No, the attacker couldn't because there's no exchange or trading platform that supports Sapling -> Sapling transactions. In fact most exchanges only allow trading the transparent pool.
There is
no decentralized or peer-to-peer trading using shielded addresses? Then what's the point of Zcash?