The SEC bungled a crypto lawsuit. Then came an alleged kidnapping in Dubai—and questions about $400 million of investor funds – Fortune