suggesting the 84-year-old may have been the victim of a so-called 'wrench attack', a violent form of crypto extortion.
The theory, raised publicly in late May, concerns the mother of Today host Savannah Guthrie and the still-unsolved abduction investigators say happened in the Catalina Foothills area near Tucson on 1 February.
How A Crypto 'Wrench Attack' Entered The Nancy Guthrie Case
The wrench attack theory around the Nancy Guthrie kidnap has been pushed most prominently by Jennifer Coffindaffer, a former FBI agent who has been following the case in public posts.
Coffindaffer has argued that the circumstances of Guthrie's disappearance resemble a trend of physical attacks against people believed to have large cryptocurrency holdings, or relatives who can be used as leverage.
She has repeatedly raised a possible link between the Tucson case and an alleged home invasion in Scottsdale, around 90 minutes' drive north, that reportedly took place the day before Guthrie vanished and was said to involve a plot to steal millions in digital assets.
Nancy Guthrie
— Jennifer Coffindaffer (@CoffindafferFBI) May 26, 2026
Wrench attacks
I have been speaking about a Wrench Attack that took place literally about 90 minutes North of Nancy's house the day before Nancy was attacked since early March. (See link)
https://t.co/MA9f6NGplZ
Below is the rundown on Wrench attacks from one…
'I have been speaking about a wrench attack that took place literally about 90 minutes north of Nancy's house the day before Nancy was attacked since early March,' she wrote on X on 26 May. 'A wrench attack checks a lot of boxes in terms of Nancy's case. I have been concerned that this is a likely possibility for months.'
In a separate post, she stressed that typical victims in such cases are people with visible cryptocurrency wealth, or those close enough to them that they can be used to force access to wallets, passwords or seed phrases.
As of this writing, none of those claims has been endorsed by local law enforcement. The Pima County Sheriff's Department told Fox News Digital in an email that it has not received any reports referencing 'wrench attacks' in the community and said only that the investigation into Nancy Guthrie's disappearance 'remains active and ongoing.'
Officials added that any significant update would be shared publicly.
What A 'Wrench Attack' Actually Is
Crypto tracing firm TRM Labs and security companies such as CertiK describe wrench attacks as physical assaults, kidnaps or robberies in which criminals use intimidation to force a victim to hand over cryptocurrency keys or transfer funds.
The label comes from an often-cited web comic in which a hacker abandons sophisticated code and buys a cheap wrench to beat a password out of someone.
Retired detective Lisa J. Miller, a former law enforcement executive with the Colorado Attorney General's Office, told Fox News Digital that today's version typically involves a 'mastermind' identifying a target online and then recruiting a local 'thug' to carry out the violence, splitting the proceeds afterward.
🚨🔎🚨 A NEW theory in the unsolved suspected abduction of Nancy Guthrie is a so-called wrench attack.
— Michael Ruiz (@mikerreports) May 21, 2026
The emerging trend is a combination of a "mastermind" plotter sitting at a computer, probably overseas, and street-level thugs hired locally to carry out the abduction and… pic.twitter.com/nEsOUbvfbf
According to Miller, attackers often scan social media, forums, podcasts and conference appearances for people who boast about their crypto gains or show off expensive lifestyles. Once a victim is selected, the plan shifts from keyboards to guns and, in some cases, to hired kidnappers.
Crypto security specialists say these crimes are rising. CertiK reported 34 confirmed wrench-style incidents worldwide in the first four months of 2026, a 41 per cent increase on the same period a year earlier, with estimated losses of about $101 million (£75.26 million).
In France, several families of wealthy crypto holders have reportedly been abducted for ransom. One high-profile case involved Ledger co-founder David Balland and his wife, who were kidnapped from their home and tortured, including the severing of one of Balland's fingers, while attackers demanded a €10 million (£8.67 million) payment, before the couple were rescued and suspects arrested.
The charming French town of Vierzon should have been an oasis of calm for crypto executive David Balland and his wife. Instead, it became the scene of 48 hours of terror.
— The Telegraph (@Telegraph) May 26, 2026
The cryptocurrency executive, who founded Ledger, was kidnapped from his home in the town by a criminal gang… pic.twitter.com/z4JL941WtL
Why Some Experts Say Nancy Guthrie's Kidnap Only Partly Fits
Miller, however, has been careful not to force the Guthrie case into a perfect template. She told Fox News Digital, in comments summarised by reporter Michael Ruiz, that 'what we're seeing with Nancy Guthrie is not a typical wrench attack.'
In her view, some elements look familiar. She highlighted what she called a 'street level thug theory', pointing to FBI-released images of a masked man on Nancy's front porch on the night she disappeared.
She has referred to him as 'porch monster', saying that his clothing, the way he handled a firearm and his general demeanour gave the impression of a clumsy, unsophisticated criminal, while the broader planning around the abduction appeared more advanced.
Miller suggested investigators might be dealing with someone who fixated less on crypto itself and more on Savannah Guthrie's perceived wealth from her Today salary, bonuses, books and other work.
Savannah's mother had appeared on the NBC show several times, including as recently as 2025, which, Miller argued, could have made her a visible and apparently vulnerable relative: an 84-year-old woman, living alone in Arizona, connected to a high-profile television figure.
She also noted that the language Savannah used in recorded ransom messages suggested the FBI was taking early notes and demands seriously. Despite the grim timeline, Miller said she still believes someone may yet come forward with information that breaks the case.
Meanwhile, a spokesperson for the Pima County Sheriff's Department has stressed that the force has dealt with no prior 'wrench attack' reports locally. More than $1 million (£750,000) in reward money has been put up in the Nancy Guthrie kidnap investigation, yet there is still no named suspect and no arrest.
Nancy Guthrie was last seen at her house in the Catalina Foothills, near Tucson, on 31 January and was reported missing the following day. Detectives have said they believe she was taken against her will, and Pima County Sheriff Chris Nanos has indicated that investigators think they know the motive, but no suspect has been named and no arrests announced.
Drops of blood found on the front porch, and doorbell footage of a masked man outside her home, have only deepened concern and speculation.
