The U.S. Securities and Exchange Commission (SEC) is suing Rivetz, a now-defunct crypto payments startup, over its $18 million initial coin offering (ICO) in 2017, which the SEC says was an unregistered securities offering.

The SEC alleged Thursday that between June and September of 2017, Rivetz and its CEO, 58-year-old Steven K. Sprague, marketed and sold RvT tokens to over 7,200 investors around the world, including the United States.

While the SEC says that Sprague and Rivetz “used the funds raised primarily to capitalize” Rivetz’s business, the sale of RvT tokens was not registered with the agency.

According to the complaint, Sprague used a portion of the proceeds, collected in ether and sold for U.S. dollars, to award himself a one-time bonus of $1 million.

He also allegedly borrowed $2.5 million from the funds to “purchase a house in the Cayman Islands that he then leased back to Rivetz Int’l,” a wholly-owned international subsidiary of Rivetz.

The SEC is seeking a final judgement that includes disgorgement and a civil penalty for Rivetz, Rivetz International and Sprague.