As the search for Nancy Guthrie extends into a second week, more details are emerging about an alleged ransom note demanding a crypto payment. A local Arizona TV station, KGUN9, reported that the alleged kidnappers have demanded $6 million in a Bitcoin payment.
The purported captors demanded that the payment be made by 5 p.m. on Monday, otherwise threatening Guthrie’s life. Savannah Guthrie and her siblings said they would pay a ransom in a video posted to Instagram over the weekend.
KGUN9 declined to share any further details about the ransom letter in a note to Fortune. Law enforcement has not said that the ransom letter is legitimate.
In order to pay the ransom, the Guthrie family would have to acquire Bitcoin, typically by opening an account with a crypto exchange, according a spokesperson at the blockchain analysis firm Chainalysis. The family could also send the money through an intermediary. In either case, they would then transfer the requested amount to the wallet address provided by the captors.
Bitcoin addresses, which are public, are long strings of random numbers and characters that can only be opened with a corresponding private key controlled by the wallet owner.
The public nature of Bitcoin’s blockchain means it’s possible to watch funds move on so-called explorer sites like this one. While the public record does not include explicit names or locations, blockchain forensics firms are often able to associate addresses with certain crypto exchanges or criminal gangs. In some cases, law enforcement can intervene to seize funds or intercept a transaction.
“Prompt response from exchanges and law enforcement is the only hope to stop the money,” said Nicholas Smart, VP of a blockchain investigations company called Crystal Intelligence.
In the case of the Guthrie abduction, one retired FBI agent told the New York Post that the ransom note has an unusual attribute—namely it includes the term “USD” for dollars, which he said an American would be unlikely to use. The former agent suggested this could mean the kidnappers may be from overseas or that the note is a hoax.
A second note has been