DDOS attacks are not expensive. All you need is a decent internet connection, a good computer, a nice malware that can hijack other computers.
Before an attack, the server can take over infected PCs(bots) and initiate attacks from the infected PCs. No self respecting hacker will even initiate an attack from his own PC. The owner of the bot is the guy who does all the spending without knowing it. Of course, for a successful attack a lot of bots are required. So, numbers can be in thousands to tens of thousands.
There are a few choices on how you can get these bots. Hackers can auction a number of bots to others hackers who want to initiate such attacks for a certain fee for every hour. This can get expensive depending on the organization that you are attacking. Very cheap if you hit an international bank, but expensive if attacking a defence forum. But for a hacker who already has all the bots required, it can get as cheap as your regular monthly subscription with your ISP to initiate the attacks and keep it going for long periods of time.
You can say it is the duty of every individual to ensure his/her computer is not a bot. When you don't allow any random guy entering your house, you need to have the same safety protocol with your computer too. This will help ensure bots are never created in the first place.