Can't the addresses with the money be marked as obsolete or something like that so no miner accepts transactions from them? Only 50%+1 need to agree on this, right?
Decentralization not only means that you need 50%+1 of miners to accept, but also that there isn't a centralized driving authority to kick-start banning initiatives like that.
It can be labeled, but this does not stop the thief from moving it. Otherwise, the network would need to fork, which will never happen for somethign like this. Even if it did fork, he would still be left with pre-forked coins, which would be worth something. In the case of the Ethereum Dao hacker, the thief still got Ethereum Classic coins worth millions.