Apologies for the speculation, but it seems that that the user @etherqueen was singled out in the hard fork commit:
//if( db().head_block_num() > 3100000 && o.owner )
if( o.account == "etherqueen" )
idump( (o.account)(db().head_block_time()) );
//idump( (o)(db().get_account(o.account))(db().head_block_num()) );
See: Commit: Hard fork 9 account recovery

I would've speculated the same according to the information. (thanks)
history in wallet ...over 90.000 STEEM was transfered to bittrex ...i guest that`s the hacker -,-