No reason to target many people's private keys. Just find a few insecure exchanges — maybe a single exchange is enough, even — that together hold a majority of stake.