Researchers Expose WhatsApp Flaw Enumerating 3.5 Billion User Numbers

Security researchers from the University of Vienna and SBA Research have exposed a significant vulnerability in WhatsApp's contact discovery system, enabling the enumeration of approximately 3.5 billion active user phone numbers worldwide. The flaw, which allowed queries at a rate exceeding 100 million numbers per hour from a single IP address, was responsibly reported to WhatsApp's parent company, Meta, and subsequently patched in late 2025.

The vulnerability stemmed from WhatsApp's core mechanism for matching users' address books to its database, a feature that confirms whether a phone number is registered on the platform. Researchers exploited this by generating plausible mobile numbers across 245 countries, systematically querying the servers to verify registrations. Despite existing rate-limiting measures, the team evaded blocks, compiling a dataset that included not only phone numbers but also timestamps, profile pictures, "about" texts, and end-to-end encryption public keys for the 3.5 billion accounts. This effort, detailed in a study titled "Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy," represented one of the largest...