The Ending Of Blackhat Explained
With an estimated budget of $70 million and a worldwide gross of just under $20 million, Michael Mann's 2015 cybercrime thriller "Blackhat" was a pretty major box office bomb. Despite that and some lackluster reviews, the film still has some high-tension thrills to offer, following a cybercrime task force as they search for a "black hat" hacker responsible for overheating a nuclear reactor in Hong Kong.
To crack the case, FBI agent Carol Barrett (Viola Davis) teams up with Chen Dawai (Wang Leehom), a captain in the Chinese People's Liberation Army's cybercrimes division, and Chen's sister Lien (Tang Wei), an accomplished computer systems engineer. Chen insists they also bring on Nick Hathaway (Chris Hemsworth), an American hacker doing time in prison, to assist the joint task force. Barnett is doubtful, but Chen explains that he and Hathaway co-wrote the program used by the hacker as a prank while they were in college together. As a result, the DOJ furloughs Hathaway from prison and offers him his freedom if he can help track down the black hat.
This action-packed techno-thriller was noted at the time by cybersecurity experts for its strikingly realistic depictions of cybercrime (per The Los Angeles Times). Mann's film explores how cybercrime manifests in the material world, showing us how vulnerable we are to digital intrusions and the personal cost of hacking attacks. If you had a hard time following the film's serpentine plot, keep reading as we break down the ending of "Blackhat."
Hathaway uses a phishing email to access Black Widow
The beginning of the end for the joint task force in "Blackhat" comes when they diverge from legal methods in their investigation. This occurs after the NSA refuses to give them access to Black Widow, a computer program designed to reconstruct corrupted files. Desperate to solve the case and have his prison sentence commuted, Hathaway uses a spear phishing email to gain access to Black Widow and rebuild the files retrieved from the nuclear power plant.
After Barrett gives Hathaway access to her emails with the NSA, and a warning that he could face charges, she, Jessup (Holt McCallany), and Captain Chen all look the other way while Hathaway does his magic. He emails the NSA agent who denied Barrett access, posing as his supervisor. The email advises him to change his password, but the PDF in the email actually gives Hathaway access to a remote login for Black Widow, and a password to access it.
There was some contention amongst the film's cybersecurity consultants about how realistic this hack was. Former FBI cyber-agent Michael Panico told Vice, "My input was, well, you'd ostensibly think the NSA worker would be smarter than that." Former black hat hacker Kevin Poulsen had issues with the Black Widow software but thought the hacking methods were believable, telling Vice, "I think it's completely realistic. A well-constructed spear phishing attack can fool almost anybody." He added, "The current line of thinking is that's how the Sony hack started," referring to the 2014 cyberattacks on Sony Pictures Entertainment.
Black Widow tracks the black hat's proxy server to Jakarta
After Black Widow rebuilds the corrupted data retrieved from the nuclear power plant in Hong Kong, Hathaway tracks the hacker's IP address to a proxy server in Jakarta, Indonesia. Captain Chen explains that this proxy server is anonymous and secure, like a Swiss bank account, and that it's used by black hat hackers to hide the locations of their IP addresses. In real life, proxy servers have often been used by hackers in this manner.
Hathaway explains that because of the level of security the proxy server provides, the team must travel to Jakarta to physically access the facility. Agent Barrett and U.S. Marshal Jessup don't have the paperwork to travel to Indonesia to work in a law enforcement capacity, and they're hesitant to contact Washington after being refused Black Widow by the NSA. Captain Chen suggests working on this from his side of the investigation by meeting with his Chinese superiors to get the visas for the team to travel to Jakarta.
Former FBI cyber agent Michael Panico told Vice that Michael Mann was "serious about making the hacking elements ring true" in "Blackhat." "What's interesting is that the hacking scenes are what drive the plot along," Panico said. "It puts the people together with one another so that you can have the action sequences." This approach makes for a more engaging film about hackers because it brings the action out of cyberspace and into reality.
Barrett and Jessup are ordered to take Hathaway into custody
At a meeting with his superiors, Captain Chen's request for travel papers for the Americans is denied, and he's ordered to hand Hathaway over to the Americans so he can be tried for hacking the NSA. Chen's loyalty to Hathaway never wavers, however, and he immediately defies his orders, contacts Lien, and meets with Hathaway to tell him to disappear.
After the NSA discovers that Hathaway hacked into their system, possibly giving the Chinese access to Black Widow, his furlough is rescinded, and Barrett's superior at the FBI orders her to return to the U.S. with Hathaway in custody. Barrett argues that the cyberattack on the nuclear power plant is evidence the hacker is dangerous, saying they must use whatever means are necessary to prevent another act of dangerous cyber-terrorism. Barrett's supervisor accuses her of being blinded by her personal loss on 9/11, ordering her to bring Hathaway home.
When it's discovered that Lien and Hathaway are not in the safe house, despite Hathaway's ankle monitor saying he's in the apartment, Jessup realizes that Hathaway changed how often his ankle bracelet's location is updated in Jessup's phone. He did this while they were in Los Angeles, much earlier in "Blackhat." Despite not being happy about their orders because they've grown to like and respect Hathaway, Jessup and Barrett leave the safe house in pursuit of his current location, unsure of what they'll do when they find him.
Elias Kassar kills Chen, Jessup, and Barrett
Hathaway and Captain Chen decide to travel to Jakarta separately while Lien stays behind. Lien is furious with Hathaway and her brother for deciding for her. Standing on the street near Chen's car, Hathaway tries to explain to Lien why she can't go on the run with him now that he's a fugitive. He begs her not to be angry with her brother, who she waves at with a tremulous smile, just moments before a rocket blows him up.
The hacker's muscle, Elias Kassar (Ritchie Coster), and his squad of goons arrive to take the joint task force out, starting with Chen. Jessup and Barrett arrive on the scene moments after the explosion, engaging in gunplay with Kassar and his associates to draw fire away from Hathaway and Lien. Barrett is gunned down and dies looking up at a tower, similar to the one her husband died in on 9/11, and Jessup is killed after taking out multiple shooters.
Hathaway and Lien narrowly escape on a subway, where she tells him that she's coming with him to Jakarta. Being wanted by the NSA essentially robs Hathaway and Lien of whatever future they wished for together, and the violent deaths of Jessup, Barrett, and Lien's brother give them a steely resolve for vengeance.
Hathaway and Lien get counterfeit passports and travel to Indonesia
Lien uses her brother's contacts to get counterfeit papers and have Hathaway's ankle monitor cut off, allowing them to travel under new identities on the small plane Dawai had previously arranged. This is where Hathaway and Lien's hunt for the hacker becomes a personal vendetta with a go-for-broke tone.
Although the film is about cybercrimes, it brings the collateral damage of these crimes into the physical realm by killing off three of our main characters in one bloody confrontation. Hackers might commit crimes in cyberspace, but they have real-life consequences — something we see when the team flies over the overheated Chinese power plant, and when we watch Lien and Hathaway grieve Dawai while on the private plane to Jakarta.
Although "Blackhat" is a hacking movie with fast-paced action sequences, it's also filled with thoughtful silences. Some scenes in the final act of the film convey the emotional intensity Lien and Hathaway are experiencing through meaningful glances and fixed stares. These scenes highlight that when people grieve, they often feel alone despite the noisy, digitally connected world we now live in.
Hathaway and Lien investigate the hacker's satellite images
In Indonesia, Hathaway and Lien investigate the site pictured in the hacker's satellite photos, which is near a major dam. While at this remote location, Hathaway realizes the facility uses the same water pumps as the reactor in Hong Kong, and the hacker's plans suddenly become clear. This isn't about terrorism — it's about money. "Chai Wan was a rehearsal," Hathaway tells Lien. "He's going to shut down these pumps, and flood the tin mine, and the valleys, and the villages." The villain's goal, they realize, is to skyrocket the price of tin options and profit immensely, using the money acquired from the earlier hack of the Chicago Mercantile Exchange. This is a perfect example of how cybercrimes can affect our material world.
An actual event inspired these malware attacks in "Blackhat." As Michael Mann told NRP, "Stuxnet [the sophisticated cyberattack on Iranian nuclear facilities in 2010] happened and I was very interested in that because it was more than a hack. It's not kind of impersonal, undramatic ones and zeroes just kind of doing things." During his interview with NPR, Mann also talked about how the Sony hack that happened weeks before "Blackhat" hit theaters hit home because "some of these people are my friends that got attacked, so that became very personal." This is where "Blackhat" excels: It makes our nebulous ideas about cybercrime concrete by depicting how it affects people, and it isn't so technical that the computer jargon confuses the average viewer.
Hathaway physically accesses the hacker's proxy server
Hathaway creates a diversion by ramming a moving van off the roof of the parking garage next door to Intrarmour's server location. The van crashes through the roof of Intrarmour's facility, setting off alarms and requiring an emergency response team. During the chaos of the emergency response, Hathaway infiltrates the facility and gains access to the hacker's server, downloading his files to an external hard drive.
He then uses the files to understand the code the hacker is writing for his next attack, learning that he will target multiple pumps to flood five tin mines and their surrounding areas. While Hathaway is checking out the code, Lien tracks the money the black hat earned from his soy price manipulation in Chicago to a local bank. Now that they know where the hacker's money is, and they know what he's planning, it's time to attack.
"Blackhat" shows that individuals aren't the only ones who are vulnerable to cybercrimes like identity theft, as infrastructure and industrial sectors are also vulnerable to cyberattacks. Tracy Lien of The Los Angeles Times wrote about how despite these attacks in the film seeming fantastical, they're already happening in the real world. Besides the Stuxnet attack on an Iranian reactor, in 2014 someone attacked a steel mill in Germany, causing significant damage to the facility.
Lien gets Hathaway access to the hacker's money
Lien gets Hathaway past the firewall at the local bank by charming a man at the front desk, asking him to print out new copies of paperwork she intentionally spilled coffee on from her flash drive. The flash drive gives Hathaway access to steal the $74 million the hacker earned from his soy manipulations. Much like Hathaway's phishing email to an NSA employee earlier in the film, this hack relies on human error to give Hathaway access to the system.
"The hacks in the movie relied on humans being the weak link," cybersecurity expert Kevin Mahaffey told The Los Angeles Times. "Hackers find a weakness in a system but ultimately use a human to exploit that weakness." The cybersecurity at the bank is stringent enough that Hathaway can't hack into the system remotely, but Lien gets an unsuspecting employee, who probably doesn't understand why he isn't supposed to print out paperwork for visitors, to plug Hathaway into the system.
This scene shows why it's necessary to physically break into the Intrarmour facility. While both the bank and Intrarmour have impenetrable security measures in place, people who work for a proxy server site like Intrarmour are highly aware of how hackers try to access their system. A bank, however, has a variety of employees, some of which won't be as tech-savvy as others, leaving them more vulnerable to a security breach like the one carried out in "Blackhat."
After stealing the money, Hathaway contacts the hacker
After electronically transferring the hacker's $74 million to a Swiss bank account, Hathaway contacts them on their server, typing, "You don't know me. But I know you. You're having a bad day," and leaves a phone number for the hacker to call. After speaking briefly with Elias Kassar, Hathaway insists upon speaking directly to the hacker, and we finally see our villain an hour and 49 minutes into "Blackhat." While talking to the black hat, Sadak (Yorick van Wageningen), Hathaway tricks him into an in-person meeting under the pretense of wanting 20% of the Malaysian tin ore hit. In reality, this is a ruse to get close enough to Sadak to exact revenge.
Sadak says something revealing during this conversation: "I can put together another bankroll, pick another target, and if I stop thinking about you, if I stop thinking about anything, it disappears, it vanishes. It ceases to exist." This attitude is how many people think about the virtual world. It isn't real. "Blackhat," argues that the virtual world and the physical world are so intertwined they are inseparable. Michael Mann told The New York Times, "It's almost like there's an invisible kind of exoskeleton above the layer in which we think our lives take place on planet Earth, that's made up of interconnectedness and data. We're swimming around in it, and everything is totally porous, vulnerable, and accessible."
Lien and Hathaway prepare for the confrontation
Lien buys medical supplies from a local pharmacy while Hathaway sharpens screwdrivers into crude but deadly weapons. He protects his core with makeshift armor constructed from magazines and duct tape to protect his internal organs during hand-to-hand combat. Preparing for the confrontation, it's clear that Hathaway knows he's putting his life on the line to avenge the deaths of Dawai, Barrett, and Jessup.
As Lien watches him prepare with glossy eyes and a grim expression, it's obvious she also knows the risks involved. By the end of the day, they will have enacted their revenge against Sadak and Kassar, or she will have lost Hathaway too — maybe both. Despite being a techno-crime thriller, "Blackhat" is about how these criminals and those who pursue them exist in the material world.
This movie isn't a chess match between two super-hackers played out in the digital realm. It's a blood-and-bones confrontation between two men — one who only cares about money, and another who's recently discovered he cares more about some people than money, freedom, or even his own life.
Hathaway lures Sadak to a crowded location
Lien provides surveillance of the rendezvous point, telling Hathaway that Sadak has many armed guards waiting two floors below and two additional armed guards on the same level as him and Kassar. Hathaway calls Sadak and chides him for arriving with protection when it was only supposed to be him and Kassar at the rendezvous point. He then forces the upper hand by moving the location to a crowded square where a parade will take place in two hours' time. Sadak complains about how crowded it will be, asking how he will find Hathaway, who in turn replies, "I'll find you."
What's so interesting about their final confrontation is that after the relative silence of the scenes in the third act, emphasizing Hathaway and Lien's isolation in Jakarta, this climax takes place in a crowd, with a cacophony of sounds and lights surrounding Hathaway as he stalks his prey. In the end, he's unafraid of surveillance or the intervention of law enforcement.
Hathaway kills Sadak and Kassar
Hathaway searches through the gathered crowd for Sadak. He takes out Kassar first with a sharpened screwdriver to the head before stealing his handgun. He then continues through the crowd, with Sadak in his sights. Film critic Matt Zoller Seitz of RogerEbert.com called the film "a high-tech action thriller about the human condition." This sentiment is confirmed when Hathaway tells Sadak, "It's not about money. It's not about zeros or ones, or code."
Gunfire erupts, scattering the crowd, and Hathaway is shot in his side before taking out the two gunmen protecting Sadak. The hacker pulls a knife, coming after Hathaway himself, and tries to stab him in the neck, which is protected by a towel. Hathaway defends himself by stabbing Sadak repeatedly in the torso with the knife he'd hidden in his waistband. Hathaway then leaves Sadak to bleed out on the concrete. He stumbles through the crowd toward Lien, who's running toward him.
Some critics of "Blackhat" found the idea of a super-hacker as physically dominant as Chris Hemsworth absolutely absurd. But, former black hat hacker Kevin Poulsen, who did five years in prison for phone hacking, told Vice, "There are definitely hackers who become very buff, tough actors as a result of doing time. Max Vision [the real-life hacker Hathaway is based on] is a bodybuilder."
Hathaway and Lien escape with millions of dollars
After killing the people responsible for the deaths of their friends and family, Lien treats Hathaway's gunshot wound in their car with items she bought at a pharmacy. Before the two fly out of Indonesia the next morning, Hathaway uses an ATM, confirming they have the millions of dollars they stole from Sadak to start their new life together. Of course, it's a hollow victory.
The irony of "Blackhat" is that it's the criminal who doles out vigilante justice when government agencies are hobbled by protocol and laws and are ill-equipped to deal with the threat Sadak poses. The question of whether global authorities are prepared to deal with the threat black hat hackers pose wasn't lost on viewers at the time, and it's only become more prescient in the years since as cybercrime, viruses, and scams have become more prominent. In a press conference to promote the film, Michael Mann said, "We're vulnerable to intrusions from everywhere, and we just don't know it. It's like we're in a house without doors and windows in a dangerous neighborhood and we don't know it" (via Collider).