A freeze total in the billions can sound like a resolution. In this case, it was not, because a large part of the stolen funds had already left the world of freezable tokens. Before the freezes, about $786M in stablecoins was converted into ETH and TRX.

ETH and TRX sit outside the freeze mechanism that governs USDT and USDC. Tether can freeze USDT, Circle can freeze USDC, but neither ETH nor TRX has a central issuer able to impose the same block, and the same is true of Bitcoin.

When issuers did act, the sums were large: Tether froze about $1.567B in USDT and Circle froze about $823M in USDC. Elliptic estimates about $2.84B frozen in total, while Binance says about $3B was frozen.

The overall hack is estimated at about $6.3B, and Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer. The gap between frozen and unfrozen is the heart of the story.

The conversion was not the only route into unfrozen assets. Per LlamaRisk, the attacker also deposited about $59.9M in stolen USDT on Aave as collateral and borrowed about $43.8M worth of ETH against it.

Taken together, these transactions show an attacker navigating the architecture of crypto itself, moving value from tokens with a central off-switch to assets without one, and doing so through ordinary conversion and lending mechanisms.

The freezes were significant, but they illustrate the limits of centralised control in a decentralised ecosystem. The billions left untouched, including the converted ETH and TRX, are the bigger story, and they will determine the long tail of this hack.