In December 2002, Mikael Blomkvist, publisher of Millennium, the Swedish political magazine, loses a libel case involving allegations about billionaire industrialist Hans-Erik Wennerström. He is sentenced to three months (deferred) in prison, and ordered to pay hefty damages and costs. Soon afterwards, he is invited to meet Henrik Vanger, the retired CEO of the Vanger Corporation, unaware that Vanger has checked into his personal and professional history; the investigation of Blomkvist's circumstances has been carried out by Lisbeth Salander, a brilliant but deeply troubled researcher and computer hacker.
Vanger promises Blomkvist evidence against Wennerström in return for discovering what happened to his grandniece, Harriet, who disappeared in 1966; Vanger believes that she was murdered by a member of the family. Harriet disappeared during a family gathering at the Vanger estate on Hedeby Island, when the island was temporarily cut off from the mainland by a traffic accident on the bridge. Blomkvist moves to the island and begins his research into the history of the Vanger family and Harriet's disappearance. As he does so, he meets most of the remaining Vanger clan, including Martin, current CEO of the company; Isabella, Martin's mother; and Cecilia, a headmistress who was Harriet's friend, though her sister Anita was closer both in age and friendship to the missing girl.
Salander was ruled legally incompetent as a child, and is under the care of a legal guardian, Holger Palmgren. When Palmgren suffers a stroke, he is replaced by Nils Bjurman, who uses his position to extort sexual favors from her, and eventually rape her. After using a hidden camera to record her assault, Salander takes her revenge, torturing him and threatening to ruin him unless he gives her full control of her life and finances. She then uses a tattoo machine to brand him as a rapist.
Despite all expectation to the contrary, Blomkvist identifies new evidence in the case. One piece is a pair of photographs, detailing Harriet's sudden discomfort at the sight of a young man in a prep-school blazer. Another lies in Harriet's journal, which contains a set of five names and five-digit numbers believed to be old telephone numbers; Blomkvist's daughter Pernilla, passing through on the way to Bible camp, identifies them as passages from the Book of Leviticus. They describe rules about the treatment and punishment of women, and Blomkvist correlates one of them with the grotesque murder of a Vanger Corporation secretary in 1949. Blomkvist realizes that he may be on the trail of a serial killer, and the scope of the resulting research makes Blomkvist request a research assistant. Vanger's lawyer suggests Salander. When he sees the report she prepared for Vanger, Blomkvist realises that Salander has hacked into his computer. He confronts her and asks her to help him with the investigation, to which she agrees. The two eventually become lovers, but Salander continues to keep Blomkvist at an emotional distance. Their suspicions are heightened when a local cat is left dismembered on Blomkvist's porch and Blomkvist is fired upon from a distance during an afternoon jog.
Blomkvist and Salander uncover the remaining four murders described in Harriet's journal, as well as several more that fit the profile: women who are sexually assaulted and then slain in accordance with (or an exaggerated parody of) a Leviticus verse. Most of the murders also took place in locations where the Vanger Corporation did business. They settle on Gottfried Vanger, father of Martin and Harriet, as a likely candidate, but are stymied when he is discovered to have predeceased his last victim. While Salander continues to hunt through Vanger Corporation archives, Blomkvist manages to identify the antagonist who frightened Harriet so: her brother Martin. Martin takes him prisoner, and reveals that Gottfried "initiated" him into the ritual rape and murder of women before his own death, and implies that Gottfried sexually abused both him and Harriet. Martin admits to murdering dozens of women, but denies killing his sister. He decides to rid himself of Blomkvist once and for all, but Salander--who had discovered the connections independently--arrives to save the day. Martin flees by car, pursued by Salander on her motorbike, and chooses his own fate by colliding headlong with an oncoming semi-truck.
By following a trail that leads to Cecilia's sister Anita, who now lives in London, Blomkvist and Salander learn that Harriet is still alive and is living under Anita's name in Australia. When Blomkvist flies there to meet her, Harriet tells him the truth about her disappearance: her father and brother had repeatedly raped her until she killed her father in self-defense. Martin was sent away to preparatory school, but when he returned the day of her disappearance, Harriet realized that she needed to escape; she found a place to hide during the tumult of the traffic accident, and Anita smuggled her to the mainland the next morning. Blomkvist persuades her to return to Sweden, where she reunites with Henrik. Blomkvist then accompanies Salander to her mother's funeral.
Blomkvist learns that the evidence against Wennerström that Vanger promised him is useless, long past its statute of limitations. However, Salander has already hacked Wennerström's computer and discovered that his crimes go far beyond what Blomkvist documented. Using her evidence, Blomkvist prints an exposé and book which ruins Wennerström and catapults Millennium to national prominence. Salander, using her hacking skills, succeeds in stealing some 2.6 billion kr (about $260 million USD) from Wennerström's secret bank account. Blomkvist and Salander spend Christmas together in his holiday retreat. A couple of days later, she goes to Blomkvist's home, intending to declare her love for him, but backs away when she sees him with his long-time lover and business partner Erika Berger.
As a postscript, Salander continues to monitor Wennerström and after six months, anonymously informs a lawyer in Miami of his whereabouts. He is found in Marbella, Spain, dead, shot three times in the head.