Coinbase, the largest cryptocurrency exchange based in the U.S., said Thursday that criminals had improperly obtained personal data on the exchange’s customers for use in crypto-stealing scams and were demanding a $20 million payment not to publicly release the info.

Coinbase Global said Thursday that it has refused to pay a $20 million ransom demand from cybercriminals who bribed the company’s overseas customer support agents to steal sensitive user data.The cryptocurrency exchange estimated that the incident could cost from $180 million to $400 million,

Coinbase expects to pay $180 million to $400 million relating to remediation costs and voluntary customer reimbursements related to this incident, which saw attackers gain access to users personal information.