Coinbase, the largest cryptocurrency exchange based in the U.S., said Thursday that criminals had improperly obtained personal data on the exchange’s customers for use in crypto-stealing scams and were demanding a $20 million payment not to publicly release the info.

Coinbase reported that a cyber attack against its systems resulted in customer data being stolen and used in scams.

Coinbase forecast a hit of $180 million to $400 million from a cyber attack that breached account data of a "small subset" of its customers, the crypto exchange said in a regulatory filing on Thursday.