Speculation:

An LMB -> Havelock transfer exploit was found, a user (presumably BTCApples, check the other thread) exploited it and sold it for a small amount at the time (2.8 mBTC/share). A little while later, the Troll accounts were causing the people to panic sell. They succeed.

Of course, whether TAT's fault or not, TAT was the person responsible for LMB -> Havelock transfers so he wanted to jump ship before he gets into legal (or more legal) trouble.

In the meantime, users (such as presumably BTCApples, (once again, check the other thread) and others) were stocking up on cheap shares.

All of this combines, left NEO no choice but to halt trading and launch an investigation.

Once again, this is just my speculation due to the info I was gathered over the few days.  Thoughts?