The Bic Pen That Humiliated Kryptonite

So picture it. It's 2004. You paid good money for a Kryptonite U-lock, the gold standard, the one with the reputation, the one that comes with a theft guarantee. Your bike is locked to a rack outside, and you feel fine about it. And then a video starts going around the internet showing somebody opening that exact lock with the barrel of a Bic pen. Not picking it. Not cutting it. Jamming a twenty-cent pen into the keyhole, giving it a wiggle, and popping it open in seconds.

That actually happened, and it's one of the great security stories of the last twenty years. So let's get into what really went down, why the lock gave up so easily, and the lesson that outlasted the whole embarrassing mess. Because the "how" here is genuinely worth understanding.

What actually happened

In September 2004, a user on a bike forum posted that they could open their Kryptonite Evolution 2000 lock with a Bic pen. Then came the videos, and that's what turned it into a wildfire. The clips showed the trick working in seconds, and they got passed around to hundreds of thousands of people almost overnight. Within days it jumped from bike forums to the tech press to the mainstream news. By the end of the year, one business magazine named Kryptonite's handling of it the single dumbest business moment of 2004.

Those old clips are still floating around, and honestly they're worth watching, because reading "he opened it with a pen" does not hit the same as watching it happen. Here are a few of them:

Watch how little technique is involved. No feeling for pins, no tensioning, no patience. Push, twist, open. That is the entire attack, and that is why it spread the way it did.

And here's a detail I love, because it's such a good reminder that nothing is ever really new: this trick wasn't even a fresh discovery. It had reportedly been floating around UK cycling circles since the early 1990s. It just took a video and the right moment to explode. Sometimes the secret was never really a secret. It was just quiet.

Why a pen could beat a premium lock

Okay, so this is the part that matters, and it comes down to one design choice: the shape of the keyway.

The affected Kryptonite locks used a tubular cylinder. Instead of a flat key going into a flat slot, a tubular lock has a round keyway with the pins arranged in a ring around the outside of a little circle, and the key is a round tube with notches cut around its rim. It looks high-tech. It looks tough. That circular design is exactly what makes people trust it.

The problem is the barrel of a Bic pen happens to be almost the same diameter as that round keyway. So you jam the pen in, and because the plastic is stiff but not too stiff, when you push and twist it deforms just enough to shove that whole ring of pins up toward the shear line all at once. It's not a precise key. It doesn't have to be. It's a crude bypass that gets close enough, and close enough is all a sloppy tubular lock needs. No skill, no practice, no tools. Just a pen and about five seconds.

If you want the deeper version of how these round locks work and how they're properly picked, I got into it over in how to pick a tubular lock. The short version: that circular layout that looks so secure is often the weakness, not the strength.

What it cost Kryptonite

To their credit, once it blew up, Kryptonite did the right thing. They ran a free lock-exchange program, swapping the vulnerable tubular locks for a new design built around a disc-detainer cylinder that a pen can't fool. They ate the shipping and replaced locks by the hundreds of thousands. Reports on the exact numbers vary, but by every account it cost the company many millions of dollars and a serious dent in a reputation they'd spent decades building.

Here's the quietly ironic part. The pen-proof design they scrambled to roll out? They were already using it on their top-tier line. The better cylinder existed the whole time. The lesson they learned the expensive way was to put it everywhere, not just on the flagship.

The lesson that outlived the mess

Now, it would be easy to make this a story about one company having a bad month. But the real takeaway is bigger than Kryptonite, and it's the same thread that runs through all of this.

A lock's reputation is not the same thing as a lock's security. Kryptonite wasn't lying to anybody. They genuinely believed the tubular cylinder was solid, the whole industry used it, and it had been standard for thirty years. But "everybody uses it" and "it's been fine so far" are not the same as "it holds up when somebody actually tests it." A twenty-cent pen was the test, and the answer was no.

So the useful habit this leaves you with is simple: don't trust a lock because of its badge, its price, or its reputation. Trust it because you understand how it works and where it's weak. The people who tend to be safe aren't the ones with the most expensive locks. They're the ones who actually know what their locks can and can't do.

Where this fits

Tubular locks are still everywhere: bike locks, vending machines, gun cases, that little round lock on all sorts of gear. Most of them are more secure than that 2004 Kryptonite was, but the round keyway that makes them look tough is worth understanding rather than trusting on faith. If you want to actually learn how they open, a tubular lock pick and a lock you own will teach you more in an afternoon than any spec sheet.

And if you came here from the bump key side of things, here's a neat contrast: a bump key beats a standard flat-key pin tumbler by exploiting a straight row of pins. That same trick does nothing to a tubular lock, because the pins are in a ring. Different lock, different weakness. Every lock has one. The whole game is knowing which is which.

Anyways, that's the pen that humbled a giant. A twenty-cent piece of plastic, a lock everybody trusted, and a lesson that's still true: understand your locks, don't just believe in them. As always, I appreciate you.