It was done by Signal themselves: https://signal.org/blog/whatsapp-complete/

The client is closed so it can't be independently verified outside of sniffing traffic or decompilation I assume.