Coinbase, the largest cryptocurrency exchange based in the U.S., said Thursday that criminals had improperly obtained personal data on the exchange’s customers for use in crypto-stealing scams and were demanding a $20 million payment not to publicly release the info.

Coinbase expects to pay $180 million to $400 million relating to remediation costs and voluntary customer reimbursements related to this incident, which saw attackers gain access to users personal information.

Coinbase has been betrayed from within. The cryptocurrency exchange said that cyber criminals bribed some of its support agents to share personal information about Coinbase customers. Attackers acquired data such as names,