“However, we didn’t receive any reward as only Koreans are eligible to receive a bounty.”
A deep link bug in KakaoTalk 10.4.3 leaked a user’s access token, and the token lets an attacker register a new device and read the victim’s chats. End-to-end encryption is off by default, and the opt-in version skips group chats. KakaoTalk has more than 100 million Play Store downloads. Kakao took the report and kept the bounty for Koreans.