Before the freezes took hold, the attacker had already moved a large share of the haul beyond issuer reach. About $786M in stablecoins was converted into ETH and TRX, assets no issuer can freeze in the way Tether can freeze USDT or Circle can freeze USDC.

That conversion is the key to understanding the limits of what followed. Once stablecoins became ETH and TRX, the freeze power held by centralised issuers no longer applied to that portion of the funds.

The freezes that did follow were still large. Tether froze about $1.567B in USDT and Circle froze about $823M in USDC, with Elliptic estimating about $2.84B frozen in total and Binance putting the figure at about $3B.

Against an overall hack estimated at about $6.3B, however, the converted sum plus other unfrozen holdings leave a major remainder. Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer.

The conversion also included, on a separate track, the use of Aave, where about $59.9M in stolen USDT was deposited as collateral and about $43.8M worth of ETH was borrowed against it, per LlamaRisk. That loan reinforced the same pattern: freezable tokens exchanged for ETH.

Together, these moves describe an attacker working across the boundary between centralised and decentralised crypto. Issuers could act on their own tokens, but ETH, TRX and Bitcoin have no central issuer with the same freeze power.

The freezes were significant and they removed a large amount of stablecoins from play. They did not solve the problem, because the earlier conversion into assets nobody can freeze is the larger and more durable part of the story.