The SEC bungled a crypto lawsuit. Then came an alleged kidnapping in Dubai—and questions about $400 million of investors' funds | Fortune