How to Add Bitmoji to Snapchat Stories: A TikTok Tutorial (Snapchat Hack Guide)

Snapchat’s latest undocumented API loophole—dubbed the “Bitmoji SnapMap Story Hack”—lets users embed real-time geolocation data into Bitmoji avatars and push them to public Stories without triggering Snap’s geofence restrictions. The exploit, demonstrated in a viral TikTok tutorial by developer @sophpmoo this week, bypasses Snap’s LocationServices sandbox by abusing the SnapKit SDK’s undocumented BitmojiAvatar.updateDynamicProperty() method, which accepts raw latitude/longitude inputs. Snap confirmed the issue exists but called it a "minor edge case" not tied to any active exploit in the wild.

The hack works by injecting geotagged Bitmoji avatars into Stories via a modified SnapMap overlay, then distributing them through Snap’s cross-platform StoryShare API. Unlike traditional SnapMap pins—which require explicit user consent—the Bitmoji avatars carry metadata in their avatarProperties payload, including precise GPS coordinates encoded as double values. When rendered, these avatars display animated "trails" that mirror the user’s actual movement history, visible even to non-friends.

How the Exploit Bypasses Snap’s Security Model

Snap’s geofence protections rely on two layers: the LocationServices permission gate (which blocks unauthorized GPS access) and the StoryPrivacyPolicy enforcer (which restricts location-sharing to approved contacts). The Bitmoji hack sidesteps both by treating avatars as "static" media assets rather than dynamic location data. "This is a classic case of type confusion in API design," said Lydia Chen, CTO of Privacy.sh. "Snap’s SDK treats Bitmoji avatars as decorative objects, not geospatial entities. The exploit repurposes that assumption."

Chen’s analysis aligns with reverse-engineered SnapKit logs from GitHub’s Snap reverse-engineering repo, which show the updateDynamicProperty() method accepting raw CLLocationCoordinate2D inputs without validation. "The SDK’s documentation lies," Chen added. "It claims this method only supports String or Number types, but the binary clearly parses GeoJSON objects."

"Snap’s geofencing relies on client-side enforcement. If the client can lie about location data, the server has no way to verify it."

— @halvarflake, Security Researcher, ZeroDay Initiative

Why This Matters: The API Arms Race in Social Media

This isn’t the first time Snap’s undocumented APIs have fueled third-party innovation—or controversy. In 2023, developers discovered a similar loophole in SnapMap’s getNearbyUsers() method, which let apps scrape real-time user locations despite Snap’s "opt-out" privacy claims. That exploit led to a class-action lawsuit and forced Snap to patch SnapKit with runtime integrity checks. This week’s Bitmoji hack follows the same pattern: a feature designed for creative expression (dynamic avatars) repurposed for data exfiltration.

The broader implications hinge on Snap’s StoryShare API, which powers cross-platform distribution to Instagram, Facebook, and TikTok. When a Bitmoji Story is shared via this pipeline, its embedded geodata travels with it—unencrypted, unless the receiving platform’s MediaMetadataExtractor filters it out. Instagram’s API, for example, strips EXIF geotags but doesn’t parse custom avatarProperties payloads. "This creates a perfect storm for stalking apps," said Chen. "A malicious actor could build a service that scans shared Stories for these avatars, then reverse-engineer the trails into a user’s home address."

The 30-Second Verdict

• Exploit mechanism: Abuses BitmojiAvatar.updateDynamicProperty() to inject GeoJSON data into static avatar assets.
• Impact: Bypasses Snap’s geofence checks, exposes precise location history in public Stories.
• Platform risk: Cross-platform sharing via StoryShare API may leak data to unpatched social networks.
• Snap’s response: "Minor edge case" (no patch timeline released).

How Developers Are Weaponizing the Hack (And How to Block It)

Within 24 hours of the TikTok tutorial’s upload, GitHub repositories emerged with Python and JavaScript scripts to automate the exploit. One repo, bitmoji-hack/avatar-trail, includes a StoryParser class that decodes avatar trails into WKT (Well-Known Text) format for mapping tools like Leaflet.js. "This is the first time we’ve seen social media location data encoded in a way that survives platform hopping," said Moxie Marlinspike, founder of Signal.

"The fact that this works at all is a testament to how little social media platforms care about API consistency. Snap’s SDK is a Swiss cheese of undocumented features—some useful, some dangerous."

— Moxie Marlinspike, Signal Foundation

Mitigation requires three steps:

1. Client-side: Disable SnapKit’s BitmojiAvatar rendering in Stories via preferences.set("avatarDynamicProps", false) (undocumented but confirmed working in iOS 17.5+).
2. Server-side: Snap must add runtime validation to updateDynamicProperty() to reject non-string/number inputs. The GeoJSON schema validation patch would require a SnapKit update.
3. Platform-side: Instagram, Facebook, and TikTok must audit their MediaMetadataExtractor pipelines for custom avatarProperties payloads and strip them pre-render.

The Broader War: Open APIs vs. Walled Gardens

This exploit underscores a fundamental tension in social media architecture: open APIs drive innovation but also enable abuse. Snap’s SnapKit is intentionally permissive to attract third-party developers, but that same openness creates attack surfaces. Compare this to Apple’s MapsKit, which enforces strict CLLocationManager sandboxes and blocks undocumented methods via runtime checks. "Snap’s approach is a gamble," said Chen. "They bet on community goodwill to patch holes faster than malicious actors exploit them. So far, the bet is losing."

The Bitmoji hack also highlights a regulatory blind spot: cross-platform data leakage. Under GDPR and CCPA, Snap is responsible for user location data even when shared to Instagram. Yet no framework exists to audit third-party APIs for hidden metadata. "This is a gaping hole in the StoryShare ecosystem," said Marlinspike. "If a user ‘opts out’ of location sharing on Snap, but their Bitmoji Story gets reposted to Facebook, what recourse do they have?"

What Happens Next

• Short-term: Expect a SnapKit patch within 30 days (historically, Snap fixes undocumented exploits slower than documented ones).
• Mid-term: Third-party apps will race to build "Bitmoji stalking" tools unless platforms act. Meta and TikTok may preemptively block avatarProperties payloads.
• Long-term: Regulators may force social media platforms to audit cross-platform API metadata flows, treating embedded data as "secondary personal information."

The Bitmoji SnapMap hack isn’t just a bug—it’s a symptom of how social media platforms treat APIs as features rather than contracts. Until that changes, creative (and malicious) developers will keep finding ways to turn decorative avatars into spy tools.