Several friends of mine had their WhatsApp completely hacked. Basically, hacker would spam recovery, which results in a phone call to the victim. If the victim doesn’t pick up the phone, the recovery code goes to voicemail. Hacker accesses voice mail (password protected yes, but for lots of people it’s a birth year, 1234, 0000, or last 4 digits of their phone), and voila they have access to your WhatsApp. They can’t see your messages but can see all the groups you’re in and message those.

Completely preventable by having WhatsApp 2FA enabled.