The cryptocurrency exchange estimated preliminary expenses of $180 million to $400 million for remediation costs and voluntary customer reimbursements.

Coinbase reported in a Securities and Exchange filing Thursday the company received an email on May 11 from an “unknown threat actor” that claimed to have stolen sensitive information from less than 1% of its monthly users, including data related to “customer service and account management systems.”

Coinbase, the largest cryptocurrency exchange based in the U.S., said Thursday that criminals had improperly obtained personal data on the exchange’s customers for use in crypto-stealing scams and were demanding a $20 million payment not to publicly release the info.