Gotta Catch 'Em All - How To Capture 3.5 Billion WhatsApp Accounts

Contact discovery in messengers usually means checking phone numbers against a service's user base. That becomes an enumeration problem when identifiers are predictable and server-side limits are loose. The speakers tested whether WhatsApp still allowed this at scale. Using an open-source reimplementation of the WhatsApp web protocol, they sent well-formed lookups from one IP address and a few test accounts. They began with a public scrape of about 500 million numbers, and more than half were still active years after the leak.

They then generated candidate numbers from national numbering plans, covering 235 countries and about 63 billion candidates. The run took roughly three weeks and found around 3.5 billion active accounts without any bans. Each hit also yielded profile photos, about text, public keys and device details. The team reported that 57 percent of accounts had public photos, that some encryption keys were reused across many accounts in regions tied to scam operations, and that about-text fields exposed drug sales and other sensitive content. They also observed activity in countries where the app is restricted.

Earlier disclosure tickets about missing rate limits were closed as duplicates or non-issues until a public paper prompted engagement. Meta then rolled out countermeasures starting in October 2025, including rate limiting and removal of some timestamps. The takeaways: metadata leaks even when messages are end-to-end encrypted, leaked data stays useful for years, and centralized messengers concentrate risk.