Coinbase, the largest cryptocurrency exchange based in the U.S., said Thursday that criminals had improperly obtained personal data on the exchange’s customers for use in crypto-stealing scams and were demanding a $20 million payment not to publicly release the info.

Coinbase said customer passwords and private keys were protected by its systems, and “at no time were any of the targeted contractors or employees able to access customer funds.”

The cryptocurrency exchange estimated preliminary expenses of $180 million to $400 million for remediation costs and voluntary customer reimbursements.