Kraken disclosed nearly $3 million was taken from its wallets following a bug-related exploit that's since been fixed.

The crypto exchange received a bug bounty program alert on June 9, according to Kraken’s Chief Security Officer Nick Percoco. The alert warned it to an “extremely critical” bug, allowing an attacker to artificially inflate their balance on its platform.

Percoco said that while the submission was lacking in specifics, it looked into the issue and discovered an isolated bug allowing a malicious attacker to initiate a deposit onto its platform and receive funds in their account, without fully completing the deposit. He noted this was only in a specific set of circumstances.

Although no client assets were at risk, he claimed, the bug derived from a flaw in a recent UX …