Tracing the stolen funds reveals a clear direction of travel: away from tokens an issuer can control, and towards assets that function without one. Before the freezes, about $786M in stablecoins was converted into ETH and TRX.

That shift changed the legal and technical reality of the funds. USDT answers to Tether and USDC answers to Circle, each of which can freeze balances. ETH and TRX answer to no central issuer, so no company can freeze them by instruction.

The freezes that followed show the other side of that divide. Tether froze about $1.567B in USDT, Circle froze about $823M in USDC, and Elliptic estimates total frozen funds at about $2.84B, against Binance's estimate of about $3B.

Measured against an overall hack of about $6.3B, the frozen portion is less than half on Elliptic's estimate. Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer.

The Aave loan fits the same pattern of travel. About $59.9M in stolen USDT was deposited there as collateral and about $43.8M worth of ETH was borrowed against it, per LlamaRisk, again exchanging an issuer-controlled token for ETH.

The pattern is a lesson in ecosystem design. Centralised issuance gives regulators and issuers a lever, but decentralised assets deliberately remove that lever, and an attacker can exploit the difference simply by converting.

The freezes were significant, and they stranded a large pool of stablecoins. They did not solve the problem, because the shift into bearer assets such as ETH and TRX had already placed a large share of the haul beyond centralised control.