Coinbase, a leading cryptocurrency exchange, disclosed on Thursday that cybercriminals bribed overseas customer support agents to steal sensitive customer data, which was then used in social engineering attacks.

The breach, detailed in an SEC filing, could cost the company up to $400 million to remediate, Coinbase estimated.

The incident came to light on May 11 when Coinbase received an email from an individual claiming to have obtained customer account details and internal documents, including customer-service and account-management system materials.

The sender demanded payment to withhold public disclosure, but Coinbase has refused to pay and is working with law enforcement to investigate.

While passwords and private keys remained secure, the stolen data included names, addresses, phone numbers, emails, masked bank account numbers, the last four digits of Social Security numbers, government ID images, and account balances, the company said.

Coinbase’s stock slid 4% on the news, reflecting investor concerns about the financial and reputational impact.

The company has not disclosed the number of affected customers but emphasized its commitment to resolving the issue and enhancing security measures.

“Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks,” the company said in a blog post. “These insiders abused their access to customer support systems to steal the account data for a small subset of customers. No passwords, private keys, or funds were exposed and Coinbase Prime accounts are untouched. We will reimburse customers who were tricked into sending funds to the attacker.”

According to the filing, Coinbase independently discovered the breach months earlier. The company promptly dismissed the employees involved, notified affected customers, and strengthened its fraud detection measures.

The threat actor paid overseas contractors and support-role employees to obtain the information, the report stated.

“We’re cooperating closely with law enforcement to pursue the harshest penalties possible and will not pay the $20 million ransom demand we received,” the company said in the blog. “Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack.”

Coinbase, the largest cryptocurrency exchange in the U.S., has made significant strides recently, enhancing its global presence and achieving a notable milestone in traditional finance.