After a yearlong sojourn to Grenada, Lisbeth Salander uses three million laundered kronor to purchase a new apartment in Stockholm. She re-establishes contact with Dragan Armansky, her former boss at Milton Securities, and her former legal guardian Holger Palmgren. Nils Bjurman, who had previously raped Salander, focuses his attention on capturing her and destroying the film she made of his crime. Reviewing her medical records, he identifies a person from her past as his strongest ally. Mikael Blomkvist, the publisher of Millennium magazine, who had lost contact with Salander since her absence, sees her being attacked by a member of the Svavelsjö outlaw motorcycle club. He attempts to help, to Salander's astonishment, and their joint efforts enable her to elude her attacker.
Millennium is approached by Dag Svensson and Mia Johansson, who have put together a report concerning sex trafficking in Sweden and the abuse of underage girls by high-ranking figures. Everyone is intrigued by recurring mentions of "Zala", a mysterious figure heavily involved in the sex-trafficking industry. Salander, hacking Blomkvist's computer, is taken aback by the mention of Zala, and visits Svensson and Johansson to ask questions. Later that same night, Blomkvist finds the couple shot dead in their apartment. With Salander's fingerprints on the murder weapon, and her formal record establishing a history of violent instability, she is implicated in the double murder. Bjurman is also found dead, shot by the same weapon; Salander is the prime suspect.
Eager to clear Salander's name and realizing that she has hacked into his notebook computer, Blomkvist leaves her notes on his desktop; her replies point him to "Zala". Blomkvist confronts Gunnar Björck, a policeman on sick leave and one of the high-ranking abusers identified by Svensson and Johansson, who agrees to disclose information about Zala if Blomkvist leaves him out of Millennium's exposé. Miriam Wu, Salander's current sex partner, is taken in for questioning by the police. After her release, Paolo Roberto, Salander's former boxing coach, witnesses her being kidnapped into a van by Salander's earlier attacker, aided by a "blond giant". He follows them to a warehouse south of Nykvarn, where he attempts to fight the giant and manages to escape with Wu. The giant recovers and sets the warehouse on fire to destroy the evidence.
Visiting Bjurman's summer cabin, Salander finds a classified Säpo file and begins to make the connection between Bjurman and Zala, whose real name is Alexander Zalachenko. By coincidence, two members of the motorcycle club, Carl-Magnus Lundin (Salander's attacker) and Sonny Nieminen, have been dispatched to burn the place down. Salander incapacitates them, leaving suspects for the police to find. She returns to her apartment and, having no choice, decides to find and kill Zalachenko. She discovers the identity of the giant, Ronald Niedermann, and traces him to a post office box in Göteborg. Meanwhile, Blomkvist manages to find Salander's new apartment as well as the DVD revealing Bjurman's crime.
With information from Björck and Palmgren, Blomkvist pieces together the entire story: Zalachenko is a former Soviet defector whose very existence is kept classified by Säpo. Initially an intelligence source, Zalachenko began to traffic in sex slaves on the side. He became the partner of a 17-year-old girl who became pregnant with twins, Lisbeth and Camilla. Zalachenko was an itinerant father who habitually abused his partner, culminated in Lisbeth's deliberately setting his car alight while her father was in it. The authorities imprisoned Salander and declared her insane, since acknowledging Zalachenko's crimes would require them to divulge his existence. Niedermann had killed Svensson and Johansson on Zalachenko's orders; Bjurman, who was involved with Zalachenko, played a role in the murders and was killed to ensure his silence.
Between Blomkvist's testimony, Salander's various character witnesses, and the additional suspects piling up, the police are forced to admit that their original suspicions were wrong. Blomkvist finds Niedermann's Göteborg address and sets off for the farm where he and Zalachenko await. There, Salander is captured and brought before Zalachenko. She is shot when she attempts to escape and is buried by Neidermann, not realising she is still alive. Battling through immense pain, Salander slowly digs herself out and attempts to kill Zalachenko with an axe. On his way to Göteborg, Blomkvist captures Niedermann and ties him against a signpost by the road. The book ends as Blomkvist finds Salander and calls emergency services.
