Coinbase, the largest cryptocurrency exchange based in the U.S., said Thursday that criminals had improperly obtained personal data on the exchange’s customers for use in crypto-stealing scams and were demanding a $20 million payment not to publicly release the info.

Coinbase said customer passwords and private keys were protected by its systems, and “at no time were any of the targeted contractors or employees able to access customer funds.”

Scammers demanded $20 million for customer data obtained by bribing insiders. Coinbase stock price tumbled Thursday following the incident.