The U.S. Securities and Exchange Commission’s (SEC) Enforcement Division has released its annual enforcement report for the 2018 fiscal year (FY), Friday, Nov. 2. The report notes actions by the Division against fraudulent Initial Coin Offerings (ICOs).

According to the report, since the formation of the Division’s Cyber Unit at the end of FY 2017, the commission’s focus on cyber-related misconduct, including ICOs, has been growing steadily. The SEC attributes this to an “explosion” in crypto-asset offerings, which it says are often considered high-risk investments. According to the report:

“In the past year, the Division has opened dozens of investigations involving ICOs and digital assets, many of which were ongoing at the close of FY 2018.”

The report notes several illicit ICOs, three of which defrauded investors of over $68 million: the cofounders of a purported financial services startup raised $32 million from thousands of investors, the “blockchain evangelist” president of Titanium Blockchain Infrastructure Services Inc. raised $21 million, while a “recidivist law violator” raised $15 million by promising a 13-fold monthly return on investments.

The Enforcement Division also noted new key formations in the agency to address investor protection, such as the Division’s Retail Strategy Task Force (RSTF). In turn, the RSTF has launched a lead-generation and referral initiative involving trade suspensions associated with the crypto and blockchain industries.

According to the report, the SEC ordered $3.94 billion in total penalties and disgorgement over FY 2018, $3.04 billion of which was ordered from the top five percent largest cases.

In October, Yahoo Finance and Decrypt Media released a joint report, claiming that the SEC has expanded its crackdown on ICOs, putting “hundreds” of projects at risk. Yahoo and Decrypto noted that there is still a lack of regulatory certainty in the space, and the agency “is not going to provide them.”

The report further states that, in response to SEC pressure, dozens of firms “quietly agreed” to refund investors’ money and pay fines, rather than attempt to reach a legal compliance.