You don't need the whole world, just the exchanges. And and some ERC20 tokens can have addresses frozen by a central authority (ex. USDC and Circle, USDT and Tether, etc) which is why the attacker immediately sold the USDC for ETH on 1inch and Uniswap.