A coded sculpture at CIA headquarters hides a message no one has cracked

What the code has already given up

The strongest reason to believe K4 hides a real message is that its three siblings do. The solved passages are not ambiguous smears that believers project meaning onto; they are clean, checkable English, and they were cracked independently by three different parties.

K1uses a keyed Vigenère cipher and decrypts to a line of Sanborn's own writing: “Between subtle shading and the absence of light lies the nuance of iqlusion” — the last word misspelled on purpose. K2, keyed differently, reads as a cryptic narrative about something “totally invisible” gathered and buried “undergruund,” complete with a set of latitude-and-longitude coordinates and a reference to a figure known only as “WW.” K3abandons substitution for a columnar transposition and paraphrases the archaeologist Howard Carter's diary entry on breaching Tutankhamun's tomb: “Slowly, desparatlyslowly … with trembling hands I made a tiny breach in the upper left hand corner … can you see anything?”

The break history is a matter of record. A team inside the NSA quietly solved K1 through K3 as early as 1992. CIA analyst David Stein solved the same three by hand in 1998, an achievement circulated only within the intelligence community. Then, in 1999, computer scientist Jim Gilloglyannounced that he had cracked them with a computer — the first public solutions, which prompted the CIA to acknowledge Stein's earlier work. Three passages, three independent breaks: the sculpture has a demonstrated habit of eventually yielding true plaintext.

Sanborn has narrowed K4 further himself. In 2010 he told The New York Timesthat the ciphertext letters NYPVTT, at positions 64–69, decrypt to BERLIN. In 2014he added that positions 70–74 give CLOCK, making the phrase BERLIN CLOCK. In 2020 he revealed that positions 22–34 read EAST NORTHEAST. Four confirmed cribs, a proven artist, and three already-broken sections: to a solver, K4 looks less like a wall than like the next step.

Why the fourth passage will not break

And yet it has held for more than thirty years against exactly the people best equipped to break it. The uncomfortable truth for optimists is that knowing pieces of the answer has not revealed the method.With K1 and K2, once you recognized the keyed Vigenère structure, the whole passage fell. With K4, solvers possess four verified plaintext fragments — BERLIN, CLOCK, EAST, NORTHEAST — anchored to exact positions, and still no published cipher reproduces them across the rest of the 97 characters.

That failure is telling. It means K4 is almost certainly not a straightforward classical cipher of the kind used in K1 through K3, because those systems would have surrendered to crib-dragging years ago. The cribs behave as if the plaintext passed through some additional layer — a second stage of masking, a hand alteration, a deliberately irregular system — that Sanborn built specifically so the earlier techniques would not carry over. The 97 characters may simply be too few to pin down such a system from the outside.

The much-discussed misspellings illustrate the problem. IQLUSION, UNDERGRUUND, and DESPARATLYare unquestionably intentional, and for decades solvers have argued they encode a hidden second key. But Sanborn has never endorsed that interpretation, and no one has turned the misspellings into a procedure that outputs K4's plaintext. They are a genuine anomaly that has generated countless theories and zero confirmed solutions — the recurring shape of the whole K4 problem.

The 2025 developments underline rather than dissolve the point. When the answer finally surfaced, it did so because researchers foundit among Sanborn's donated papers, not because anyone decoded it. The writer Jarett Kobek and journalist Richard Byrneread the plaintext in his archive at the Smithsonian's Archives of American Art; the archive was then sealed, and the solution was auctioned to a private buyer for $962,500, all parties agreeing to keep it quiet. As a cryptographic challenge, K4 was not solved in 2025. It was merely spoiled for a very small number of people while remaining unbroken for everyone else.

Why people cannot stop trying

The devotion Kryptos inspires is not credulity — the puzzle is real and its earlier sections genuinely decode — but it does run on a nearly perfect engine for sustaining effort. The foundation is verifiable success. Because K1, K2, and K3 provably decrypt, every solver can treat K4 not as a possibly-empty box but as a puzzle that is merely unfinished. Failure gets framed as “we haven't found the right approach yet,” never as “there may be nothing tractable here” — a stance no amount of fruitless work can dislodge.

The setting supplies the rest. A code stumping cryptanalysts, standing in a courtyard at CIA headquarters, co-designed by the agency's former cipher chief, feels charged with institutional secrecy in a way an ordinary artwork never could. Sanborn's occasional clues keep the flame lit: each new crib revives the community, appears to shrink the search space, and reassures everyone that the artist wants the message found. His warning that solving K4 only yields a further riddle is, psychologically, an invitation dressed as a caution — there is always one more door.

Finally there is the prize, which is pure status. Whoever reads K4 from the ciphertext alone will be remembered as the person who cracked the world's most famous unsolved code. That is an enormous reward for exactly the self-directed puzzle-solver most likely to spend years on it — and it explains why, even after a private answer changed hands in 2025, fresh solvers keep arriving to break the cipher the honest way. The community around Elonka Dunin's long-running Kryptos site has not disbanded; it has simply set itself a purer goal.