For 35 years, a ten-foot copper sculpture in the courtyard of CIA headquarters held a 97-character secret that defeated the agency's own cryptanalysts, the National Security Agency, and an entire generation of obsessive amateur codebreakers. Then, in September 2025, two journalists cracked the case without breaking a single line of code. They simply found the answer sitting, unsealed, in a public archive at the Smithsonian, accidentally filed there by the artist himself during cancer treatment. Two months later, that same answer sold at auction for $962,500. The puzzle is technically still unsolved by the public. Its solution, however, now belongs to a single anonymous buyer.
Background: A Sculpture Built to Be a Mystery
Kryptos was commissioned for the CIA's New Headquarters Building in Langley, Virginia, awarded through a joint National Endowment for the Arts and CIA panel in November 1988 as part of a $250,000 art commission. Artist James Sanborn, working for four months with retired CIA cryptographer Edward Scheidt, built the piece from red granite, quartz, copperplate, and petrified wood, centered on an S-shaped copper screen designed to resemble a sheet of paper emerging from a printer. The sculpture was dedicated on November 3, 1990, its central theme explicitly framed as "intelligence gathering."
The copper screen carries four separate encrypted passages, designated K1 through K4, primarily using a Vigenère cipher built around the keyword "Kryptos," the Greek word for "hidden." Scheidt later described the encryption's difficulty as roughly nine out of ten, stating he had expected the full puzzle to be solved within five to ten years of its unveiling. Sanborn has said the sculpture contains a deliberate riddle within a riddle that can only be understood once all four passages have been deciphered, and in August 2025 he confirmed the existence of a fifth, even more hidden message, K5, which he says will be revealed only after K4 is solved.
Three Down, One Standing
The first three passages fell with a speed that mirrored Sanborn and Scheidt's original expectations, though not in the order the public first heard about it. An NSA internal team quietly solved K1 through K3 by 1992, two years after dedication, though the agency did not announce this for years. CIA analyst David Stein solved all three passages by hand using pencil and paper in 1998, again without public disclosure at the time. It was not until 1999 that the first public announcement came, from Jim Gillogly, a California computer scientist who cracked the same three passages using software, prompting the CIA to finally confirm that its own analyst had already done so the year before.
K1 reads, in part, "between subtle shading and the absence of light lies the nuance of iqlusion," with the word "illusion" deliberately misspelled as a built-in red herring. K3 turned out to be a paraphrased account drawn from Howard Carter's description of opening Tutankhamun's tomb. K2 includes a partial passage reading "who knows the exact location? Only WW," a line widely interpreted as a reference to William Webster, the CIA director who presided over the sculpture's dedication, though Sanborn has given inconsistent accounts over the years about exactly what, if anything, he privately told Webster. K4, a separate and considerably shorter 97-character passage, resisted every documented attempt to break it for the next 35 years.
| Passage | Status | Solved By | Year Solved |
|---|---|---|---|
| K1 | Solved | NSA internal team | 1992 (disclosed later) |
| K2 | Solved | NSA internal team / CIA's David Stein | 1992 / 1998 |
| K3 | Solved | Jim Gillogly (public); CIA's David Stein (private) | 1999 (public) |
| K4 | Plaintext recovered, not publicly decrypted | Found via Smithsonian archive, not cryptanalysis | 2025 |
| K5 | Unknown content; existence confirmed | To be revealed after K4 is public | Confirmed August 2025 |
How the Answer Was Found Without Being Solved
The 2025 resolution of K4 is unusual precisely because no one actually broke the cipher. In September of that year, journalists Jarett Kobek and Richard Byrne were investigating Sanborn's working papers, donated to the Smithsonian's Archives of American Art, after noticing a reference to his original "coding charts" in auction catalogue notes. Sifting through the archive, they found scattered scraps of text that, assembled together, appeared to be the complete plaintext solution to K4. They emailed the reconstructed text to Sanborn directly. He confirmed it was accurate, explaining that he had mistakenly included those scraps while compiling documents for donation years earlier, during a period of cancer treatment.
Sanborn's response was immediate and defensive: he asked the Smithsonian to seal the relevant files for the next fifty years, until 2075, and the institution complied. He then asked Kobek and Byrne to sign non-disclosure agreements; both refused, though they agreed not to publish the plaintext themselves. Lawyers connected to an auction house later in motion allegedly threatened the two journalists with copyright infringement and contract-interference claims if they released the text publicly. In October 2025, RR Auction formally listed Sanborn's full Kryptos archive, including the K4 solution, a 1988 copper prototype, original encryption tables, and correspondence with Scheidt, as part of a sale titled "Decoding History: Kryptos, Enigma and the Rosetta Stone." The auction closed on November 20, 2025, with the complete archive selling for $962,500 to an anonymous bidder, with a portion of proceeds designated for programs supporting people with disabilities.
Theories and Explanations
The straightforward account, confirmed directly by Sanborn himself, is that the K4 plaintext was never deliberately released and was discovered purely by archival accident, a researcher noticing a passing reference in an unrelated catalogue description and following it to a filing oversight made under genuine personal duress. This explanation requires no conspiracy: an aging artist organizing decades of papers during a cancer diagnosis simply included material he should have kept separate, and two persistent researchers happened to notice the loose thread.
A second, more skeptical reading treats the entire sequence, the accidental discovery, the immediate sealing of archives, the auction announcement that followed within weeks, as a remarkably convenient narrative for substantially raising a collectible's value, since a puzzle confirmed as genuinely solvable and now privately owned commands a different kind of fascination than one merely rumored to be crackable. Sanborn's own statements complicate this reading rather than resolving it: he has been candid for years about the genuine personal toll Kryptos has taken, describing threats, a hacked computer, and security measures installed at his home, details that argue against a calculated publicity stunt and toward authentic, longstanding strain. A third position, common among the dedicated community of amateur Kryptos researchers, treats the 2025 development as essentially beside the point: the cipher's actual cryptographic method remains unbroken by anyone outside Sanborn's circle, meaning K4 is, in the strictest technical sense, still unsolved no matter who currently owns the answer on paper.
The Curious Connection
Kryptos closes this series' exploration of unsolved ciphers with an outcome unlike any of its predecessors. Z340 fell to patient, transparent, publicly documented mathematics, openly shared and verified by the FBI for anyone to read. K4's plaintext surfaced through an entirely different mechanism: not codebreaking at all, but a human filing error, the same category of vulnerability that cryptographers in adjacent fields describe as the real weak point in nearly all modern security. Cutting-edge encryption protecting emails and financial transactions is rarely broken through brute mathematical force; it is undermined by phishing, misconfiguration, and exactly the kind of accidental disclosure that handed Kobek and Byrne their answer. Kryptos, deliberately built as an analog artwork referencing the deep history of cryptography, ended up illustrating one of the field's most modern lessons almost by accident.
The auction's outcome adds a final, distinctly contemporary twist: a 35-year public mystery, sustained by thousands of amateur cryptanalysts working for free out of genuine curiosity, was ultimately resolved not by collective effort but by private purchase, with the actual answer now sealed behind both a Smithsonian embargo and a single owner's discretion. The puzzle that was built to be public, displayed in a government courtyard specifically to provoke open fascination, ends this chapter as the most expensive secret in the history of recreational cryptography, technically solved and simultaneously further from public view than it has ever been.
FAQ
What is Kryptos?
Kryptos is a sculpture by artist James Sanborn located at CIA headquarters in Langley, Virginia, dedicated in 1990. It contains four encrypted passages, K1 through K4, primarily using a Vigenère cipher, with the first three solved between 1992 and 1999 and the fourth remaining publicly unsolved.
Has K4 actually been solved?
The K4 plaintext was discovered in September 2025 by journalists who found it accidentally archived at the Smithsonian, and Sanborn confirmed its accuracy. However, no one has cryptographically broken the cipher's underlying method, and the text was sold at private auction in November 2025 rather than released publicly.
Why did Jim Sanborn auction the K4 solution?
After the accidental 2025 discovery threatened to undermine the puzzle's value, Sanborn, then approaching his 80th birthday and having experienced health issues, chose to auction his complete Kryptos archive, including the K4 solution, rather than continue personally safeguarding a secret that had reportedly brought him threats and security concerns for decades.
What is K5?
K5 is a fifth, additional hidden message within Kryptos whose existence Sanborn confirmed in an open letter in August 2025. He has stated it will only be revealed once K4 becomes public knowledge.
Who solved the first three Kryptos passages?
An NSA internal team solved K1 through K3 by 1992, and CIA analyst David Stein solved them by hand in 1998, though neither disclosure was made public at the time. The first public announcement came from computer scientist Jim Gillogly in 1999, prompting the CIA to confirm its own earlier internal solution.