Who leaked?

For three weeks last April, bosses at DreamWorks, the cartoon studio that gave us Shrek and Kung Fu Panda, swapped deal proposals with would-be acquirers PAG Capital Asia and Comcast. To keep news from leaking, they used secret meetings, secured emails, and shredders.

But every trading day as talks wound on, pro investor Shaohua "Michael" Yin, a Wharton MBA grad, bought tens of thousands of DreamWorks shares, at $25 to $28 each, for accounts in the names of his retired parents, plus a teacher and two energy-company workers in Beijing. That netted the group $29 million in profits on April 28, when Comcast announced it was buying DreamWorks for $41 a share.

On Feb. 9, the Securities and Exchange Commission filed securities-fraud charges against Yin and his investors.

How did the SEC decide these investors knew too much? And why did it sue 10½ months later?

For the SEC, those highly profitable trades were also highly suspicious. Using borrowed money, the group had purchased nearly 3 percent of DreamWorks amid the secret sale talks. The SEC's Market Abuse Unit, including investigative accountant John Rymas in Philadelphia, reviewed their trades.

Using its algorithms, the SEC "can easily identify which accounts" bought shares "in front of the news," says Daniel Hawke, a partner at Arnold & Porter Kaye Scholer in New York and former head of the Market Abuse Unit.

But it's harder to identify how they got the privileged insider information and whether they broke U.S. securities law.

To build a case, the SEC checks IP addresses, phone records, and other forensic data linked to suspicious trades. It traced the accounts to Yin through contacts to his China office and his wife's family home in Silicon Valley.

These searches, sometimes with FBI criminal investigators, can take years -- or end in a hurry, if the target looks set to fly off.

On Feb. 3, FBI agents stopped Yin at the San Jose airport and took his cellphone before he flew home to China. Over the next two days, Yin's investors asked their brokers to withdraw $21 million. The SEC persuaded a federal judge to freeze the accounts.  On Feb. 9 the SEC sued Yin, his parents, and the three other account holders for securities fraud, and demanded their profits back, with interest.

Yin, his parents, and fellow investors didn't respond to my emails. Their New York lawyer didn't answer phone or email messages.

In a Wharton alumni club presentation in Beijing four years ago, Yin identified himself as founder of Hong Kong-based Summitview Capital Management Ltd. Another Summitview founder, Zhang Zili, told Bloomberg last week that Yin left the firm Feb. 7 "for personal reasons."

The SEC admitted in court filings that its case is "circumstantial." It doesn't say how Yin got insider information, only that his purchases "cannot be explained by any publicly available news." Yin "knew, recklessly disregarded, or should have known" that he possessed "nonpublic information about the DreamWorks acquisition," says the SEC.

Hawke said defense lawyers would call that a "very thin" legal case. "Suspicious trading is not enough," without knowing how the trader got protected information. But dubious trading patterns can help persuade the accused to negotiate settlements, he added.

The SEC says this wasn't Yin's first time: His trading circle made an additional $20 million in the last four years with five other "suspiciously well-timed and profitable trades" involving U.S.-listed and China-based companies.

According to the SEC, Yin's group in 2013 bought shares in the game developer Giant Interactive, just before a takeover offer. In 2015 it did the same with the online marketplace 58.com, which then merged with the owner of Ganji.com, and with the online travel service CTrip, before deals with Expedia Inc. and China's Baidu.com. In 2016, members bought shares of the electrical-equipment maker Jinpan just before its sale, and in U.S.-based Lattice Semiconductors, before it was bought by China-based Canyon Bridge Capital Partners.

The SEC bust makes "a nice headline. But there's questions: Who's he working with?" asks Dan David, cofounder of Skippack-based Geoinvesting, which investors hire to check out claims by China-based firms on the New York and Nasdaq exchanges. David also runs FG Alpha Management Fund, a long-short hedge fund, and lists firms he's blown a whistle on at StopTheChinaHustle.org.

In the DreamWorks case, "it's like this guy just got piggy," David told me: The Yin group accounted for an average 17 percent of DreamWorks daily share purchases in the three weeks before its sale. Better-polished insider traders "are smart enough to stay below 5 percent" of daily trading volume, and many don't get caught, he said.

David says China-based stock manipulators with U.S. victims face little risk of punishment back home. He has proposed to Pennsylvania's congressional delegation that China stocks in U.S. markets "should come with some kind of warning, like you get on a packet of cigarettes."

Even if no one gets a criminal prosecution, the SEC got the Yin group's profits frozen, and the proceeds could go to the U.S. Treasury, Hawke noted. But first, "the SEC still has to prove the case."