Coinbase suffered a cyberattack that exposed user data and triggered a $20 million ransom demand. The company refused to pay and now faces up to $400 million in costs, plus an SEC probe.