Based on recent SEC reports, The Securities Exchange Act, The Investment Company Act, and Investment Advisers Act are applicable to most ICOs that the SEC deems to be in violation of federal law.
This is when issuing an unregistered security bites back. The lawsuits often just claim it was an unregistered security, which is easy to prove. If someone lost money, they can go after the people behind the ICO on that basis.
[1] https://www.equities.com/news/class-action-lawsuits-hit-cryp...
The SEC also proactively brings suits against misbehaving persons.