See now that's the interesting question.
Did the HF23 team get betrayed by an insider?
Were they hacked?
All that is known is that whoever transferred those coins had access to the private active key and they used it to sign a transaction to Bittrex.
There could easily very well be an exploit on one of the frontends that was used during this process. In the transaction comments to @community321 it says @anonsteem was used to create the account. A hacker could have also traced the IP address of the specific computer that created the account and tried to hack that computer directly.
Except that hacker wouldn't know the IP address of the computer that created the account, only AnonSteem would know that. And if Anonsteem wanted to compromise the account, they could do so easily: just make a copy of the private key.
That's what I was saying I thought :D
I was giving AnonSteem the benefit of the doubt that they wouldn't preemptively compromise accounts.
It is all fucking obvious it was ned!