then he will probably want to transfer balances from that keys to his own keys, because if he doesn't do that those gullible large stakeholders who sold him their empty keys will be able transfer funds from those keys again to their new addresses
In Nxt if the attacker does that then he will be unable to generate blocks for 1 day because moved coins lose the right to forge blocks for 1440 blocks. As the result branch difficulty will drop significantly because only those coins that the attacker controlled before the purchase of the keys will be allowed to forge. And the legit chain may get more weight taking over the control.