Mr. Clayton highlighted the risks posed by cryptocurrency trading platforms that call themselves “exchanges,” which gives the impression that they are regulated like the New York Stock Exchange and the Nasdaq. But investors using such platforms “do not receive many of the market protections that they would when transacting through broker-dealers on registered exchanges,” Mr. Clayton said. Instead, the cryptocurrency exchanges are considered “money transmission” businesses, subject to a hodgepodge of state and federal rules that provide little protection to those who use their services.

There are distinctions between cryptocurrencies like Bitcoin, which are not tied to a single company but instead operate more like regular money, and tokens issued by firms to help raise money in initial coin offerings, or I.C.O.s. Mr. Clayton announced a much tougher stand on that second form of virtual assets. “The structures of I.C.O.s that I have seen involve the offer and sale of securities and directly implicate the securities registration requirements,” he said. The S.E.C. has filed cases against companies making coin offerings for selling unregistered securities, and more are certainly on the way.

Mr. Giancarlo explained that his agency does regulate futures contracts that are tied to cryptocurrencies, and it can police firms executing transactions involving the contracts. But he pointed out that the C.F.T.C. “does not have regulatory jurisdiction over markets or platforms conducting cash or ‘spot’ transactions in virtual currencies, or over participants on those platforms.” To reach actual trading in cryptocurrencies, Congress would have to extend its authority to cover a cash commodity market, something lawmakers have not done.

Investors need protection. Virtual currency firms have seen a rash of large-scale thefts from customer accounts. An Italian cryptocurrency exchange called BitGrail reported on Saturday that tokens called Nano worth approximately $170 million had gone missing in unauthorized transactions. An exchange in Japan called Coincheck disclosed in late January that hackers had stolen $530 million from the accounts of cryptocurrency investors.

Any theft can be prosecuted under a range of federal laws, including the Computer Fraud and Abuse Act and the wire fraud statute because cryptocurrencies are a form of property, even though they are intangible. But criminal prosecution is not a particularly effective weapon for battling hackers who plunder cryptocurrency wallets. Many of the exchanges are outside the United States, so finding those responsible is a challenge.