Thieves recently stole Coinbase customers’ personal information and tried to extort it for $20 million, the company announced Thursday. Coinbase, the United States’ largest cryptocurrency exchange, said that instead of paying, it is offering a $20 million bounty for information leading to the arrest of those responsible. In a Wednesday evening filing with the Securities and Exchange Commission, Coinbase said that it received an extortion email on Sunday from criminals who had obtained some users’ names, addresses, contact information, government identification, transaction history and the last four digits of their Social Security numbers. The criminals gained the information by paying overseas contractors and support workers to hand it over, Coinbase said.

Coinbase (COIN.O) forecast a hit of $180 million to $400 million from a cyber attack that breached account data of a "small subset" of its customers, sending the crypto exchange's shares down nearly 3% on Thursday. The company received an email from an unknown threat actor on May 11, claiming to have information about certain customer accounts as well as internal documents. While some data including names, addresses and emails was stolen, the hackers did not get access to login credentials or passwords, Coinbase said. It will, however, reimburse customers who were tricked into sending funds to the attackers. The disclosure comes days before the company is set to join the benchmark S&P 500 index (.SPX), marking a landmark moment for the crypto industry.

The cryptocurrency exchange estimated that the incident could cost from $180 million to $400 million, between fixing the underlying issues and reimbursing customers, according to a regulatory filing. The disclosure sent the company’s stock down more than 7% on Thursday morning. The data breach is a setback for the largest U.S. crypto exchange, which has cultivated a reputation for safety and largely avoided the type of attacks and thefts that have crippled many overseas exchanges. The company said it received an email on Sunday from an unknown party who claimed to have obtained information about certain customer accounts, adding that the threat actor appears to have obtained the information by paying multiple contractors or employees working in support roles outside the U.S.