$1M WhatsApp Hack Flops: Only Low-Risk Bugs Disclosed to Meta After Pwn2Own Withdrawal

SecurityWeek reports that the much-publicised $1 million WhatsApp exploit demo at Pwn2Own Ireland 2025 did not take place, after a researcher from Team Z3 withdrew from the event. WhatsApp said it is reviewing two vulnerabilities rated as low risk, and that neither could be used for arbitrary code execution. The researcher, Eugene (3ugen3), confirmed to SecurityWeek that he opted for private disclosure of his findings to protect his identity, with ZDI and Meta agreeing that details would remain private for now.

According to WhatsApp, the company remained in contact with ZDI and Team Z3 to triage the low-risk bugs it received and to understand the research, while emphasising its ongoing bug bounty programme. In total, more than $1 million was paid out to participants in the contest, which was run by Trend Micro’s Zero Day Initiative this week, covering exploits demonstrated against a range of devices and systems.