Coinbase, the largest cryptocurrency exchange based in the U.S., said Thursday that criminals had improperly obtained personal data on the exchange’s customers for use in crypto-stealing scams and were demanding a $20 million payment not to publicly release the info.

Coinbase said customer passwords and private keys were protected by its systems, and “at no time were any of the targeted contractors or employees able to access customer funds.”

The cryptocurrency exchange estimated preliminary expenses of $180 million to $400 million for remediation costs and voluntary customer reimbursements.

The inquiry continued even after the commission dropped a lawsuit accusing Coinbase of illegally marketing digital currencies to the public.

Coinbase said on Thursday it strongly believes a regulatory investigation by the U.S. securities regulator into its disclosures of monthly transacting users should not continue.

Coinbase Global Inc. is cooperating with the US Securities and Exchange Commission on an agency probe into its previously reported user metrics, the company said Thursday.