Coffindaffer & a Retired Detective Both Said Same — A Dark Web Mastermind Ordered Nancy’s Kidnapping

Nancy Guthrie and the $5 Wrench: Was Her Disappearance Part of a Crypto “Wrench Attack”?

January 31, 2026, will be remembered as a night when two seemingly unrelated crimes unfolded across Arizona. In Scottsdale, two California teenagers dressed in FedEx uniforms forced their way into a home, assaulting a family in an attempt to steal access to a $66 million cryptocurrency wallet. Roughly 200 miles south in Tucson’s Catalina Foothills, 84-year-old Nancy Guthrie returned home from dinner at her daughter’s house and vanished. Blood on her porch, a masked figure on doorbell camera, and a disabled pacemaker told a story of sudden violence.

For months, investigators treated Nancy’s case as a local abduction. But this week, two seasoned law enforcement professionals independently voiced what some had suspected: Nancy Guthrie’s disappearance bears the hallmarks of a “wrench attack” — a growing form of cryptocurrency extortion where criminals use physical violence or kidnapping to force victims to surrender wallet passwords.

This blog explores the wrench attack theory, its documented rise, the chilling parallels with the Scottsdale incident on the same night, and what it means for the ongoing search for Nancy.

What Is a “Wrench Attack”?

The term originates from a 2009 web cartoon in which a frustrated hacker gives up on cracking encryption and says, “I’ll just use a $5 wrench” — meaning beat the password holder until they comply. What began as dark humor has become a real criminal business model.

According to security researchers and law enforcement:

In 2024, 41 documented wrench attacks occurred globally.
In 2025, the number rose to 70 — a 70% increase.
Actual figures are likely much higher, as many victims stay silent due to fear or shame.

TRM Labs and other blockchain analysts note that global crypto ransom payments reached hundreds of millions annually, with the true total significantly underreported. These operations target individuals with substantial digital assets, often identified through data breaches.

The 2025 Coinbase breach, in which rogue employees allegedly sold customer data including names, addresses, and account balances, supercharged this trend. Criminal networks suddenly had precise target lists instead of guessing.

The Scottsdale Parallel: Same Night, Same Blueprint

On the same evening Nancy disappeared, Jackson Sullivan (17) and Skyler Lee (16) drove over 600 miles from California to Scottsdale in a borrowed blue Subaru. Dressed in FedEx uniforms, carrying a box and dolly, they followed instructions from anonymous handlers known only as “Red” and “Eight” via an encrypted app on a burner phone.

Their mission: Enter the home, assault the occupants until they handed over the crypto wallet code. The plan failed when a child upstairs called police. The teens were arrested. Their handlers were never identified.

The operational similarities to Nancy’s case are striking:

Hired low-level actors recruited remotely.
Use of disguises and props (FedEx uniforms vs. the masked figure with backpack).
Encrypted communication with unknown superiors.
Target selected for cryptocurrency wealth or family connections to money.
Execution by people who knew almost nothing about the full operation.

While law enforcement has not officially linked the cases, the blueprint matches what experts describe in wrench attacks.

Expert Voices: Coffindaffer and Miller Connect the Dots

On May 19, 2026, retired FBI Supervisory Special Agent Jennifer Coffindaffer posted publicly: “Do you know what a wrench attack is? These are very organized attacks against the rich to extort cryptocurrency via kidnappings and violent home invasions. The puppet masters in these crimes are sophisticated. Despite all of their expertise, the FBI cannot identify…”

Four days later, on May 23, retired Colorado detective and FBI-trained hostage negotiator Lisa J. Miller told Fox News Digital that elements of Nancy’s case “did not seem to fit” a standard random crime. She described the masked individual on camera as a “porch monster” — a low-level operator, not a mastermind.

Both experts, from different backgrounds, reached the same conclusion independently: Nancy’s abduction shows signs of an organized wrench operation where the physical actor (the “mope” or “doofus” on camera) is expendable, while the planner remains invisible.

The Mastermind Profile

In documented wrench attacks, the architect rarely gets close to the target. Key traits include:

Operating from overseas jurisdictions with weak or no extradition treaties with the U.S.
Young, tech-savvy individuals fluent in dark web marketplaces, encrypted apps (Signal, Telegram), layered VPNs, and anonymizing networks.
Experience running multiple operations — this is a repeatable business model.
Never physically present at the scene.

The mastermind handles research (target wealth, routines, home layout), posts the job on dark web forums, vets recruits, provides seed money and instructions, and monitors remotely. The hired actor — often someone needing quick cash — executes the violence but knows little about the person above them.

In Nancy’s case, the figure on the doorbell camera fits the low-level profile: awkward gear (backpack with reflective strips, improperly worn holster), improvised tactics (stuffing foliage into the camera with a flashlight in his mouth). Experts describe this as someone who studied heist movies more than professional tradecraft.

Operational Sophistication in Nancy’s Case

Several details align with wrench attack methodology:

No geo-fencing hits: No unusual cell phones pinged near Nancy’s home. Experts suggest the use of two-way radios/walkie-talkies instead — old technology invisible to modern digital tracking.
Ransom emails: Six sophisticated emails sent to media outlets showed layering that street-level criminals rarely achieve.
Prior reconnaissance: Reports confirm the suspect visited the property multiple times before January 31.
Knowledge of routines: The perpetrator struck after Nancy returned from dinner, when she was alone.

Pima County Sheriff’s Department reportedly had no prior experience with wrench attacks, and the FBI was kept out for the first four critical days — a window the mastermind could have used to observe and adapt.

The Human Cost and Nancy’s Fight

Nancy Guthrie was not a cryptocurrency expert or high-profile target herself. She was an 84-year-old mother, grandmother, gardener, and churchgoer who raised her family alone. On January 31, she enjoyed dinner with loved ones before being driven home.

The blood on her porch tells of resistance. An elderly woman with mobility issues, a pacemaker, and hearing aids removed for the night still fought back, leaving trace evidence that investigators continue to analyze at Quantico.

Her daughter Savannah Guthrie has spoken movingly about the family’s pain and whether her own public profile made her mother a target. On Mother’s Day, she wrote: “We miss you with every breath. We will never stop looking for you.”

Where the Investigation Stands

Despite the complexity, several active threads offer hope:

DNA at Quantico: Genetic genealogy is being used — the same technology that solved the Golden State Killer case. Sheriff Nanos has said investigators are getting closer to identifying the unknown contributor.
Bitcoin wallet: Ransom demands specified Bitcoin. Wallet creation and transaction metadata can be traced with advanced forensics.
Communication trails: Signal threads or burner phones used to recruit the actor may yield links.
50,000+ tips: Former Detective Robbie Mayer believes the suspect’s name may already be in the pile, waiting for the right connection.

The Scottsdale teens provided almost no useful information about their handlers, illustrating how these networks are designed — the bottom rung knows little.

A Chilling but Solvable Pattern

Wrench attacks are not unstoppable. When masterminds are caught, it is usually through careful backward tracing: identifying the physical actor, following payment trails, analyzing crypto wallets, or exploiting a single mistake in the anonymity chain.

The mastermind’s greatest strength — distance and digital invisibility — requires constant perfection. One loose thread anywhere can unravel the operation.

Nancy Guthrie’s case has drawn massive attention. It involves a beloved national news anchor’s family, a former military intelligence connection, and public pressure that keeps the case alive. Choosing this target may prove to be the mastermind’s biggest miscalculation.

The $1.2 million reward remains unclaimed. The FBI continues to urge anyone with information to contact them at 1-800-CALL-FBI. Tips can be anonymous.

Nancy fought back on her front steps. Investigators, scientists at Quantico, and her family continue fighting for answers. The wrench may have been $5, but the cost to those who wield it — and those who order it — is rising.

The answer exists. It lives in the DNA, the wallet metadata, the communication logs, and the 50,000 tips. Somewhere in that mountain of evidence is the thread that leads to the person who placed the order.

Nancy Guthrie deserves for that thread to be pulled.

If you have any information, contact the FBI immediately. The reward is real. The investigation is active. Nancy is still missing — but she is not forgotten.

Coffindaffer & a Retired Detective Both Said ...