After the freezes, the larger sum remained in motion, and that fact reframes what the Binance hack response actually achieved.

The freeze figures are not small. Tether froze about $1.567B in USDT, Circle froze about $823M in USDC, Elliptic estimates the total frozen at about $2.84B, and Binance says about $3B was frozen.

Yet the overall hack is about $6.3B, and Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer. The amount left outside the freeze is the amount that will define the months ahead.

How that sum ended up outside issuer control is already partly documented. Before the freezes, the hacker converted about $786M in stablecoins into ETH and TRX, moving value from tokens an issuer can block into assets it cannot.

Per LlamaRisk, about $59.9M in stolen USDT was deposited as collateral on Aave, and about $43.8M worth of ETH was borrowed against it, a further conversion from stablecoin collateral into ETH.

USDT and USDC can be frozen by their issuers, but ETH and Bitcoin have no central issuer with that same power, so the tools that produced the headline freezes have no equivalent for the remaining holdings.

The work ahead is therefore tracing rather than freezing: mapping movements, identifying where funds are held or exchanged, and building a record that can support later action. The freezes were significant, but they did not solve the problem, and the story now follows the money the freezes could not touch.