For 35 years a sculpture taunted the CIA's own codebreakers, then its last secret slipped out
A few steps from the entrance of America's most secretive agency stands a slab of copper covered in nonsense letters. Three of its four coded messages were read long ago. The fourth defeated the best cryptographers in the world for a third of a century. The way Kryptos finally gave up its secret in 2025 is even stranger than the code itself.
A curved copper screen of cut-out letters has hidden a message in plain sight at Langley since 1990. Illustration: Watts & Wild.
In a courtyard at the heart of CIA headquarters in Langley, Virginia, sits one of the most famous puzzles on Earth. Kryptos is a sculpture made of curved copper covered in nearly 1,800 punched-out letters, and hidden inside that jumble are four secret messages set there deliberately to be decoded. It was dedicated in November 1990, and within its own walls the agency that lives and breathes secrets had built itself a riddle.
For most of the next 35 years, that riddle stayed three-quarters answered and one-quarter maddeningly shut. This is the story of how it was built, why it held out for so long, and how its last lock was finally picked, not by a genius with a pencil, but by accident.
A puzzle at the heart of the spy agency
The sculpture was the work of the American artist Jim Sanborn, who built it with the help of a retired CIA cryptographer to make sure the codes were genuinely solvable. The theme he chose was intelligence gathering itself, the act of pulling a hidden truth out of noise. The copper screen rises like a scroll caught mid-curl, and the letters are not decoration; every one of them is part of a working cipher.
Sanborn split the text into four sections, now known as K1, K2, K3 and K4. Three of them lean on classic encryption methods that a determined expert could eventually unwind. The fourth, the shortest at just 97 letters, he built to be brutally hard, and he kept its answer entirely to himself.
What the Kryptos code actually says
The first three passages were cracked over the 1990s, first quietly inside the NSA and the CIA, then publicly in 1999 by an independent computer scientist who ran the letters through his own software. The solved sections of the Kryptos code read like fragments of a riddle, with lines about subtle shading and the absence of light, a question asked into the dark, and the careful record of a buried location on the CIA grounds.
One passage even contains a deliberate misspelling, a quirk Sanborn added on purpose, and the wording hints at something hidden and dug up. Taken together, the three solved messages feel less like a memo and more like a treasure map written by a poet, which is roughly what Sanborn intended.
The passage that beat the codebreakers
Then there was K4. The final 97 letters refused to fall to any known technique, and an entire community of amateur and professional codebreakers threw themselves at it for years without success. K4 became one of the most famous unsolved codes in the world, a single sentence that outlasted every supercomputer and obsessive that came for it.
To keep interest alive, Sanborn began releasing tiny clues. In 2010 he revealed that part of the hidden text spelled BERLIN, in 2014 he added CLOCK, and in 2020 he offered NORTHEAST and EAST. The BERLIN CLOCK pointed not to the Berlin Wall directly but to a real, eccentric timepiece in the city, the Berlin World Clock, while the whole solution wove in Sanborn's 1986 trip to Egypt and the fall of the Wall in 1989. The clues helped, and still no one closed it out.
A secret that escaped, not cracked
The ending, when it came in 2025, did not look like the movies. Sanborn, now in his late seventies, had donated his archives to the Smithsonian's collection of American art. In September 2025 two journalists digging through those donated papers found scraps that, pieced together, appeared to be the full plaintext of K4, and Sanborn confirmed the text was genuine.
It was an awkward twist for everyone. Sanborn had actually been planning to auction off the solution, treating the secret itself as a kind of artwork, and the accidental leak landed in the middle of that plan. After 35 years of brute force and brilliant guesswork, the answer slipped out through a filing cabinet rather than a cipher attack. The message had been there to read all along, just in the wrong archive.
Has the Kryptos code been solved?
In one sense, yes: the words of K4 are now known and confirmed by the man who wrote them. But the puzzle was never publicly cracked by codebreaking, which is why many enthusiasts feel the real challenge, the method that turns those 97 jumbled letters into the answer, still has not been honestly won.
It is a fitting outcome for a sculpture about the messy reality of intelligence. The secret was kept for decades, then lost not to a cleverer enemy but to ordinary human paperwork, the same way real intelligence triumphs so often turn on a misplaced document rather than a flash of genius.
A code built to be solved sat unbroken for 35 years inside the home of the world's best codebreakers, then leaked out by accident. Does a secret that escapes through a forgotten file count as solved, or did Kryptos win in the end? Tell us what you think in the comments.
Related reading: the Voynich manuscript, a 600-year-old book in a language no one can read.
