The freezes arrived after the attacker's first, most consequential move. About $786M in stablecoins was converted into ETH and TRX before the freezes, shifting that value into assets that no issuer can freeze.

That order of events matters. A freeze can only act on tokens still held in their original, issuer-controlled form. Once converted, the funds no longer answer to Tether or Circle, the issuers behind USDT and USDC.

The eventual issuer action was extensive. Tether froze about $1.567B in USDT, Circle froze about $823M in USDC, and Elliptic estimates about $2.84B was frozen overall, compared with Binance's figure of about $3B.

Even so, the overall hack is estimated at about $6.3B, and Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer. The early conversion is a central reason that remainder is so large.

A related move on Aave underlined the pattern: about $59.9M in stolen USDT deposited as collateral, with about $43.8M worth of ETH borrowed against it, per LlamaRisk. In both cases, freezable stablecoins became ETH.

The picture that emerges is of a decentralised ecosystem in which centralised tools have real but bounded power. They can freeze the tokens they issue, but they cannot freeze ETH, TRX or Bitcoin, which have no central issuer.

The freezes were significant, and they will have constrained the attacker. They did not solve the problem, because the first move, the swap into unfreezable coins, had already secured a large portion of the haul beyond issuer control.