3.5 Billion WhatsApp Accounts Identified Through Enumeration

According to the University of Vienna and SBA Research, a recent study examined how WhatsApp users can be identified even though end-to-end encryption is in place. The researchers tested more than 63 billion potential phone numbers across 245 countries and identified 3.5 billion active WhatsApp accounts, using a reverse-engineered API without facing rate limits.

They generated 63 billion valid numbers and conducted the crawl in multiple rounds, with round one finding the 3.5 billion active accounts, round two fetching profile text and pictures, and round three obtaining the public keys. The team authenticated five sessions by scanning QR codes with real WhatsApp accounts and sent large batches of numbers—up to 50,000 in one request—to the endpoint that checks if a number is on WhatsApp.

They reported speeds of 7,000 numbers per second for registration checks, 3,000 per second for profile data, and 2,000 per second for encryption keys, and noted that the method was practical and scalable. The findings highlight that WhatsApp’s contact discovery system can reveal substantial personal information at scale, raising privacy concerns for users.