easiest (but not easy) may be coercion of large mining pools. You would hope that the unconstrained miners pointing hashrate at the coerced pools would pull their hash and direct it at other pools, quickly halting the 51% attack, though that requires monitoring to detect shenanigans other contenders - hardware backdoors to allow remote hash halting - stuxnet style mining worm

Interested in how a stuxnet-esk mine worm would work?