How Bitcoin exchange gave authorities’ ‘control’ over Nancy Guthrie’s kidnapper: crypto expert

Authorities now have the upper hand against Nancy Guthrie’s purported kidnapper, according to a cryptocurrency expert.

Bezalel Eithan Raviv, the CEO and founder of Lionsgate Network — a crypto recovery service with expertise in Blockchain forensics — spoke with Page Six after a deposit was made into a Bitcoin wallet related to Guthrie’s ransom note late Tuesday.

“If the reported $150 transaction to the alleged ransom Bitcoin wallet is accurate, it aligns with a known investigative tactic,” Raviv said. “A small ‘test’ transfer can sometimes be used to confirm that the wallet is active and to trigger blockchain monitoring tools.”

The Israeli tech entrepreneur noted that, despite misconceptions, Bitcoin is “not anonymous” and is very much traceable.

“The moment funds move, they leave a permanent digital footprint,” Raviv said. “That activity can provide investigators with valuable intelligence, especially if the wallet interacts with exchanges or custodial services where identity verification is required.”

When monitoring criminal crypto activity, his firm follows what they call a “cow’s bell.”

“Once a wallet is identified and tagged, every movement can trigger alerts, no matter how many times the funds split, consolidate, or hop across wallets. Every step leaves a signal,” he said.

Raviv believes authorities may have gained an advantage in their investigation after funds were sent to the Bitcoin wallet.

“If this wallet has now received funds, the dynamic shifts,” Raviv explained. “The person demanding ransom may believe they are in control, but once a transaction is made, they become the one being watched.

“The ransom actor is no longer just making demands. They are now the target of forensic tracking.”

Raviv acknowledged that investigators may have their own protocol to follow in ransom cases like this.

“That said, ransom strategy decisions should always be directed by law enforcement and professional negotiators,” Raviv said. “The critical phase now is real-time monitoring, because movement is where mistakes happen.”

Savannah’s 84-year-old mother was last seen alive at her Tucson-area home on Jan. 31. She was reported missing the next day after the Pima County Sheriff’s Department determined that she was dragged from her home against her will.

Several news outlets received an alleged ransom note demanding that $6 million in Bitcoin be sent to a Bitcoin address in exchange for Nancy’s release. The note offered two deadlines — one on Feb. 5 at 5 p.m. EST and the second for this past Monday at the same time.

Savannah and her siblings released a statement saying they were willing to pay but that they needed the alleged kidnapper to show proof of life before sending any funds.

As of Tuesday morning, Page Six confirmed that the balance of the Bitcoin wallet remained at $0, meaning no transaction had been made. However, about $152 worth of bitcoin was deposited into the wallet Tuesday night.

While it’s unclear whether it was the FBI or another party to administer the exchange, Raviv told Page Six earlier this week that sending a small amount of funds could help lead to catching the perp.

“This is a very simple tactic among many that we utilize when we want to be able to intercept criminal network crypto assets,” Raviv said. “That’s from our perspective based on previous cases that have been incredibly successful.”

Raviv believes Nancy’s kidnapper revealed themself right when they provided the Bitcoin address.

“He showed his Achilles to everyone who understands blockchain forensics,” Raviv said.

Authorities have yet to identify a suspect in the case, though cops released terrifying security footage of an armed and masked individual outside of Nancy’s home on the night she disappeared.

Hours later, a man named Carlos was detained in connection to the investigation, but he was released shortly after.

On Wednesday, TMZ reported that the outlet received a third Bitcoin demand — this time in exchange for information on the purported abductor.

FBI Phoenix released a statement that they are “conducting an extensive search along multiple roadways in the Catalina Foothills area related to the Nancy Guthrie investigation.”