Cicada 3301: The Internet’s Greatest Unsolved Mystery
On January 4, 2012, a black-and-white image appeared on 4chan’s paranormal board. The message was simple: “Hello. We are looking for highly intelligent individuals. To find them, we have devised a test.” It was signed “3301.”
Most people scrolled past it. A few dug in. What they found changed everything.
How It Started
Opening the image file in a text editor revealed hidden ASCII text pointing to a Caesar cipher. Decoding it led to an Imgur image of a duck. That was the decoy.
The real clue was in the image itself. Two embedded words pointed to a steganography tool called OutGuess. Running it on the original image pulled out a hidden PGP-signed message. That message led to a Reddit page filled with Mayan numerals and encrypted text.
From there, solvers found a phone number in Texas. Calling it played an automated message asking them to multiply three prime numbers together, one of which was 3301, and visit the resulting URL. That URL displayed a countdown timer and a cicada image.
When the timer hit zero, the site revealed 14 GPS coordinates pointing to real-world locations. Warsaw. Paris. Seattle. Seoul. Miami. Honolulu. Sydney. At each location, a physical poster waited on a telephone pole, hand-drawn cicada included, with a QR code linking to a darknet .onion page.
Whoever did this had people on the ground across four continents.
What You Needed to Solve It
Cicada 3301 tested a wide range of technical skills all at once. Solvers needed to know steganography, classical ciphers like Caesar and Vigenere, modern RSA encryption, prime number theory, Tor and darknet navigation, and programming to automate decoding. The puzzles also pulled from literature, philosophy, Anglo-Saxon runic scripts, and Aleister Crowley’s writings.
Every legitimate message came signed with the same OpenPGP key, fingerprint ending in 7A35090F. This level of cryptographic discipline mirrors what intelligence agencies use to maintain anonymous operations.
The Winners
After the public phase, the puzzle went private. One of the few confirmed winners was Marcus Wanner, a 15-year-old from Virginia. He received an email from 3301 describing themselves as “an international group” with no name, no symbol, and no membership list, united by beliefs in liberty, privacy, and security.
Winners were placed in a private forum and asked to build something. The 2012 group proposed CAKES, the Cicada Anonymous Key Escrow System, a dead man’s switch designed to protect whistleblowers by automatically publishing their data if they were arrested or killed. The project collapsed. Nobody got paid. Motivation faded. Wanner eventually became the only one still showing up.
Round Two and Three
The puzzle returned on January 4, 2013, exactly one year later. It added original music compositions, Crowley references, and more layers of encryption. About 10 people completed the 2013 round and entered a private channel with 3301.
In 2014, a third round introduced the Liber Primus, a 75-page book written entirely in Anglo-Saxon Futhorc runes using a custom cipher system. Solvers have only cracked about 17 of those pages. The remaining 58+ are still being worked on today by an active community on Reddit and Discord.
The last verified PGP-signed message from 3301 appeared in April 2017. It said: “Do not believe anything that is not signed with our PGP key.” Nothing verified has appeared since.
Who Did It
Nobody knows. The leading theories are:
An intelligence agency. The puzzles target exactly the skills the NSA, CIA, and similar agencies recruit for. Those agencies have used puzzle-based recruiting before. But Wanner’s leaked email explicitly says 3301 is not affiliated with any government.
A privacy-focused collective. The CAKES project and the group’s stated values around liberty and security point toward privacy activism. But coordinating physical posters across 14+ cities for years is extreme for a volunteer group.
A cybersecurity professional group. The skills tested match security work, and winners were put to work building security tools. No known firm has ever claimed it.
An ARG, or alternate reality game. The structure fits. But no one has ever tried to monetize it, and it outlasted any known ARG by years.
Where It Stands Today
The PGP key 7A35090F still exists. Its private half sits with someone who has stayed completely silent for over eight years. The Liber Primus pages are still being decoded. No arrests. No identities. No company or agency has ever stepped forward.
What makes Cicada 3301 stand out is not the complexity of the puzzles. It is the operational security behind them. Whoever did this coordinated a multi-year, multi-country operation involving darknet infrastructure, physical deployments, original music, custom literature, and strict cryptographic discipline, all without leaving a single traceable identity behind.
That is the actual puzzle.
