How We Won First Place at DEF CON 32 Crypto Challenge

Q: How Does a Book Cipher With Dog-Eared Pages Work?

The first puzzle we tackled was called Etiquette. The flavor text described a grandson receiving an old etiquette book — The Ladies and Gentlemen Etiquette Book of the Best Society — from his grandmother. Clicking a link in the puzzle revealed a PDF of this book, and sharp-eyed teammates immediately

Q: How Do You Solve Cipher Puzzles at DEF CON Crypto Village?

The second puzzle I cracked was called Masquerade. It involved a ballroom dance ceremony with a peculiar algorithm hidden in flowery, verbose prose. The flavor text described masked guests entering and exiting a building, and the "Ceremony Master" announcing a curious phrase: "The baron doth gaze so

Q: What Is the Dancing Man Cipher From Sherlock Holmes?

The puzzle called Charades dropped us into an image of stick figures in various poses. No text, no instructions — just dancing figures. If you're a Sherlock Holmes fan, you might recognize this immediately: it's the Dancing Men cipher, a substitution cipher where each stick figure pose represents a

DEF CON is one of the world's largest and most iconic hacking conferences, held annually in Las Vegas. But more than a conference, it's a massive playground of puzzles, competitions, and creative problem-solving. At DEF CON 32, as a first-time attendee, I joined Prim's team, the Psychoholic, and after 72 grueling hours of cipher cracking, sleep deprivation, and a healthy dose of conspiracy-level overthinking, we took first place in the Gold Bug crypto village challenge — solving 12 out of 13 puzzles. Out of 250 competing teams, only 40 got even a single puzzle correct. Here's how we did it.

What Is the Gold Bug Challenge and Why Is It So Hard?

The Gold Bug challenge is part of DEF CON's Crypto Village, a dedicated space where attendees tackle cryptographic puzzles ranging from beginner-friendly to completely brain-melting. This year's challenge featured 13 individual puzzles plus one meta puzzle. With 250 teams competing, the difficulty is evident in the numbers: 10th place solved only 3 puzzles. We solved 12.

What makes it so hard isn't just the cryptographic knowledge required — it's the layered nature of the puzzles. Each one hides its mechanism. You often don't even know what kind of cipher you're dealing with until you've already dug several layers deep. Add in sleep deprivation and you've got a recipe for seeing clues everywhere, even where there aren't any.

What Is DEF CON and How Do the Hacking Challenges Work?

If you've never been to DEF CON, think of it as the Super Bowl of hacker culture. Thousands of security researchers, hobbyists, professionals, and curious minds descend on Las Vegas to attend talks, run workshops, and most importantly — compete. The hacking challenges, often called CTFs (Capture the Flag), are scattered across the entire conference in various "villages," each themed around a different area of security or cryptography.

The Crypto Village is where cipher enthusiasts gather. Challenges are released and teams race to decode them, earn points, and climb the leaderboard. It's collaborative, competitive, and completely addictive. For a first-timer, the experience is overwhelming in the best possible way.

How Does a Book Cipher With Dog-Eared Pages Work?

The first puzzle we tackled was called Etiquette. The flavor text described a grandson receiving an old etiquette book — The Ladies and Gentlemen Etiquette Book of the Best Society — from his grandmother. Clicking a link in the puzzle revealed a PDF of this book, and sharp-eyed teammates immediately noticed something: every page had a subtle dog-eared fold mark in a different position.

My first instinct — classic Alex Jones cipher mode — was to find where specific quoted phrases intersected with the fold marks and decode from there. I even calculated positional relationships between sentences and fold locations. The result? Never at. Wrong answer.

The actual solution was far more elegant. Teammate G suggested we look at the parts of each page that were NOT folded — the unfolded middle sections. By extracting those line segments from every page and rendering them one pixel at a time using a Python script, the lines formed readable letters. The dog-eared folds were literally drawing the answer through negative space. The result spelled out a clear phrase, worth 100 points and our first score on the board.

Key Takeaway From the Book Cipher Puzzle

Sometimes the answer isn't where you're looking — it's in what's left behind. When you're deep in cipher-solving mode, remember to consider the inverse of what seems obvious.

How Do You Solve Cipher Puzzles at DEF CON Crypto Village?

The second puzzle I cracked was called Masquerade. It involved a ballroom dance ceremony with a peculiar algorithm hidden in flowery, verbose prose. The flavor text described masked guests entering and exiting a building, and the "Ceremony Master" announcing a curious phrase: "The baron doth gaze sour toward steamed pudding cold."

Reading the instructions carefully revealed they were literally describing the algorithm step by step — placing guests (representing letters) around a circle of 26 positions, announcing letters, moving guests to specific markers, and shifting positions. It was essentially a custom substitution cipher built through a choreographed dance.

My approach was methodical:

Replicate the exact algorithm in code, printing every step to match the provided example output.
Run the known test phrase through the algorithm and compare output to the provided answer.
Once the outputs matched exactly, run the actual cipher text through the inverse of the algorithm.
The decoded output was 13 letters long — matching every other answer we'd seen.

The answer: accuse. Two puzzles down.

What Is the Dancing Man Cipher From Sherlock Holmes?

The puzzle called Charades dropped us into an image of stick figures in various poses. No text, no instructions — just dancing figures. If you're a Sherlock Holmes fan, you might recognize this immediately: it's the Dancing Men cipher, a substitution cipher where each stick figure pose represents a letter of the alphabet.

Decoding the figures gave us: ARCOLC — clearly not the answer, since it was neither 13 letters nor recognizable English. But above each figure were 13 speech bubbles containing words, and each word contained embedded Roman numerals.

Here's where it got clever: calculating the Roman numeral values of each word gave distinct numbers from 1 through 13. Sorting the words by those values and mapping each Dancing Man letter to its ordered position produced the final phrase: rail crash hero — 13 letters, proper English, confirmed correct.

Confession time: I was working on this puzzle early on and mistranslated one Dancing Man figure — an S that I read as an L. I also got completely sidetracked by small numbered buttons on the image, convinced they were a hidden clue. They were not. This is the DEF CON experience in a nutshell: you will go down rabbit holes, and sometimes a teammate will gently redirect you back to reality.

What Happens When Sleep Deprivation Meets a Complex Cipher?

The puzzle that nearly broke us — and provided the most unintentional comedy — was part of Cipher Mystique. It involved a colorful potion shelf belonging to "Roy G Biv," an alchemist. Each bottle had a color and a shape, and a series of arithmetic equations revealed that each color and shape combination mapped to a specific decimal value.

After solving all the color-math equations, we summed values in groups of three, applied modulo arithmetic, and converted to ASCII. The result told us to "rot left drop last" — rotate the bottle sequence left and drop the last column.

Simple enough, right? Except at 2 in the morning after 48+ hours awake, teammate G and I could not make the output look like English. We rotated every conceivable way. We dropped individual bottles, entire rows, last columns, first columns. We laughed at strings of letters that looked like alien language. We genuinely questioned our sanity.

The answer was staring us directly in the face. Literally. When the correctly rotated and dropped values were mapped back to the shelf and rendered visually, the bottles spelled out words in the physical layout of the shelf itself: vile axe. Not a text output — a visual one. Once we saw it, we couldn't unsee it. It unlocked the next page, and we erupted.

What Should First-Time DEF CON Attendees Expect?

DEF CON 32 was my first, and it was everything I hoped for and nothing I was prepared for. Here's the honest truth for anyone considering it:

You will be sleep-deprived. The puzzles don't care about your circadian rhythm.
Teamwork is everything. There's no way one person solves 12 puzzles in 72 hours alone.
You'll go down wrong paths. And that's okay. Ruling out wrong answers is progress.
The community is incredible. I also participated in Crash and Compile — a coding challenge where you drink and solve problems simultaneously. My internet died and I had to push code via GitHub on my phone while a friend pulled the output. We didn't win. It was still one of the best nights.

Whether you're an experienced CTF competitor or a complete newcomer, DEF CON has a place for you. The Gold Bug challenge alone is worth the trip. Just maybe sleep before you go.