Where is coinbase transaction after a hacker successfully performs >50% attack? Here is the scenario: 

 Honest nodes build one block from Block_1. 

 Hacker nodes privately build four blocks from Block_1 and broadcast these malicious blocks. 

Now, where is the honest node's coinbase transaction (25 BTC + Transaction Fee). Is it included in the hacker's malicious blocks? 

In Satoshi's white paper, he mentioned: 


  If a greedy attacker is able to assemble more CPU power than all the
  honest nodes, he would have to choose between using it to defraud
  people by stealing back his payments, or using it to generate new coins


I think a hack with more than 50% power could do BOTH, stealing back his payments and generate new coins. Why am I wrong?
You're not wrong. 

A miner with more than 51% of the network's mining power can build the longest chain by himself, thus reaping all block rewards and dictating which transactions make it into the longest blockchain, allowing him to doublespend at will. Also see: What can an attacker with 51% of hash power do?

There can only be one valid block at each height, so when the attacker broadcasts his longer chain, it replaces the blocks of the honest node exclusively up to the common ancestor.
The mining reward from the honest blocks which are now not part of this longest chain will be treated as if they had never been found, as they do not represent valid blocks in the longest chain.

However, the malicious node's contrarian position will slow down the number of blocks found to a respective amount due to the reduced mining power supporting the longest chain (assuming he is trying to catch-up).

By playing selfishly, he will be in control short-term, still get only 51% of the rewards (at least until the difficulty reset), and shake the trust in Bitcoin, thus eroding the value of his bitcoins.

By playing cooperatively, he would gain 51% of the blocks and increase trust in the system, thus making his bitcoins more valuable.