I reckon that simply having the SP to conduct the attack is no crime. There is no rule or prior sentiment against it. As most of the Steem that exists was mined before Steemit was opened to the public, the holders of it would become quite wealthy by purveying it to the purchaser(s).

Also, since they would have, at that point, sold off the majority (at least) of their Steem, they would no longer be whales, or even on Steemit, so may no longer care.

It is not necessary that a single party undertake control in order for that control to occur. Conspiracies and collusion are practically the order of business when hostile takeovers are conducted, and pooling of capital is no novel technique. The fact is that the control IS presently undertaken through holdings of SP by voters for witnesses. Since, by and large, the accounts holding that SP are the founders of Steem and Steemit, that isn't an attack at all, but management. Also, despite a certain congruence of belief and interests, there is no little divergence of views amongst those account holders (as the mutual flaggotry shows).

So, the only real means the rest of us might have to ascertain that a Sybil attack has been conducted is a) the sudden replacement of code by witnesses, most likely preceded by a wholesale replacement of witnesses by new witnesses, many likely to be new to Steemit, and b) the end of the powerdown period, which the attackers may find desirable so that they can immediately extract their Steem after making the changes to the code necessary to kill or neuter Steemit.

Those most likely to conduct such investment to harm Steemit are it's competitors with deep pockets, such as Zuckerberg, Schmidt, Soros, et al...

They will also probably make some changes that reflect their interests, such as ending free speech by making the blockchain less permanent, setting up some sort of centralized control over content insertion, etc., and may also not kill Steemit but seek to use it (it's success will be the only reason they'd find it beneficial to assume control of, IMHO).

It's likely we'd never know such an attack was being undertaken in advance, as there are many ways of xferring Steem surreptitiously. Perhaps the powering down of substantial SP would predate an attack, but accounts can be xferred, and simply convinced to vote as desired, too, so Steem might never even change hands in the conduct of such an attack.

There is but one way to defend against such an attack, and that is decentralization of VP. Presently concentrating wealth is the means of concentrating VP and this is what potentiates this attack vector. Concentrating wealth is perhaps the most singular feature of capitalism, so this is not some novel technology that would need to be developed to permit a Sybil attack on Steemit.

That one way I have long advocated, and it is to no longer weight VP by SP. The SEC may be able to conduct such a concentration of SP by means other than purchase, and the desecuritization of Steem would also preclude that attack vector.

Sorry if this is a bit obtuse. Up late and early, and the meds/coffee haven't really kicked in yet =p