Instead of paying the $20 million ransom, Coinbase offered the same amount of money for information leading to the attackers.

Coinbase reported in a Securities and Exchange filing Thursday the company received an email on May 11 from an “unknown threat actor” that claimed to have stolen sensitive information from less than 1% of its monthly users, including data related to “customer service and account management systems.”