The first one was not only a security token (unregistered security selling an 'expectation of profit' to token buyers) but also a scam:
http://www.zerohedge.com/news/2017-09-29/sec-files-first-ever-civil-fraud-charges-against-ico-companiesHowever, there are many legit token projects that are not a scam, but set up as a security offering (investment contract, expectation of profit, etc) even if their intention is a utility token (access to platform/services). In those cases, they need to be registered with the SEC or they are illegal, and there's a good chance the SEC will investigate them to protect investors.
Be careful buying tokens that are unregistered securities.
We carefully structured the CHEX as a utility token:
https://bitcointalk.org/index.php?topic=2112470.msg21120617#msg21120617