The most revealing transaction in the aftermath of the Binance hack was not a freeze, but a loan. The attacker deposited about $59.9M in stolen USDT on Aave as collateral and borrowed about $43.8M worth of ETH against it, according to figures attributed to LlamaRisk.

The move mattered because it changed the form of the stolen funds before issuers could act on all of them. USDT can be frozen by its issuer, Tether, but ETH has no central issuer with that same power, so borrowing ETH against USDT collateral gave the attacker an asset that sits outside issuer control.

That sequence helps explain why the later freezes, large as they were, did not close the case. Tether froze about $1.567B in USDT and Circle froze about $823M in USDC, with Elliptic estimating total frozen funds at about $2.84B, while Binance put the frozen figure at about $3B.

Set against an overall hack estimated at about $6.3B, the frozen total still leaves a vast remainder unaccounted for by issuer action alone. Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer.

The Aave transaction is a clear illustration of that gap. A decentralised lending protocol, operating without a central party able to seize collateral on an issuer's instruction, allowed stolen stablecoins to be turned into a different, unfreezable asset through an ordinary borrowing mechanism.

This is not a story of a single failed control. It is a story of two systems running side by side: tokens whose issuers can freeze balances, and networks and protocols where no equivalent switch exists. The attacker moved value across the boundary between them.

The lesson, then, is about the limits of centralised control in a decentralised ecosystem. Freezing USDT and USDC can slow an attacker and strand part of the haul, but as long as collateral can be borrowed against and converted, freezes alone will not recover the whole sum.