In short, I don't think a for-profit attack is likely.
Why, if the ROI of such an attack is positive ?
It's not positive... you have to spend a fortune, and what could you accomplish? In the best scenario you would attack some exchanges and get some cash, but then, that would identify you, since cash transfers are not anonymous. You wouldn't manage to make a positive ROI by doing cash-in-the-mail exchanges!
Seriously, I can't see how such an attack would be profitable. I bet that, if you're willing to engage in criminal activities, there are probably much better ROIs you could obtain with such an investment....