After much trial and error, Stevens successful identifies the bomber as Derek Frost (Michael Arden), the man who is always seen dropping his wallet before leaving the train.

Who bombed the train in Source Code?

To summarize, Colter was nearly killed in Afghanistan. After that, he was hooked to Source Code. 2 months later a nut by the name of Derek blows up a train. Everyone on the train dies.

Is the Source Code real?

Or is it actually real? "The idea is that it's a simulator, but it actually opens up access to a parallel reality," Jones explained. ... Every time Colter is sent into the Source Code, they're creating a new reality where a new terrorist event occurs.