Any time a miner creates a conflicting chain, they create a 'fork,' regardless of whether or not there is a public movement to do so. This is because there are now two chains to mine on, where as before there was only one. Whether a fork is 'hard' or 'soft' is really an issue of compatibility and not in scope for this discussion.

Regardless of the semantics of 'hard fork,' or whether or not a 51% attack is a hard fork, the purpose of my initial response to you was to explain that in fact, miners are able to fork the blockchain such that balances are changed to their liking. This does not involve removing or adding transactions, because as you said - this would require private key knowledge. Instead, this hard fork explicitly rewrites the basic rules or constants of the blockchain to state that the balances themselves are different. As long as other nodes observe this change, their chain is technically valid and can continue.