If crypto needs legal protection from attacks, I think that would invalidate most of its value proposition.

You will probably end up in court. But you might not get convicted.

Shakeeb Ahmed was convicted of wire fraud for exploiting a smart contract bug.

Avi Eisenberg was also convicted for exploiting a smart contract bug, but he had his conviction overturned on appeal.

The Peraire-Bueno brothers were in court for exploiting a bug in the MEV mechanism but it ended in a mis-trial so we're going to have to wait to find out.

Not legal advice ;-)

The attack described in this article might violate CFTC market manipulation regulations.

Depending on the currency, it's celebrated. (Code is law, etc.)

IANAL, but from my understanding, the primary law used to prosecute hacking is the CFAA's broad "without authorization" and "exceeding authorized access" clauses.

That said, authorization implies an entity with ownership rights granting some kind of limited license to others to interact with the owner's property.

For a permissionless decentralized network with no owner, where the attack is against the consensus of which chain is valid, I'd have a hard time arguing that "authorization" as a concept is even applicable or relevant.

As wmf suggested, market manipulation laws may still apply, but I'm not sure traditional CFAA "without authorization" / "exceeding authorized access" hacking charges could apply, though I'd be willing to bet a prosecutor could make a case for wire fraud - a scheme to defraud using interstate communications.