Major cryptocurrency exchange Kraken has discovered a critical bug that effectively allowed printing free money. 

Despite the bug’s severity, the exchange says that no client’s assets were actually at risk. 

The global cryptocurrency trading platform was notified about the vulnerability by a security researcher via email. 

Despite routinely dealing with fake bug bounty reports, the exchange says that it treated that particular alert seriously, with its team quickly digging into the issue. 

The exchange’s team discovered a bug that allowed bad actors to initiate a deposit onto Kraken and receive funds in their account without completing the deposit.

A bad actor could print assets out of thin air on Kraken, according to Nick Percoco, Kraken’s chief security officer. This was due to a recent UX change that would credit accounts before their assets cleared. 

A money-printing spree  

Three accounts managed to take advantage of the bug, according to Percoco. Notably, one of them was the security researcher who generated $4 in crypto and later disclosed the bug to the other two individual who printed millions of dollars worth of crypto. 

"After patching the risk, we thoroughly investigated the situation and quickly discovered that 3 accounts had leveraged this flaw within a few days of each other. As we dug deeper, we noticed that one account was KYC’d to an individual who claimed to be a security researcher," Percoco said.