Crypto exchange Coinsecure will pay back users following a $3.4 million theft last week – but there’s a catch.

According to a message posted Saturday on the India-based exchange’s website, all of the balances held in Indian rupees are secure. But the 438.318 BTC stolen is currently being tracked and has yet to be recovered. And depending on the outcome of its investigation, those bitcoin-denominated funds may ultimately be paid out in rupees instead.

Coinsecure explained in its message:

“Through the course of the investigation, should we be able to recover all of our BTC, all our customers’ BTC holdings will be refunded as per the balance they held with Coinsecure. However, if recovery of siphoned BTC is not possible, then we will apply the lock in rates as of the 9th of April, 2018. 10% of the coin holding balance will be refunded in BTC and 90% will be returned in [Indian rupees].”

As previously reported, Coinsecure has implicated its chief security officer for the incident and is said to have gone as far as requesting that Amitabh Saxena have his passport rescinded amidst the investigation. The exchange startup further blamed the CSO’s practices for putting the funds at risk in the first place.

On April 9, bitcoin’s price closed at $6,773.94. It has since rebounded, meaning that if Coinsecure is unable to salvage the lost bitcoins, users could suffer a more than 17 percent loss (as of press time) in holding value.

The exchange said in its statement that it is working with “global exchanges and experts” to locate the funds, and plans to release further updates next week.

Bitcoin and rupee notes image via Shutterstock