This is the classic time-money tradeoff. Theoretically you only need one wrench and one attacker—but even if she attacks 100 people a day it would take thousands of years to reach everyone. And word of the attacks would spread, so later victims would take steps to safeguard their money and the attacks would become ineffective.

To be maximally effective you'd need to mobilize enough attackers and enough windowless white vans to reach the entire populace within probably a day, so let's say 3 million attackers and 3 million white vans. That's when things start getting more expensive than the sql query.