Coinbase, the largest cryptocurrency exchange based in the U.S., said Thursday that criminals had improperly obtained personal data on the exchange’s customers for use in crypto-stealing scams and were demanding a $20 million payment not to publicly release the info.

Coinbase said customer passwords and private keys were protected by its systems, and “at no time were any of the targeted contractors or employees able to access customer funds.”

Coinbase Global shares fell on Thursday after the crypto exchange said a recent cyberattack that breached customer account data could cost up the company up to $400 million.