Meta Offers $1M bounty at Pwn2Own Ireland 2025 for WhatsApp exploits
August 01, 2025
Meta backs Pwn2Own Ireland 2025 in Cork, offering up to $1M for WhatsApp exploits; targets include phones and wearables, Oct 21–24 via Zero Day Initiative.
Meta is sponsoring ZDI’s Pwn2Own Ireland 2025 hacking competition, where participants can earn big prizes for smartphone, WhatsApp and wearable device exploits. Participants can earn up to $1 million for a WhatsApp exploit that allows attackers to achieve remote code execution with no user interaction.
The event, organized by Trend Micro’s Zero Day Initiative, will be held from October 21 and 24 in Cork.
“we’re excited to announce that Meta is co-sponsoring this year’s event, and they are hoping to see some great WhatsApp exploits.” reads the ZDI’s announcement. “They are so excited for it, we’re putting up $1,000,000 for a 0-click WhatsApp bug that leads to code execution.”
ZDI’s Pwn2Own Ireland 2025 has eight different categories:
Participants can earn up to $500,000 for a one-click WhatsApp remote code execution exploit, while a zero-click account takeover exploit could fetch up to $150,000.
ZDI announced the return of the SOHO Smashup category with added difficulty, they also revealed that a new USB attack vector has been added to the mobile category.
Under the Wearables Category, participants can earn up to $150K for zero-click RCE on Ray-Ban smart glasses and Quest headsets, while the payout for Self Jailbreak $30K.
With WFH shifting enterprise perimeters to home networks, attackers can exploit consumer routers for lateral movement. Pwn2Own’s SOHO Smashup category highlights this risk, featuring fewer but more complex devices. Successfully compromising both targets within 30 minutes earns $100,000.
Last year in Pwn2Own Ireland 2024, participants earned a total of $1,066,625 for over 70 new vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, WhatsApp)
