Full spoilers follow.
Anna Dover and Joy Birch are taken on Thanksgiving. The RV parked on the street belongs to Alex Jones, a young man with the mental capacity of roughly a ten-year-old, who lives with a woman he calls his aunt, Holly Jones. Detective Loki arrests him, but there is no forensic evidence and Alex is released into Holly's custody. On the way out Alex mutters to Keller a line about the girls not crying until he left them — enough for Keller to become certain. Keller abducts Alex and imprisons him in the derelict apartment building his late father left him, beating him for days and eventually confining him in a boarded-up shower stall he floods with scalding and freezing water. Franklin and Nancy Birch learn what he is doing and, in their own agony, become complicit.
The false trails. Loki's investigation produces a series of dead ends that are, in retrospect, all fragments of one story. A priest, Father Patrick Dunn, has the body of a man in his basement — a man who confessed to murdering sixteen children before the priest killed him. That man was Holly Jones's husband. A second suspect, Bob Taylor, turns out to have burgled the girls' homes for their clothes and to draw mazes compulsively while keeping crates of snakes; he was himself abducted as a child years earlier and escaped, and he shoots himself in custody. Bob was never the kidnapper — he was a previous victim, still trapped in the maze.
The reveal. Holly Jones and her husband lost their own son to cancer, and in response began abducting children — 'a war we wage with God,' as Holly puts it, designed to destroy parents' faith and turn them into monsters. After her husband's disappearance Holly continued alone. Alex is not her nephew: he is one of the abducted children, drugged and kept for years until he no longer knew who he was. The maze drawings, the pendant and the puzzle book all trace back to her. Joy Birch is found alive in Holly's house and hospitalized; when Keller presses her about Anna, she says 'You were there' — Keller had visited the Jones house and stood, unknowingly, a few feet from his own daughter.
The trap. Keller drives to Holly's home and confronts her. She pulls his own gun on him, shoots him in the leg, and makes him climb into a concealed pit beneath a car in her yard — the same hole where the children were kept — then closes the lid. Loki, meanwhile, has finally connected the maze pendant to Holly, arrives at the house, finds Anna drugged in the back of the car, and shoots Holly in the head. Bleeding from a wound to his own face, he races Anna to the hospital through a snowstorm. Anna survives. Alex Jones — real name Barry Milland — is reunited with the parents he was stolen from.
The final shot. Days later, at the sealed-off Jones property, police wind down a search of the yard. Loki, alone in the snow, hears a faint whistle: Keller, still alive in the pit, blowing Anna's emergency whistle. Loki turns his head. Cut to black. The film withholds the rescue, but the sound is unambiguous enough that the widely accepted reading is that Loki hears him and Keller is saved.
What only becomes clear afterward. Keller tortured a fellow victim for six days while the actual perpetrator served him coffee. His certainty was the mechanism of his failure — he was, as Holly intended, turned into a demon by the crime itself, fulfilling the antagonist's stated purpose. The film's rhyme is exact: the man who built a cage ends in a hole, and is found not by force but by the same patient attention he dismissed, using a whistle he gave his daughter to keep her safe.