Coinbase, the largest cryptocurrency exchange based in the U.S., said Thursday that criminals had improperly obtained personal data on the exchange’s customers for use in crypto-stealing scams and were demanding a $20 million payment not to publicly release the info.

Coinbase expects to pay $180 million to $400 million relating to remediation costs and voluntary customer reimbursements related to this incident, which saw attackers gain access to users personal information.