Surveillance cameras captured the Pathfinder entering Times Square at approximately 6:28 p.m. on a Saturday evening, the sidewalks thick with tourists and theatergoers. The driver walked away through an alley moments after parking. Police evacuated a wide perimeter, from 43rd to 49th Street on Seventh Avenue and across 45th Street to Eighth Avenue, displacing thousands of pedestrians and delaying Broadway shows. A bomb disposal team broke the rear window and sent a remote-controlled robot inside to disassemble the device. They found two full five-gallon cans of gasoline, three full twenty-gallon propane tanks, 152 M-88 firecrackers packed into two metal containers, and two travel alarm clocks wired as triggering devices. The bomb had been set ablaze but malfunctioned before it could detonate. Investigators later called the design "amateurish," and the president of the fireworks company that manufactured the M-88s noted they were too weak to damage a watermelon. Had the device functioned as intended, it would have produced a massive fireball and sprayed shrapnel across one of the most crowded intersections in the world.

The bomber's operational planning unraveled through a series of mistakes that read almost like dark comedy. Faisal Shahzad, a thirty-year-old Pakistani-born naturalized U.S. citizen living in Bridgeport, Connecticut, had purchased the Pathfinder for $1,300 cash off Craigslist, declining a bill of sale. He had parked a getaway vehicle, a black 1998 Isuzu Rodeo, several blocks from the bomb site the day before the attack. On the night of the bombing, he accidentally left the Isuzu's keys inside the Pathfinder and had to take the train home instead. He returned the next day with a second set. Meanwhile, investigators traced the Pathfinder through a VIN stamped on the engine block after Shahzad had removed it from the dashboard and door. That number led to the previous owner, who provided the phone number Shahzad had used to arrange the purchase. The phone linked to calls from Pakistan, and within forty-eight hours, Shahzad was the prime suspect.

On the evening of May 3, Shahzad drove to John F. Kennedy International Airport, parked a white Isuzu Trooper loaded with a Kel-Tec 9mm Sub Rifle 2000 and five full magazines of ammunition, paid roughly eight hundred dollars cash for a one-way ticket to Dubai, and boarded Emirates Flight 202. Customs and Border Protection officers arrested him at 11:45 p.m., moments before the aircraft pushed back from the gate. His final destination was Islamabad. In custody, Shahzad waived his Miranda rights and spoke freely to interrogators. He described training at a Taliban-run camp in the Waziristan region of Pakistan in late 2009 and early 2010, including instruction in explosives. He acknowledged contact with Baitullah Mehsud, founder of the Pakistani Taliban, and with Yemeni-American cleric Anwar al-Awlaki, whose English-language online content calling for attacks against the West had influenced multiple plots.

Shahzad pleaded guilty to a ten-count indictment in June 2010, including conspiracy to use a weapon of mass destruction and attempting an act of terrorism. On October 5, a federal judge sentenced him to life in prison without possibility of parole. When the judge asked whether he had sworn allegiance to the United States upon becoming a citizen, Shahzad replied: "I sweared, but I didn't mean it." Attorney General Eric Holder confirmed that evidence pointed to the Pakistani Taliban as having directed and possibly financed the plot. Secretary of State Hillary Clinton warned of "severe consequences" if a successful attack were traced back to Pakistan, and the Obama administration developed contingency plans for unilateral military strikes in such a scenario. Three Pakistani men were arrested in the northeastern United States on immigration violations connected to informal money transfers that may have funded the operation.

In the aftermath, the narrative kept circling back to the two street vendors who had noticed something wrong and acted on it. One of them, Duane Jackson, received a personal thank-you call from Police Commissioner Raymond Kelly. The other, a Senegalese immigrant, drew far less media attention despite being, as several commentators later pointed out, a Muslim himself. Mayor Bloomberg warned against backlash, telling the city that New York would not tolerate bias against Muslim New Yorkers. Times Square returned to its usual crush of neon and crowds within hours, but the failed bombing intensified scrutiny of homegrown radicalization, informal terrorist financing networks, and the gap between a suspect's amateurish technical skills and the catastrophic potential of even a crude bomb placed in the right location.