The vulnerability has been fixed and funds "restored" to accounts, the company said.