- ENTITY
- DEF CON — Las Vegas hacker convention, founded 1993 by Jeff Moss ("The Dark Tangent") when he was 18 FACT
- ETHOS
- Cash at the door, no pre-registration, no attendee database, "Spot the Fed" — a deliberately anonymous, anti-commercial hacker gathering FACT
- THE DRAMA
- Price from ~$30 (1993) to ~$580 (2025); attendance from a few hundred to tens of thousands; a con-culture argument about whether it got captured or just grew up
- SELF-POLICING
- A 2015 code of conduct and public transparency reports; a ban list running from the 2017 wave (Appelbaum, Draper, Marquis-Boire) through Chris Hadnagy (2022) to the 2026 Epstein cluster (Joi Ito, Iozzo, Holman)
- RECORD
- No wrongdoing by DEF CON is asserted here. The commercialization is documented in its own numbers; the "capture" reading is our analysis, and the con's defense runs at full strength FACT
- STATUS
- RUNNING — still independently owned, still cash at the door, still the biggest room in the field
DEF CON▊
The hacker con that started in 1993 as a $30, cash-at-the-door, no-names-please party in a Vegas casino — and grew into a ~$580, thirty-thousand-person institution with a code of conduct, transparency reports, and a ban list. The anti-establishment con that became an establishment. Both readings are on the record; the price chart is DEF CON's own.
Cash at the door works every time.
DEF CON, on why it still takes no credit cards and keeps no attendee registration for badges — defcon.org FAQ
one of the oldest continuously running hacker conventions around, and also one of the largest
DEF CON's description of itself — defcon.org
Every subculture that survives long enough faces the same bill: the thing that made it special was that it was small, cheap, and hostile to outsiders — and the reward for being good at that is to become large, expensive, and full of outsiders. DEF CON is the cleanest example in this field.
This file is not an accusation. It is a chart with a caption, a founding ethos quoted from the con's own FAQ, and a list of the moments the con chose to act like an institution. Whether that is capture or maturity is the reader's call. Both cases are argued below at full strength.
the drama timeline
ACT I — THE $30 PARTY (1993)
A teenager throws a going-away party for a friend's BBS network, invites the hacker scene, and accidentally founds an institution.
-
1993
Founded
Jeff Moss — "The Dark Tangent," then 18 — launches DEF CON 1 in Las Vegas. Cash at the door, roughly $30, a few hundred people, no registration and no names collected. The ethos is the product: anonymity, cash, and open hostility to being turned into a business.
The founding constraint — cash only, no database — is the same one the con still markets thirty years later. Keep that in mind when the price curve bends.
ACT II — THE PRICE CURVE (1993–2025)
The chart above is the whole act. A $30 party becomes a $100 conference becomes a $300 event becomes a ~$580 institution — while insisting, correctly, that you can still pay cash at the door and give no name.
-
1993–2025
$30 → ~$580
Badge price climbs steadily across three decades: about $100 by ~2007, $200 by ~2012, $300 by DEF CON 30 (2021–22), and into the $540–$580 range by 2025 — the last figures straight out of DEF CON's own FAQ. Attendance over the same span grows from hundreds to tens of thousands, with dozens of villages and contests. The con notes, fairly, that Las Vegas venue costs and scale drive the number.
ACT III — THE FEDS, THE FUGITIVES & THE REPORTER (2001–2017)
The con the government now sponsors spent two decades as the place the government showed up to make arrests — and the place that once chased a network-news producer through a parking lot.
-
2001
Sklyarov — arrested for a slide deck
Russian programmer Dmitry Sklyarov presents "eBook Security — Theory and Practice" at DEF CON 9, showing Adobe's eBook encryption was trivially broken. As he prepares to fly home, the FBI arrests him under the DMCA. Charges are later dropped; a jury acquits his employer ElcomSoft on all counts in 2002. Bruce Schneier's verdict at the time: "Arrest of Computer Researcher Is Arrest of First Amendment Rights."
-
2007
Spot the Undercover Reporter
Dateline NBC associate producer Michelle Madigan enters DEF CON with a hidden camera, aiming to film attendees confessing to crimes and to out an undercover fed for a segment. Tipped off in advance, staff flip "Spot the Fed" into "Spot the Undercover Reporter," Jeff Moss names her from the stage, and she bolts from the Riviera with a crowd of roughly 150 in pursuit. There is, of course, video.
DEF CON 15, 2007: named from the stage, Madigan bolts the Riviera with the crowd behind her. There is, as promised, video. -
2008
The MBTA gag order
Three MIT students prepare "Anatomy of a Subway Hack" for DEF CON 16. Days before, the Massachusetts Bay Transportation Authority wins a federal restraining order barring the talk — prior restraint on security research. The EFF defends the students; a judge lifts the gag ten days later. The slides were already on the conference CD.
-
2012–2013
"Feds, we need some time apart"
At DEF CON 20 (2012), NSA director Gen. Keith Alexander keynotes and denies the agency keeps files on Americans. A year later, after the Snowden disclosures, Moss posts "Feds, we need some time apart" and asks federal law-enforcement and intelligence personnel to sit out DEF CON 21 — the first such request in the con's history.
-
2017
The WannaCry hero, cuffed at the airport
Marcus Hutchins — who months earlier stopped the WannaCry pandemic with a kill-switch domain — is arrested by the FBI at the Las Vegas airport as he leaves DEF CON 25, indicted over the Kronos banking trojan he wrote as a teenager. He pleads guilty to two counts in 2019 and is sentenced to time served, the judge citing his "subsequent course of conduct."
ACT IV — THE MACHINES DON'T WORK (2017–2023)
The con's other export: live proof that the infrastructure everyone trusts — voting machines, then the AI everyone was suddenly buying — falls over the moment someone is finally allowed to touch it.
-
2017–2019
The Voting Village
DEF CON 25 opens the Voting Village with real, decommissioned U.S. voting machines. Every unit is breached; one is popped remotely over Wi-Fi in minutes using a 2003 bug and stock Metasploit. In 2018 an 11-year-old alters a mock Florida results site in under ten minutes. Manufacturers call the conditions "unrealistic" — about the machines that ran actual elections. The Village keeps publishing its reports with the University of Chicago.
-
2023
The feds come back — to help
DEF CON 31 hosts a public red-team of generative-AI models with White House backing, and administration officials attend openly. "Spot the Fed" is now trivially easy: the feds are on the program. The arc from 2013 completes — the con that told the government to stay home now co-hosts it.
ACT V — THE INSTITUTION ACTS LIKE ONE (2015–2026)
A con that ran for two decades on "don't be a jerk" writes a code of conduct, starts publishing transparency reports, and begins naming and banning its own — including some of the scene's boldface names.
-
2015–2017
A code, and the first names
DEF CON adopts a formal code of conduct (2015) and publishes its first transparency report (from DC25, 2017). The first ban list names three 2017 entries "based on multiple public reports": Tor developer Jacob Appelbaum (who denies the allegations), phone-phreaking pioneer John Draper ("Captain Crunch"), and researcher Morgan Marquis-Boire, whose ten corroborated sexual-assault allegations The Verge reported that November.
-
2022
The Hadnagy ban
DEF CON bans social-engineering figure Chris Hadnagy via its transparency report, citing code-of-conduct violations. The full record — and Hadnagy's response — is on his own file.
-
2025
An enabler, and an arrest
Two 2025 bans. Eric Michaud — "based on reporting of the Washington Post, including enabling Morgan Marquis-Boire" (DEF CON's word, not ours; he is charged with nothing). And Tom Alexandrovich, an Israeli National Cyber Directorate official, arrested in a Las Vegas police sting during Hacker Summer Camp on a charge of soliciting a minor online; he posted bond, flew home, and says he will fight the charge — a charge, not a conviction.
-
2026
The Epstein cluster
After the DOJ releases roughly three million Epstein files — showing Epstein's interest in hacker gatherings — DEF CON bans three men named in them: futurist-inventor Pablos Holman (whom Epstein arranged to meet at DEF CON in 2013, then at Intellectual Ventures), researcher Vincenzo Iozzo, and Joi Ito, who resigned from MIT in 2019 over $1.7M in concealed Epstein funding. Iozzo's spokesperson calls the ban "entirely performative... not based on any investigation or wrongdoing."
both sides, on the record
The capture read (ours, argued): a convention founded as a cheap, anonymous, cash-only act of hostility to commercialization now costs ~$580, runs a sponsor floor and a jobs market, publishes a code of conduct, and maintains a ban list. The $30 party grew a bureaucracy. The chart is the con's own.
The price is real: whatever the justification, admission rose roughly 19-fold from 1993 to 2025 — far outpacing inflation — pricing out exactly the broke teenagers the founding myth celebrates.
The institution names names: banning Hadnagy and Ito is DEF CON acting as a gatekeeper with a reputation to protect — the behavior of an establishment, not a party.
The ethos survived the price: DEF CON still takes cash at the door, still refuses to pre-register attendees or keep a names database, and still runs "Spot the Fed." The one thing the founding myth actually protected — anonymity — is intact. "Cash at the door works every time" is current, first-party text [1].
The price bought scale, not a sellout: tens of thousands of attendees, dozens of villages, hardware, and Las Vegas venue costs are real. A larger, deeper con costs more to run; the number tracks growth, not extraction. DEF CON remains independently owned by its founder, not a media conglomerate [2].
The bans protect attendees: a code of conduct and transparency reports are what a community builds after it is big enough that "don't be a jerk" stops scaling. The Hadnagy and Ito actions were widely supported in the community; each is documented and two-sided on its own file, not a mark against the con [3] [4].
YOU DECIDE
Scoped to what is documented: the price went from about $30 to about $580, and the con grew the machinery of an institution — a code of conduct, transparency reports, a ban list. Those are facts, several of them in DEF CON's own numbers. Whether that is capture or simply growing up is the argument, and the con's defense is strong: the anonymity-and-cash ethos, the one part that was ever load-bearing, is still standing.
Weigh the costly signal the con still pays: it leaves money on the table every year by refusing credit cards and a registration database it could easily monetize. An institution captured by commerce does not usually turn down the commerce. The archive keeps the chart.
The archive does not judge. The archive keeps the receipts — and the price list.
evidence locker
PRIMARY / FIRST-PARTY
- DEF CON FAQ — defcon.org SELF-PUBLISHED — the current cash-at-the-door price ($500–$580 range) and the "Cash at the door works every time" ethos, verbatim. defcon.org/html/links/dc-faq/dc-faq.html
- defcon.org SELF-PUBLISHED — the con's self-description and its transparency reports (independent ownership, code of conduct). defcon.org defcon.org/html/links/dc-transparency.html
CONTEXT & CROSS-LINKS
- troll.fan — Chris Hadnagy (both-sides file) CROSS-LINK — the 2022 DEF CON transparency-report ban, sourced and two-sided. troll.fan/dossiers/chris-hadnagy.html
- troll.fan — Joi Ito (both-sides file) CROSS-LINK — the 2026 DEF CON ban and the 2019 Media Lab / Epstein-funding resignation. troll.fan/dossiers/joi-ito.html
- Wikipedia — DEF CON ATTRIBUTED — founding (1993, Jeff Moss, age 18), history, attendance growth. en.wikipedia.org/wiki/DEF_CON
The standard. The price history is documented, its recent figures taken from DEF CON's own FAQ, and the chart matches them. The commercialization is stated as fact; the "capture" reading is labeled as our analysis, and the con's defense — the surviving cash-and-anonymity ethos, the real costs of scale, independent ownership, and the pro-attendee framing of its bans — is presented at full strength. No wrongdoing by DEF CON is asserted. The banned individuals are cross-linked to their own two-sided files, not re-tried here. If it couldn't survive a defamation challenge, it wouldn't be on this page.