Kidnappers in Ukraine have released an employee at a United Kingdom-registered cryptocurrency exchange after getting more than $1 million in bitcoins as ransom, an adviser to the Ukrainian interior minister told Reuters on Friday.

Pavel Lerner, a leading analyst and expert in blockchains, or decentralized public ledgers, was abducted by unknown masked people on December 26, according to a statement by his company, EXMO Finance, on its website.

“This is the first such case in Ukraine linked to bitcoins,” Anton Gerashchenko, an adviser to Interior Minister Arsen Avakov, said in a phone text message.

It was unclear who paid the ransom. Lerner’s work at EXMO did not involve access to the financial assets of its users, the company said, adding that the platform was operating normally.

“At the moment, he is safe, and there was no physical harm inflicted on him,” the statement said.  “Nevertheless, Pavel is currently in a state of major stress. Therefore, he will not provide any official comments in the coming days.”

News of the release came as bitcoin and other cryptocurrencies rebounded after two days of losses partly related to regulators toughening rules on digital currencies in an effort to curb excessive speculation. Many digital currencies surged in value this year.

Balaclavas

Strana.ua, a local news website, had earlier reported that six gun-toting men in dark clothing and balaclavas had snatched Lerner and pushed him into a minibus with stolen number plates.

Police have begun a criminal investigation after a man was kidnapped in the Obolon district of Kyiv, Oksana Blyshchyk, the Kyiv police spokeswoman, said by phone without revealing the name of the victim.

EXMO has 900,000 users as of December 2017, according to its website.

“We would like to note that the story of Pavel’s abduction has overgrown with rumors that might tamper with the official investigation,” EXMO said in its statement. “That said, EXMO currently refrains from any comments or suggestions of own versions of the possible scenario, in the nearest future.”

Separately, the company announced Thursday that it had been hit by a denial-of-service attack.