As speculation grows around the motive behind the alleged kidnapping of Nancy Guthrie on February 1, experts are sounding the alarm about a troubling trend. Criminals are increasingly using the internet to identify individuals who may be vulnerable due to their visible wealth.
“In many criminal cases, the perpetrators exploit open-source information and social media to pinpoint their targets and assess their weaknesses,” noted Lisa J. Miller, a former detective from the Colorado Attorney General’s Office. “Companies often release information about their riches, while social media showcases a more glamorous side of life—expensive gadgets, lavish homes. Most of us share at least a portion of our lives online, typically highlighting our happiest moments.”
The modus operandi behind wrench attacks involves intricate cryptocurrency dealings and encrypted communications, although the underlying idea is fairly straightforward. A “mastermind” orchestrates an attack remotely, hiring local individuals to carry out abductions through intimidation and violence in pursuit of ransom.
In the first four months of 2026 alone, there have been 34 reported wrench attack incidents, according to cybersecurity firm CertiK, marking a 41% increase from the previous year.
Nancy Guthrie, aged 84, is the mother of NBC’s Savannah Guthrie. Miller mentioned that these wrench attacks can often have devastating impacts since the assailants may focus on the relatives of high-profile individuals, as they are typically easier targets.
“Someone may have been monitoring Nancy Guthrie,” Miller suggested, adding that the coverage of her family could act as a pressure point for Savannah.
This situation underscores the importance of being cautious about the amount of personal information shared online. “To safeguard ourselves, we should take steps we’ve already heard: limit social media exposure, refrain from posting pictures of our homes, and be mindful of the audience when sharing images of family or signs of affluence,” Miller advised. “It’s also wise to keep track of what information about us is publicly available online.”
There are services designed to help secure personal information, and some tech companies, including Google, offer assistance at no charge.
“This is certainly easier said than done,” Miller remarked. “In our digital age, many people have the skills to dig up information online.” We all might have, at some point, posted a picture of our adorable pets or grandkids, not realizing who could stumble upon them.
Not every viewer of these posts has good intentions, she cautioned.
“Safety in this digital landscape often mirrors the personal safety tips I advise women,” Miller pointed out. “Take care.”
Timeline of Savannah Guthrie’s Mother’s Disappearance:
Most wrench attacks occur in France, with the United States coming in a close second.
CertiK’s analysis referred to Guthrie’s case as an instance of “proxy target selection,” implying that someone physically vulnerable—rather than the wealthy relative—might be abducted. The report indicated an initial crypto ransom demand of $6 million.
Miller explained that in over half of the wrench attacks documented during the early months of 2026, the intended target was not the person taken. However, no official connection has been made between Guthrie’s disappearance and the wrench attack theory.
A spokesperson from the Pima County Sheriff’s Department stated they haven’t received reports of wrench attacks in their jurisdiction. The investigation into Nancy Guthrie’s case remains active, with updates anticipated to be shared with the public.
Pima County Sheriff Chris Nanos informed that he forwarded CertiK’s findings to law enforcement related to the Guthrie case.
Savannah Guthrie has frequently shared her Tucson roots and personal anecdotes on “Today,” focusing on her mother and beloved local spots. However, other victims of wrench attacks, while less visible, may have also unintentionally showcased their wealth, making them potential targets, according to Miller.
“If Savannah was a target—something I and others suspect—then someone must have observed her closely for a time,” Miller commented. “It’s likely that this investigation was to pinpoint her vulnerabilities, given her security measures in both New York and elsewhere.”
While authorities have not confirmed if they’re pursuing the case of Nancy Guthrie as a wrench attack, Miller speculated that the masked individual seen on Guthrie’s security footage could be a hired participant, suggesting a more complex scheme at play aiming for an initial ransom collection.
An additional image from her doorbell camera captured a similarly disguised figure, indicating prior surveillance of her residence.
“Those who prey on others do so for various, often nefarious reasons, but it’s never the victim’s fault for attracting the attention of such cruelty,” Miller stated.
