Some crypto investment firms may be overstating potential payouts and understating the risks, regulator suggests -