A possible “wrench attack” motive is drawing increased attention in the Feb. 1 suspected abduction of Nancy Guthrie, as security experts caution that criminals are more frequently mining the internet for clues about wealth when selecting victims.
“The bad guys in these cases — and in many other crimes — use open-source material and social media to identify targets, along with their weak spots and pressure points,” said Lisa J. Miller, a retired detective and former law enforcement executive with the Colorado Attorney General’s Office. She noted that company announcements highlighting financial success, along with social posts flaunting expensive purchases, luxury items or large homes, can provide valuable leads. “Many of us share at least part of our lives publicly, and it’s usually the best-looking part,” she said.
Though wrench attacks may involve complex cryptocurrency transfers, encrypted messaging and plots that span multiple countries, the basic model is straightforward: a remote organizer orchestrates the scheme and recruits local attackers to carry out a violent kidnapping or confrontation aimed at forcing a ransom payment.
Cybersecurity firm CertiK has recorded 34 wrench attack cases during the first four months of 2026, marking a 41% jump from the same period a year earlier.
Savannah Guthrie returned to NBC’s “Today” after being away for two months following the disappearance of her mother, Nancy Guthrie, from the family’s Arizona home during what authorities are treating as a suspected kidnapping case. (Getty Images/News Agency)
