The two details in Nancy Guthrie ransom note that have detectives believing they can crack the case

Investigators in the Nancy Guthrie case are taking another look at ransom notes sent in the days after the crime — because of two clues that suggest they were sent by the real kidnappers, according to a new report.

An email ransom note sent shortly after the 84-year-old mother of “Today” show host Savannah Guthrie correctly identified a broken flood light behind her home and details about the Apple Watch she had been wearing when she went missing near Tucson, Arizona, in February.

Surveillance image of a suspect wanted in connection with Nancy Guthrie’s kidnapping from her Tucson, Ariz., home. FBI

Investigators have gone back to that note — along with a follow-up sent from the same IP address — in a desperate attempt to track Guthrie’s abductors, news outlet Air Mail reported.

The aforementioned details have investigators convinced the emails could have been legitimate — and authorities have renewed efforts to trace a string of proxy servers that could lead back to the suspects, sources told the outlet.

If the early notes are real, it would also suggest that the kidnapping could have been a multi-person operation.

One mastermind may have engineered a sophisticated ransom ransom scheme, tasking another — the apparently bumbling thug captured on surveillance footage — with kidnapping the helpless senior, Air Mail’s sources speculate.

Nancy disappeared from her home on Feburary 1, 2026. Facebook/Savanah Guthrie

However, an attempt to flush out the person behind the ransom note by depositing a little money in the Bitcoin account has failed. The cryptocurrency wallet who details were sent in the ransom note has remained inactive — thwarting authorities’ ability to track the people behind it.