So attacker is scared of the hard fork.
I have the feeling that the attacker could sue them for this.

He just got the coins by using the code and if they make a hard fork it would be like stealing the funds.

Who can he sue? The miners will be the people doing the forks, they are around the world. Can he sue them in every country?