The bomber is Derek Frost, the guy whose wallet was returned to him as he left the train. He deliberately left his wallet there so it would be assumed that he died on board. Stevens figures this out and Frost is arrested before he can use his next bomb. Not content with the fact that everyone on the train died for nothing, Stevens convinces Goodwin to send him into the Source Code one last time and disconnect his life support after that. In the Source Code, Stevens deactivates the bomb and handcuffs Frost to a pole. He calls the cops on Frost and lets them know where the next bomb is. He then sends a text message to Goodwin. Stevens's life support is deactivated, but he continues to live on in the Source Code as he deboards the train with Cristina. Goodwin hears about an attempted bombing on a commuter train being thwarted just as she receives the text from Stevens. Sure enough, the text says that she will get the news. Goodwin remembers everything as she looks down on Stevens disfigured body. The text says that someday Stevens will be sent back into the Source Code for another mission.