On the actual contract, it's possible a court would find that the contract was between parties x and y, and therefore party z inserting themselves into it is not valid. Often law comes down to intent, so the hacker could well find themselves in trouble, even if technically all they did was play by the rules allowed by the contract.

There is another interesting point here, which I think applies to Bitcoin too - if the blockchain/smart contract is the distributed source of truth and lets you deal with untrusted third parties without a middleman, it shouldn't require external arbitration.

If you need external arbitration in the event of problems, which requires verifying identity, intent, etc, why not have a central system with strong identities and regulatory bodies in the first place and forget the distributed system (which is slower and another point of failure), since the centralised system is what you fall back to anyway when the distributed trust fails.