An estimated $3.33B remains in the attacker's hands in a form that centralised issuers cannot freeze, according to Elliptic, a blockchain analytics firm, and that stockpile now defines the next phase of the incident.

Issuers did act at scale. Tether froze about $1.567B in USDT and Circle froze about $823M in USDC, bringing the total frozen to about $2.84B under Elliptic's estimate, compared with about $3B in Binance's account.

Timing mattered. Before the freezes landed, the hacker had already converted about $786M in stablecoins into ETH and TRX.

Separate lending activity added another layer. LlamaRisk reports that about $59.9M in stolen USDT was deposited on Aave as collateral, against which about $43.8M worth of ETH was borrowed.

Set against an overall hack estimated at about $6.3B, the frozen sum is substantial yet incomplete.

That incompleteness follows from how the assets work. Issuers of USDT and USDC can freeze those tokens, but ETH and Bitcoin have no central issuer able to exercise the same power.

What the episode demonstrates is not that freezing failed, but that it has a boundary. The freezes were significant and still did not solve the problem, because the unfrozen billions remain the bigger story in a system where centralised control only reaches so far.