From kotaku.com:

An algorithm that allowed the generation of working Microsoft point codes resulted in the unauthorized acquisition of what some claim could be as high as $1.2 million in virtual currency. Microsoft tells Kotaku that they looking into punishing those that took advantage.

Microsoft discovered the exploit within hours, but not before a substantial number of codes were generated.
"We are aware of the situation and have taken steps to invalidate the codes obtained illegitimately," Microsoft told Kotaku in an official statement this afternoon.

And since they can track the damage, they are qualified to tell us that the $1.2 million figure being thrown about is far from the actual number. "We can't share specific numbers, but the figure is nowhere near the amount that has been reported."

"We take safety and security very seriously and require that Xbox LIVE members use the service in compliance with applicable laws and specifically prohibit people from engaging in illegal activity as a part of our Terms of Use and Code of Conduct," the statement continued. Our Policy and Enforcement team is evaluating whether or not certain individuals have violated the Terms of Use for Xbox LIVE and will take the appropriate enforcement on an individual basis."
Full Story: kotaku.com