A small Bitcoin transaction tied to the ransom demand in the Nancy Guthrie kidnapping case may have shifted momentum in favor of investigators, according to a cryptocurrency forensics specialist who says digital currency is far more traceable than many criminals realize.

Bezalel Eithan Raviv, CEO and founder of Lionsgate Network, a crypto recovery firm specializing in blockchain forensics, told Page Six that a modest deposit made late Tuesday into the Bitcoin wallet listed in the ransom note could signal a strategic investigative move.

“If the reported $150 transaction to the alleged ransom Bitcoin wallet is accurate, it aligns with a known investigative tactic,” Raviv said. “A small ‘test’ transfer can sometimes be used to confirm that the wallet is active and to trigger blockchain monitoring tools.”

Raviv, an Israeli technology entrepreneur, emphasized that Bitcoin transactions are not invisible, despite popular belief.

“The moment funds move, they leave a permanent digital footprint,” Raviv said. “That activity can provide investigators with valuable intelligence, especially if the wallet interacts with exchanges or custodial services where identity verification is required.”

When tracking illicit cryptocurrency activity, Raviv explained that his company employs what it refers to as a “cow’s bell” method.

“Once a wallet is identified and tagged, every movement can trigger alerts, no matter how many times the funds split, consolidate, or hop across wallets. Every step leaves a signal,” he said.

According to Raviv, once money enters the account, the balance of control may change.

“If this wallet has now received funds, the dynamic shifts,” Raviv explained. “The person demanding ransom may believe they are in control, but once a transaction is made, they become the one being watched.

“The ransom actor is no longer just making demands. They are now the target of forensic tracking.”

Still, Raviv noted that law enforcement agencies follow established procedures in handling ransom situations.

“That said, ransom strategy decisions should always be directed by law enforcement and professional negotiators,” Raviv said. “The critical phase now is real-time monitoring, because movement is where mistakes happen.”

Nancy Guthrie, 84, was last seen alive at her home near Tucson on Jan. 31. She was reported missing the following day after the Pima County Sheriff’s Department concluded that she had been forcibly removed from the residence.

Multiple media organizations later received what authorities believe to be a ransom message demanding $6 million in Bitcoin in exchange for her freedom. The note listed two deadlines — Feb. 5 at 5 p.m. EST and another this past Monday at the same hour.

Savannah Guthrie and her siblings issued a public statement indicating they were prepared to meet the demand but required proof that their mother was alive before transferring any money.

As of Tuesday morning, Page Six confirmed that the Bitcoin wallet’s balance remained at zero. By Tuesday night, however, approximately $152 in Bitcoin had been deposited into the account.

It remains unclear whether the FBI or another entity initiated the transaction. Earlier in the week, Raviv told Page Six that sending a minimal amount of cryptocurrency can sometimes be part of a broader investigative approach.

“This is a very simple tactic among many that we utilize when we want to be able to intercept criminal network crypto assets,” Raviv said. “That’s from our perspective based on previous cases that have been incredibly successful.”

Raviv also suggested that the individual behind the ransom demand may have exposed himself the moment he shared the wallet address.

“He showed his Achilles to everyone who understands blockchain forensics,” Raviv said.

Authorities have yet to announce any arrests directly connected to the abduction, though they did release alarming surveillance footage showing an armed and masked individual outside Nancy’s home on the night she vanished.

In the hours following the footage’s release, a man identified as Carlos was taken into custody in connection with the probe but was later released.

On Wednesday, TMZ reported receiving a third Bitcoin-related demand — this time offering information about the alleged kidnapper in exchange for cryptocurrency.

Meanwhile, FBI Phoenix announced that agents are “conducting an extensive search along multiple roadways in the Catalina Foothills area related to the Nancy Guthrie investigation.”