Comment by jude-

Why does the attacker need to hold or buy any coins? All the attacker has to do to wreck havoc is prevent quorum from being reached. This can be done by knocking validators offline (which is a slashable penalty), or hacking validators and making them slash themselves, or hacking an exchange or two in order to amass control of 33% or more of the voting power.