Cicada 3301
Internet puzzles and verifiable signatures
▲ Cover of the incident – Unfolding the records
Cicada 3301, which appeared on an Internet bulletin board in 2012, linked encryption, steganography, telephone, and physical posters. The identity and ultimate purpose of the organizers have not been confirmed.
Cicada 3301 creates trust through cryptographic signatures even in anonymity. It's not just the puzzle that remains unresolved, it's the purpose of the group with that signature.
Prologue: The night that broke records
When I laid out the case data on my desk, the first thing I noticed was not the correct answer but an imbalance. Some scenes were overly clear, and some time periods were completely blank. People try to explain the entire incident by focusing on one clear scene, but I instead marked the blank section first. Mysteries can arise because there are many clues, but they can also arise because the distance between clues is too great.
The first puzzle started with a hidden message in an image and continued with QR codes for various websites and real cities. Official messages were then identified as authentic by their PGP signature.
I did not view this incident as confirming an already known conclusion. The records were arranged chronologically, the movement paths of objects were drawn separately, and sightings and interpretations were indicated in different colors. The most popular explanations were then deliberately reviewed last. Because when you first read a famous hypothesis, all the clues seem to exist for that hypothesis.
▲ On-site reconstruction — last confirmed movement route
Case Files: What I Could Believe
| number | confirmed record | current reliability |
|---|---|---|
| 1 | Major puzzle rounds appeared in 2012, 2013, and 2014. | high |
| 2 | Participants covered classical ciphers, book ciphers, digital hiding, Tor addresses, and more. | high |
| 3 | PGP signatures have been a key tool in distinguishing between copycat posts and official messages. | middle |
| 4 | The runic Liber Primus has only partially agreed upon decipherings. | middle |
The identity of the organization, the subsequent activities of the selected participants, the purpose of the puzzle, and undeciphered portions of Liber Primus remain.
The sentence ‘It is not explained’ is not the same as the sentence ‘It is supernatural’ or ‘Someone intended it’. I didn't use the blank space as evidence.
▲ Timeline – Flow before and after the event
Reconstructing the Scene: Finally, a Certain Point
I changed the location where the incident took place to the actual route rather than the stage in my head. We divided the starting point, final confirmation point, and discovery location and calculated the time needed in between. In the process, several later dramatic depictions were omitted. Instead, the recorded sounds, weather, means of transportation, and locations of objects came to the fore. The novelistic atmosphere arose from the very texture of the facts. There was no need to add unidentified secret passageways or nameless accomplices.
When reconstructing the last scene, I did not determine the character's feelings. The same behavior can be caused by fear, planning, mistake, or fatigue. So, I wrote down the actions first and left the emotions to the extent possible. Thanks to this principle, events became less flashy but more concrete.
Clue 1. Major puzzle rounds appeared in 2012, 2013, and 2014.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tried to tackle the next record: “Contestants covered classical cryptography, book ciphers, digital hiding, Tor addresses, and more.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “If the purpose was recruitment, why were the organization’s performance not disclosed?” will ignore the remaining records instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
▲ Key Clue 1 — Traces left by records
Clue 2. Participants covered classic ciphers, book ciphers, digital stashes, Tor addresses, and more.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tackled the next note: “PGP signatures were a key tool in distinguishing between copycat posts and official messages.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “Is Liber Primus the final gateway or an independent work?” will ignore the rest of the record instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
▲ Key Clue 2 — Pieces that do not fit together
Clue 3. PGP signatures were a key tool for distinguishing between copycat posts and official messages.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tried the next record, “The runic Liber Primus has only partially agreed upon deciphering.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “How much do physical clues around the world reveal about the size of the central organization?” ends up ignoring the rest of the record instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
▲ Key Clue 3 — Evidence that shakes the hypothesis
Clue 4. The runic Liber Primus has only partially agreed upon deciphering.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tried to match it with the next record: “Major puzzle rounds appeared in 2012, 2013, and 2014.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “If the purpose was recruitment, why were the organization’s performance not disclosed?” will ignore the remaining records instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
put three hypotheses on the same scale
Hypotheses were not evaluated in fancy sentences. We wrote down the number of explanatory clues, the number of new assumptions required, and the degree to which they can withstand contrary evidence. Even if one clue is completely explained, if the remaining three clues have to be discarded, it is not a good hypothesis.
Hypothesis A. Security and information talent recruitment project
The beauty of this explanation is that it takes relatively few assumptions: “Major puzzle rounds appeared in 2012, 2013, and 2014.” I first assumed that this hypothesis was true and re-traced the event from beginning to end. Each sentence linked where and what the character saw, what judgment he made, and then moved to the next location. There was always a hidden assumption at the point where the connection was lost.
The biggest weakness is that it does not sufficiently explain “PGP signatures have been a key tool in distinguishing between imitation posts and official messages.” If you keep adding exceptions to your hypothesis, you can explain anything, but such an explanation predicts nothing. I lowered the score of the hypothesis the moment there were more than two exceptions. Conversely, scores were increased only when two independent clues pointed in the same direction.
In the end, this hypothesis cannot be completely discarded, but it cannot be taken as a conclusion either. If you read the incident like a novel, the blank spaces will be filled in naturally. If you read it like an investigation record, the blank spaces remain. I chose the latter. Even if the blank space left is inconvenient, that inconvenience protects the scope of what the evidence can say.
Hypothesis B. A philosophical experiment in online secret communities
The beauty of this explanation is that it makes relatively few assumptions: “Participants worked with classical ciphers, book ciphers, digital stashes, Tor addresses, etc.” I first assumed that this hypothesis was true and re-traced the event from beginning to end. Each sentence linked where and what the character saw, what judgment he made, and then moved to the next location. There was always a hidden assumption at the point where the connection was lost.
Its greatest weakness is that it does not sufficiently explain “the runic Liber Primus has only partial, agreed-upon deciphering.” If you keep adding exceptions to your hypothesis, you can explain anything, but such an explanation predicts nothing. I lowered the score of the hypothesis the moment there were more than two exceptions. Conversely, scores were increased only when two independent clues pointed in the same direction.
In the end, this hypothesis cannot be completely discarded, but it cannot be taken as a conclusion either. If you read the incident like a novel, the blank spaces will be filled in naturally. If you read it like an investigation record, the blank spaces remain. I chose the latter. Even if the blank space left is inconvenient, that inconvenience protects the scope of what the evidence can say.
Hypothesis C. Art and game projects continued by several creators
The beauty of this explanation is that it makes relatively few assumptions: “PGP signatures were a key tool for distinguishing between copycat posts and official messages.” I first assumed that this hypothesis was true and re-traced the event from beginning to end. Each sentence linked where and what the character saw, what judgment he made, and then moved to the next location. There was always a hidden assumption at the point where the connection was lost.
The biggest weakness is that it does not sufficiently explain “major puzzle rounds appeared in 2012, 2013, and 2014.” If you keep adding exceptions to your hypothesis, you can explain anything, but such an explanation predicts nothing. I lowered the score of the hypothesis the moment there were more than two exceptions. Conversely, scores were increased only when two independent clues pointed in the same direction.
In the end, this hypothesis cannot be completely discarded, but it cannot be taken as a conclusion either. If you read the incident like a novel, the blank spaces will be filled in naturally. If you read it like an investigation record, the blank spaces remain. I chose the latter. Even if the blank space left is inconvenient, that inconvenience protects the scope of what the evidence can say.
▲ Comparison of hypotheses – explanatory power and gaps
Conclusions I threw away
When I began my investigation, I too was drawn to the most popular explanation. It summed up events in one sentence and gave intention to every object. But when the data was collated, the explanation required a new coincidence for every blank space. I erased that conclusion and started again. Good reasoning is less about adding things and more about removing unnecessary assumptions.
Signature verification is more important than organizer claims. Unsigned follow-up messages have weak grounds for being considered official puzzles, even if they use the same name.
In particular, details repeated in later testimonies and on the Internet were separated from the original records. Just because the same sentence appears in multiple places does not mean there are multiple independent sources. First, we checked the possibility that a single incorrect sentence was duplicated. After going through this process, the size of the case decreased, but the weight of the remaining clues actually increased.
▲ Counterevidence check — the conclusion I discarded
Final Reason: What I arrived at
Cicada 3301 creates trust through cryptographic signatures even in anonymity. It's not just the puzzle that remains unresolved, it's the purpose of the group with that signature.
This conclusion is not a completely definitive ruling. This is a direction that requires the fewest assumptions and simultaneously explains the most clues within the currently available records. It may be revised as new physical evidence emerges. However, it is also clear that the conclusion may change depending on what comes out. Reliable original records, verifiable forensic data, and independent evidence directly linking objects and people are needed.
I do not write that the case is closed. Instead, write down how far you can close it. That boundary is the result of this investigation. The fun of mystery is not that anything is possible. The goal is to find out which of the possible explanations can be discarded.
▲ Final judgment – explanation that requires the fewest assumptions
Additional Investigation Records 1. Redraw the timeline
At dawn, I opened the case sheet again. This time, the conclusion was obscured and only the record was “Major puzzle rounds appeared in 2012, 2013, and 2014.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put a hypothesis called “Security and Information Talent Recruitment Project.” At first everything seemed to fall into place. However, when we asked the question, “If the purpose was recruitment, why weren’t the organization’s performance made public?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation record 2. The missing link
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the record, “Participants covered classical cryptography, book cryptography, digital hiding, Tor addresses, etc.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put the hypothesis “Philosophical experiment in an online secret community.” At first everything seemed to fall into place. However, when we asked the question, “Is Liber Primus a final gateway or an independent work?”, a weak point in the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation records 3. Witness distance
At dawn, I opened the case sheet again. This time, the conclusion was obscured and only recorded, “PGP signatures were a key tool for distinguishing between imitation posts and official messages.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put the hypothesis that it was “an art/game project continued by several creators.” At first everything seemed to fall into place. However, when we asked the question, “How much do physical clues around the world reveal about the size of the central organization?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation record 4. The path the object took
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the following record: “There are only partial, agreed-upon decipherments of the runic Liber Primus.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put a hypothesis called “Security and Information Talent Recruitment Project.” At first everything seemed to fall into place. However, when we asked the question, “If the purpose was recruitment, why weren’t the organization’s performance made public?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation records 5. Temptation of false clues
At dawn, I opened the case sheet again. This time, the conclusion was obscured and only the record was “Major puzzle rounds appeared in 2012, 2013, and 2014.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put the hypothesis “Philosophical experiment in an online secret community.” At first everything seemed to fall into place. However, when we asked the question, “Is Liber Primus a final gateway or an independent work?”, a weak point in the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional Investigation Record 6. Reconstruction of the final scene
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the record, “Participants covered classical cryptography, book cryptography, digital hiding, Tor addresses, etc.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put the hypothesis that it was “an art/game project continued by several creators.” At first everything seemed to fall into place. However, when we asked the question, “How much do physical clues around the world reveal about the size of the central organization?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
▲ End of investigation record — Questions still remaining
· CicadaSolvers — Signature/Puzzle History
※ This article is a commentary in the form of a personal investigation record based on public records and reliable data. We distinguish between facts and inferences, and we update our judgments when new official announcements are made.
Image sources and editing
Openly licensed material from Wikimedia Commons was used by cropping, scaling, and color correcting to fit the flow of the text. Episodes with mixed generated images are not included in the list below.
- Internet map 1024.jpg — The Opte Project, CC BY 2.5
- P-products-xsh-screenshot2.png — NetSarang Computer, Inc., CC BY 4.0
- Cicada 3301 poster locations.png — User:Андрей_Романенко, telenavdrives from openstreetcam (© Telenav and OpenStreetCam Contributors), User:Averette, User:Lawe, User:RebelAt, CC BY-SA 4.0
- Dead Tree Cicada3301 HD.png — 3301J, CC0
- Cabinet Network Rear Close.jpg — Robert.Harker, CC BY-SA 3.0
- Host-Bus-Adapter-(HBA).jpg — Marcin Wieclaw (Pc Site), CC BY-SA 4.0
- Kissimmee-Computer-Services-Network.jpg — Computer Support Kissimmee, CC BY-SA 4.0