The novel is formally divided into a prologue followed by four parts. The prologue of the book opens with a girl captured and restrained inside a dark room by an unidentified male. To cope with being captured, she mentally replays a past episode when she threw a milk carton filled with gasoline onto another man inside a car and tossed an ignited match onto him.
Part 1 – Irregular Equations
After finishing the job on the Wennerström affair (described in The Girl with the Dragon Tattoo), Lisbeth Salander disappeared from Sweden and traveled throughout Europe. The novel opens with her on the shores of the Caribbean in St George's, the capital of Grenada. Salander has become interested in Fermat's Last Theorem and mathematics, an interest that resounds with the opening page of each Part in this novel. From within her room in her hotel she observes on several occasions that her neighbor, Dr Forbes, an American tourist from Texas, physically abuses his wife, in the next room to Salander. She also befriends George Bland, a sixteen-year-old orphaned student living in a small shack, and begins tutoring him in mathematics. Salander finds Bland's company relaxing and enjoyable because Bland does not ask her personal questions, and the two develop a sexual relationship.
Salander uses her connections among the hackers' network to investigate Dr Forbes and learns that he was once accused of mishandling funds in his faith-based foundation. Currently he has no assets, but his wife is the heir to a fortune worth $40 million. Concerns for the safety of the residents at the hotel cause the hotel management to begin ushering them into a cellar as a hurricane hits Grenada. Salander remembers Bland and braves the strong wind and rain to collect him. As the two reach the hotel entrance, Salander sees Dr Forbes on the beach with his wife and realizes that he is attempting to kill her for her inheritance. Salander attacks Forbes with the leg of a chair, and abandons him to the elements. Salander, Bland and Mrs Forbes retreat to the cellar and receive medical care; Dr Forbes is later confirmed as the only fatality of the storm.
Part 2 – From Russia with Love
Lisbeth Salander returns to Stockholm after more than a year away. Immediately before the Wennerström affair became public knowledge, Salander laundered a sum of three billion kronor (the equivalent of about half a billion $US) into a disguised bank account. With this sum she purchases a new up-scale apartment outside Mosebacke Torg and moves out of her old apartment in Lundagatan (SV). Salander allows her current sex partner, Miriam Wu, to move into her old apartment, for the price of 1 krona and the condition that Wu forward all of Salander's mail. She also re-establishes contact with Dragan Armansky, her former boss at Milton Securities, and former legal guardian Holger Palmgren, who fell victim to a stroke at the beginning of Dragon Tattoo.
Nils Bjurman, Palmgren's replacement, continues to nurture a growing hatred for his ward after the events of Dragon Tattoo. His fury has caused him to diminish his practice down to a single client (Salander) and focus his attention on capturing her and destroying the film she made of him raping her. He scrutinizes Salander's medical records, and identifies an incident named "All the Evil" as well as a person from her past as his strongest ally.
In the meantime, Mikael Blomkvist, the publisher of Millennium magazine, has lost contact with Salander, who has refused even to open his letters. He is therefore surprised, shortly after her return, while he is walking past her apartment in the vain hope of running into her, to see her being attacked by a ponytailed man with a beer gut, a member of the Svavelsjö outlaw motorcycle club. Blomkvist attempts to help, to Salander's astonishment, and their joint efforts enable her to elude her attacker.
Millennium is approached by Dag Svensson, a young journalist, and his girlfriend Mia Johansson. They have put together a meticulously-researched report, ironically titled "From Russia with Love", about sex trafficking in Sweden and the abuse of underage girls by high-ranking figures; this is the subject of Bergman's doctoral thesis and Svensson wants Millennium to publish his exposé in book form. Whilst the research is mostly complete, Svensson, Johansson and the Millennium staff are intrigued by recurring mentions of "Zala," a shadowy figure heavily involved in Sweden's sex-trafficking industry. Salander, hacking Mikael Blomkvist's computer, is taken aback by the mention of Zala and visits Svensson and Johansson to ask questions.
Part 3 – Absurd Equations
Later the same night, Blomkvist calls on the couple, to find them both shot dead in their apartment, the killer having apparently left the building only seconds before. Blomkvist notifies Erika Berger, the editor in chief of Millennium and his lover, of the double murder, and the magazine's management team holds an emergency meeting at which they decide to postpone the publication of Svensson's book and the associated magazine special. They decide to backtrack Svensson's research to ensure the accuracy of the material, and to comb through it for possible murder motives, while Blomkvist is tasked with finishing Svensson's mostly-completed book.
Prosecutor Richard Ekström assembles an investigation team, led by Inspector Jan Bublanski, who selects Sonja Modig for inclusion in the team because of her sensitivity to women's issues. The team identifies Salander's fingerprints on the murder weapon, and her formal record establishes her as a violent, unstable, psychotic young woman with a history of prostitution. Armansky, Blomkvist and Berger all vouch for her intelligence and moral fiber; neither Mikael nor Erika were even aware of her psychiatric history. While investigating Salander's social circle, Modig finds Bjurman shot dead in his apartment with his own revolver, the same weapon used on Svensson and Bergman; Salander remains the prime suspect. In the light of this new evidence, Ekström holds a press conference and discloses Salander's name and psychiatric history to the press, describing her as a danger to others and herself.
Blomkvist enlists the help of managing editor Malin Eriksson to investigate the murders, during which he realizes that Salander has hacked into his notebook computer. He leaves her notes on his desktop, and her replies point him to "Zala". He confronts Gunnar Björck, a policeman on sick leave and one of the high-ranking abusers identified by Dag and Mia, who agrees to disclose information about Zala if Blomkvist leaves him out of Millennium's exposé.
Armansky realises that Milton Security should become involved in the investigation and sends two of his employees, Hedström and Bohman, to aid the formal police investigation. Miriam Wu returns from a Paris trip to find herself taken to the police station and confirms Salander's intelligence and moral character. However, Hedström, who carries an old grudge against Salander, leaks Wu's identity to the press, who publish stories about Wu's involvement in a Gay Pride Festival and Salander's prior friendship with a female rock group; both she and Salander are sensationalized in the media as members of a "lesbian Satanist gang". The press also publishes information about Salander's past.
Part 4 – Terminator Mode
Part 4 begins with Salander wondering why the press's inside source has chosen not to publicize "All the Evil," the events which dominated the gap in her biography, information she knows would swing public opinion even further against her. Blomkvist is approached by Paolo Roberto, a boxing champion and Salander's former coach. Blomkvist asks Roberto to help by finding Miriam Wu, who, released by the police, has been avoiding all press contact, including Mikael. In the meantime, at Salander's suggestion, Blomkvist focuses onto Zala as the key connection between the three murders and sex trafficking. As the police continue the investigation, Blomkvist's team also notices the three-year gap in Salander's biography. Blomkvist decides to confront Björck and trade his anonymity for information on Zala.
Roberto, staking out Salander's former apartment in the hopes of catching Wu, witnesses her being kidnapped into a van by a paunchy man with a ponytail (Salander's former attacker) and a "blond giant". He follows the van to a warehouse south of Nykvarn, where he attempts to rescue Wu by boxing with the giant. He finds his opponent unusually muscular and totally insensitive to pain, and only through applications of massive blunt trauma can he and Wu stun the giant enough to escape. The giant recovers and sets the warehouse on fire to destroy the evidence. However, Roberto is able to direct the police to the site, where they find three buried and dismembered bodies.
Visiting Bjurman's summer cabin, Salander finds a classified Swedish Security Service file written about "All The Evil", and begins to make the connection between Bjurman and Zala, whose real name is Alexander Zalachenko. By coincidence, two members of Svavelsjö MC, Carl-Magnus Lundin (the paunchy ponytail man) and Sonny Nieminen, have been dispatched to burn the place down; Salander physically incapacitates them, leaving more suspects for Bublanski to find. She returns to her apartment and, having no choice, decides to find Zalachenko and kill him. Salander discovers the blond giant's identity ("Ronald Niedermann") and his connection to a post office box in Göteborg and goes there to find him and Zalachenko.
In his apartment, Blomkvist finds Salander's keys, which he had picked up after her escape from Lundin. He manages to find her new, up-scale apartment as well as the DVD revealing Bjurman's crime. With information from Björck and Salander's former guardian, Holger Palmgren, Blomkvist is able to piece together the entire story: Zalachenko is a former Soviet defector under secret Swedish protection, whose very existence is kept classified by Säpo; Bjurman and Björck knew about him only because they happened to be the junior officers on duty the day he went into a police station and demanded political asylum. Zalachenko, initially a source of vital information on the USSR's intelligence operations to Säpo, began to traffic in sex slaves on the side. He became the partner of a 17-year-old woman who became pregnant with twins, Lisbeth and Camilla. Zalachenko was an itinerant father who physically and emotionally abused his partner when he was home. The cycle of violence culminated in Lisbeth Salander deliberately setting his car alight with gasoline while her father was in it. This is the event Salander refers to as "All the Evil", since the authorities, instead of listening to her pleas on behalf of her mother, imprisoned her and declared her insane. Salander's mother was left with the first of a series of brain aneurysms which consigned her to nursing homes and ultimately caused her death. Salander realised that the government would never acknowledge Zalachenko's crimes, which would require them to admit his existence. Zalachenko was allowed to walk away, but suffered serious injuries and had to have his foot amputated. Svensson and Johansson were killed by Niedermann on Zalachenko's orders: when Salander visited them, she asked whether Bjurman had ever showed up on their list of high-ranking abusers, and they called him immediately after she left; Bjurman then called Zalachenko in a panic, leading not only to their deaths but to his own.
Blomkvist does not share all of his findings with Bublanski, out of respect for Salander's privacy, but between his testimony, the various character witnesses, and the additional accomplices piling up, the police are forced to admit that their original suspicions of Salander as a psychotic murderer may have been wrong. Milton Security are ejected from the investigation when it becomes clear that Hedström is the inside source who has been leaking sensational details to the press; Armansky is satisfied, as his true goal in aiding the investigation—ensuring Salander is not simply condemned as a murderer out of hand—has been achieved. Finally, Blomkvist finds Niedermann's Göteborg address, and sets off for the farm where Niedermann and Zalachenko await. He has deduced that Salander has entered what Roberto and his boxing friends called "Terminator Mode", where she attacks without restraint to defend her life and those she cares about.
Salander enters the farmhouse and is captured as a result of secret cameras and alarms Zalachenko had installed. He tells Salander that Niedermann is her half-brother. When Salander attempts to escape, Zalachenko shoots her in the hip, shoulder and head, and Niedermann buries her, not realising that she is still alive. Salander digs herself out and again attempts to kill Zalachenko with an axe, noting that Zalachenko's use of a Browning .22 firearm is the only reason she survived. On his way to Göteborg, Blomkvist sees Niedermann trying to hitch a ride, and captures him at gunpoint, tying him against a signpost by the road. The book ends as Blomkvist finds Salander and calls emergency services.