Two years after the Battle of New York, Steve Rogers works in Washington D.C. for the espionage agency S.H.I.E.L.D. under Director Nick Fury, while adjusting to contemporary society. Rogers and Agent Natasha Romanoff are sent with S.H.I.E.L.D.'s counter-terrorism S.T.R.I.K.E. team, led by Agent Rumlow, to free hostages aboard a S.H.I.E.L.D. vessel from Georges Batroc and his mercenaries. Mid-mission, Rogers discovers Romanoff has another agenda: to extract data from the ship's computers for Fury. Rogers returns to the Triskelion, S.H.I.E.L.D.'s headquarters, to confront Fury and is briefed about Project Insight: three Helicarriers linked to spy satellites, designed to preemptively eliminate threats. Unable to decrypt the data recovered by Romanoff, Fury becomes suspicious about Insight and asks senior S.H.I.E.L.D. official Alexander Pierce to delay the project.
On his way to rendezvous with Maria Hill, Fury is ambushed by assailants led by a mysterious assassin called the Winter Soldier. Fury escapes to Rogers' apartment, and warns Rogers that S.H.I.E.L.D. is compromised. After handing Rogers a flash drive containing data from the ship, Fury is gunned down by the Winter Soldier. Fury dies in surgery, and Hill recovers the body. The next day, Pierce summons Rogers to the Triskelion. When Rogers withholds Fury's information, Pierce brands him a fugitive. Hunted by S.T.R.I.K.E., Rogers meets with Romanoff. Using data in the flash drive they discover a secret S.H.I.E.L.D. bunker in New Jersey, where they activate a supercomputer containing the preserved consciousness of Arnim Zola. Zola reveals that ever since S.H.I.E.L.D. was founded after World War II, Hydra has secretly operated within its ranks, sowing global chaos with the goal that humanity would willingly surrender its freedom in exchange for security. The pair narrowly escape death when a S.H.I.E.L.D. missile destroys the bunker, and realise that Pierce is Hydra's leader within S.H.I.E.L.D.
Rogers and Romanoff enlist the help of former USAF pararescueman Sam Wilson, whom Rogers befriended, and acquire his powered "Falcon" wingpack. Deducing that S.H.I.E.L.D. agent Jasper Sitwell is a Hydra mole, they force him to divulge that Zola developed a data-mining algorithm that can identify individuals who might become future threats to Hydra's plans. The Insight Helicarriers will sweep the globe, using satellite-guided guns to eliminate these individuals. Rogers, Romanoff, and Wilson are ambushed by the Winter Soldier, who kills Sitwell. During the fight, Rogers recognizes the Winter Soldier as Bucky Barnes, his friend who was captured and experimented upon during WWII. Hill manages to extract the trio to a safehouse where Fury, who had faked his death, is waiting with plans to sabotage the Helicarriers by replacing their controller chips.
After the World Security Council members arrive for the Helicarriers' launch, Rogers broadcasts Hydra's plot to everyone at the Triskelion. Romanoff, disguised as one of the Council members, disarms Pierce. Fury arrives and forces Pierce to unlock S.H.I.E.L.D's database so that Romanoff can leak classified information, exposing Hydra to the public. Following a struggle, Fury shoots Pierce dead. Meanwhile, Rogers and Wilson storm two Helicarriers and replace the controller chips, but the Winter Soldier destroys Wilson's suit and fights Rogers on the third. Rogers fends him off and replaces the final chip, allowing Hill to take control and have the vessels destroy each other. Rogers refuses to fight the Winter Soldier in an attempt to reach his friend, but as the ship collides with the Triskelion, Rogers is thrown out into the Potomac River. The Winter Soldier rescues the unconscious Rogers before disappearing into the woods. With S.H.I.E.L.D. in disarray, Romanoff appears before a Senate subcommittee and Fury, under the cover of his apparent death, heads to Eastern Europe in pursuit of Hydra's remaining cells. Rogers and Wilson decide to find the Winter Soldier, while Rumlow, who was a double agent for Hydra, is hospitalized following the Triskelion's destruction.
In a mid-credits scene, Baron Wolfgang von Strucker, at a Hydra lab, proclaims that the "age of miracles" has begun as scientists examine an energy-filled scepter and two prisoners: one with superhuman speed, the other with telekinetic powers. In a post-credits scene, the Winter Soldier visits a Bucky memorial at the Smithsonian Institution.