The applause came too early. The freezes after the Binance hack were real and large, but billions had already been moved beyond any issuer's reach before the celebration began.

Tether froze about $1.567B in USDT and Circle froze about $823M in USDC. Elliptic estimates the total frozen at about $2.84B, and Binance says about $3B was frozen.

Those totals tell only part of the story, because the overall hack is about $6.3B. A freeze total, however large, does not close a case when the remaining holdings sit outside issuer control.

The movement happened before the freezes. The hacker converted about $786M in stablecoins into ETH and TRX, shifting value into assets that a stablecoin issuer cannot freeze in the same way.

Per LlamaRisk, about $59.9M in stolen USDT was deposited as collateral on Aave, and about $43.8M worth of ETH was borrowed against it, showing how quickly stolen value could change form.

Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer. USDT and USDC can be frozen by their issuers; ETH and Bitcoin have no central issuer with that same power.

That is why the next phase looks different from the first. It is less about a single freeze decision and more about tracing funds that no issuer can halt, following them across networks, and watching where they surface next. The freezes were significant, but they did not solve the problem, and the unfrozen billions are the bigger story.