Timing shaped the outcome of this hack as much as the size of the freezes. Before issuer controls could cover every stolen token, the attacker deposited about $59.9M in stolen USDT on Aave as collateral and borrowed about $43.8M worth of ETH against it, per LlamaRisk.

Once borrowed, that ETH was no longer subject to the freeze power that Tether holds over USDT. The loan effectively moved value from a token with a central off-switch into a network where no issuer can flip that switch.

Later, the issuers acted on a large scale. Tether froze about $1.567B in USDT, Circle froze about $823M in USDC, and Elliptic estimates about $2.84B in total was frozen. Binance put the frozen amount at about $3B.

Against an overall hack estimated at about $6.3B, those freezes still leave a substantial gap. Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer.

The Aave borrow is one concrete reason for that gap. It happened through a decentralised protocol, not through an issuer, and the asset received sits outside issuer jurisdiction.

This sequence reframes the freeze as a race rather than a wall. Issuers can block tokens they control, but an attacker who converts or borrows quickly can place value beyond that wall before it is fully built.

The broader lesson is about the limits of centralised control in a decentralised ecosystem. Freezes are powerful within their own domain, yet they did not solve the problem here, because the unfrozen billions, including ETH obtained through Aave, remain the larger story.