Nancy Guthrie ransom notes released in full text

Released record, not authentication

The Nancy Guthrie ransom-note release sits with Pima County, Arizona, and the FBI Phoenix Field Office. As last verified on August 2, 2026 UTC, the FBI wanted/kidnap page continued to treat the matter as an active missing-person/kidnapping case rather than a closed charging record, with no public suspect identification on that page [1]. The public-release event occurred on Friday, July 31, 2026, when Pima County authorities released the contents of two early-February notes in an effort to generate new leads [2].

That release confirms a narrow but important fact: two documents that had been treated as investigative material are now public. It does not establish that the sender was the abductor, that the claims inside either note are true, or that law enforcement has resolved the contradiction around authenticity. CBS reported that investigators believed the two released notes were likely sent by the abductor and that both were sent from the same source IP address [3]. A conflicting summary in the broader record, attributed to earlier Reuters/Wikipedia reporting, says the FBI had determined the two early-February notes and a third note reportedly received by TMZ were fakes. The safe reading is therefore status discipline: released, relevant, and being used for lead generation; not officially authenticated in the public record.

This is a public-record digest, not legal advice. The notes are set out below only to the extent supported by the released-source record available here. One line remains redacted in the public materials; NBC described it as the line explaining how payment would reach the sender, while CNN and CBS placed that redaction in the bitcoin-payment context [2][3][4].

The released notes

The first note carries the ransom demand, deadlines, threat language, the single public redaction, and two private corroborating details. The second note changes the claimed status of Nancy Guthrie and ends with apology language. NewsNation and other outlets published the notes after the July 31 release; the formatting below preserves the reported sequence and flags the redaction rather than filling gaps with speculation [5].

Note 1 — sent February 2, 2026, to KOLD-TV; addressed to Savannah Guthrie

Savannah Guthrie,

[Demand for $4 million in bitcoin by 5PM Thursday Feb 5.]

[If the first deadline was not met, the demand would increase to $6 million by 5PM Monday Feb 9.]

Do not play games, law enforcement will not be able to help you.

[REDACTED — one line. Outlets identify this as the payment-delivery line, in the bitcoin-address/payment context.]

[Private corroborating detail: a white smartwatch on the floor at the foot of the bed.]

[Private corroborating detail: a destroyed white floodlight in the backyard.]

The threat line is the passage most likely to be repeated in general coverage, but the two closing details are more important for verification. The white smartwatch and destroyed white floodlight were not just narrative color; reporting describes them as details law enforcement and the family wanted held back so any later communication could be tested against information not generally known [2].

Note 2 — sent February 6, 2026; addressed to the Guthrie family

Guthrie Family,

[The sender claimed Nancy Guthrie died shortly after being taken.]

We believe it was heart related... She is buried in nature now.

[The note ended with apology language.]

The second note is not simply a later installment of the first demand. It changes the sender’s claimed account from extortion under deadline pressure to a statement that Nancy Guthrie had died. In public-record terms, that makes the note harder rather than easier to classify: it could be evidence, manipulation, imitation, or noise. The July 31 release does not publicly resolve which of those categories applies.

Why these notes were held back before July 31

The first note was sent to Tucson CBS affiliate KOLD-TV on February 2, 2026, the day after Nancy Guthrie disappeared, according to the July 31 reporting [2][3]. CBS reported that both released notes were sent from the same source IP address [3]. That shared IP is a provenance fact; it links the two messages to each other in the reporting. It does not, by itself, prove that the sender had Nancy Guthrie or that the sender’s claims were true.

CNN reported that on June 24, 2026, media outlets were asked by law enforcement and the family not to publish the notes’ contents. The reason was practical: some details could be used to authenticate future communications purporting to come from the same source [2]. Once a detail is published, it loses much of that screening value. A future tipster can copy it. A hoaxer can absorb it. A genuine sender no longer has exclusive access to that fact.

That is why the remaining redaction matters. It is not just a privacy mark or a courtesy edit. The redacted line preserves a boundary between what the public can see and what investigators may still be able to use. NBC described the withheld line as the payment-delivery line, while CNN and CBS connected the redaction to the bitcoin-payment address context [2][3][4].

The July 31 release was also described as a recognition tactic. PBS NewsHour/AP reported that authorities hoped someone might recognize the writing style, explicitly invoking the historical precedent of publishing the Unabomber manifesto to prompt public pattern recognition [6]. ABC likewise framed the release around the sheriff’s office asking for public help identifying the writer [7]. That does not turn the public into a jury. It turns the public record into a controlled net for leads.

What the documents can support

The public materials support several limited conclusions. First, two notes exist and were released by authorities on July 31, 2026 [2]. Second, the first demanded bitcoin, used deadlines, threatened that law enforcement could not help, and included two details treated as private corroboration before publication [2][4]. Third, the second claimed Nancy Guthrie had died shortly after being taken and included the line, “We believe it was heart related... She is buried in nature now” [5]. Fourth, CBS reported that both notes came from the same source IP address [3].

The documents do not publicly support a solved narrative. A note can be related to a disappearance without being truthful in every assertion. A shared IP can connect two communications without identifying the sender in the public record. A private detail can raise the evidentiary value of a communication without making the whole communication authentic. Those distinctions are the difference between preserving the record and laundering an investigative theory into a fact.

Compact open-case timeline

Other reported case details should stay in their lane. Hair evidence has been described as inconclusive, which means it should not be used as confirmation of a suspect theory [5]. Reward reporting includes a $1 million family reward, an FBI reward of up to $100,000, and an 88-CRIME figure of $102,500, according to NewsNation [5]. Those figures may help explain why the case continues to draw tips; they do not authenticate either note.

Collateral references to Derrick Callella’s pending September 10, 2026 sentencing, and reported detention-lawsuit dollar figures that vary by outlet, are not treated here as proof of authorship or case resolution. They are status cautions at most. The controlling public posture remains: two notes are public, one payment-delivery line remains redacted, authenticity remains disputed or undetermined in the public record, and the release is meant to surface leads while the case remains open.

References

1. Nancy Guthrie — FBI Phoenix Field Office.
2. Nancy Guthrie ransom notes: Sheriff's department releases full contents in hopes of generating new leads — CNN, July 31, 2026.
3. Nancy Guthrie ransom notes, including message saying she died, released by sheriff's department — CBS News.
4. Letters sent to Nancy Guthrie's family after her disappearance are released — NBC News.
5. Read ransom notes released by Pima County sheriff 6 months after she vanished — NewsNation.
6. Authorities release early Nancy Guthrie ransom note, hoping someone recognizes writing style — PBS NewsHour/AP.
7. Ransom notes in Nancy Guthrie case released as sheriff's office asks for public's help in identifying writer — ABC News.