Pwn2Own WhatsApp Hacker Says Exploit Privately Reported to Meta

According to SecurityWeek, at Pwn2Own Ireland 2025 the highest WoC reward was for a WhatsApp entry that would have demonstrated a $1 million zero-click remote code execution exploit, but the demonstration was withdrawn. A total of $1,024,750 was paid out across the event, with rewards for various exploits including a $100,000 share for two Samsung Galaxy S25 chains and similar sums for certain NAS and printer flaws, and up to $40,000 for several smart home devices.

The researcher, identified as Eugene (3ugen3) of Team Z3, was scheduled to present the WhatsApp exploit on Thursday but ultimately withdrew, with ZDI stating the researcher did not feel ready to publicly demonstrate; ZDI also said Meta remained interested in receiving the research. SecurityWeek notes there has been no public update on ZDI’s assessment or whether Meta paid any bounty for the WhatsApp hack, and the researcher cited an NDA that prevents sharing details.

The article, published on 24 October 2025, also quotes Dustin Childs, head of threat awareness at ZDI, explaining the coordinated disclosure process to Meta.