A 250,000 node botnet would have roughly 99.6% of network hashing power. It would also eventually mine 1 million coins and become a trusted node and then have complete control of the network. Of course there is no reason to have 99.6% of hashing power as 51% power = 100% power. Once an attacker accumulates 1M coins (and thus has an "owned" trusted node to sign their attack blocks) it would only take a pathetic 800 bots to takeover the entire network.
Well, that depends on what those boxes are like - if those are mostly single-core lame Chinese PCs with decent-ish connections, it might have taken more to get same hashes, but provided far more DOS potential.
Also, the hypothetical botnet could be mining with only a fraction of its overall boxcount - the reason why it might attack mostly when it is not mining is primarily due to the fact that it is going to take "rests" anyway (to leverage asymmetric diff adjust to mine more coins), and attacks during those periods so that not a single kb of traffic is "drawn away" from the attack (a petty kind of efficiency-humping, but all to plausible for someone whose business model is essentially building great armies out of petty components)
Also, a kind soul has suggested that
maybe the bot herder IS one of the "10 trusted individuals" thus giving him every incentive possible to make SC's "bitcoin gonna dieee" marketing hype look "real" (it's not like the herder could sell his million coins off, assuming this scenario was true), which seems reasonable, if quite hypothetical, proposal.
All in all, methinks, the best way to go about it would be to wait for the next "BTC-related" DDoS outbreak and see if it coincides with weird SC2 diff drop once again. Several such repetitions would strongly suggest that it is not coincidental, and such repetitions can be trivially ascertained by multiple neutral parties. Yea, it makes it seem unlikely 'Dick' is part of the Botnet. I mean, unless his zombies are only capable of either running a Miner or running a Syn Flooder one at a time, why would he even bother to stop the 800~ from mining.
Cheers
He would stop for a seemingly unrelated reason - to leverage asymmetric adjust so he can get more coins.
The reason attack happened then would be to ensure so that the "resting" bots can use all of their bandwidth too, out of sheer petty "nitpicker" efficiency drive that seems consistent with a "good" botherder mindset.
We could trivially test this hypothesis by waiting and seeing if future mass DDoS sprees coincide with oddball diff drops in SC