[proofofmoon]

> Mining several blocks in private to confirm the fake transaction may be needed to prevent the other miners from reorganizing the blockchain in order to steal the fees and output of transaction T. If the attacker is not in collusion with 51% of the miners, then this may cost the attacker millions in rented hashing power ...

Does this mean that this exploit only has value to an attacker who is already capable of sustaining a 51% attack?

[mickronome]

No, AFAIU it only implies that such an attacker would have to face the multi million dollar cost of renting enough hashing power to guarantee that no-one could steal the 'loot' before the attack has settled. I didn't study the article a lot, but it seems the attack transaction(s) previously crafted can essentially be stolen by any node working with it, and that the costs sunk by the attacker to craft the could then be avoided by THAT attacker.