The freeze worked only where someone held the switch, and in the Binance hack that condition applied to stablecoins, not to every asset the attacker held.

A stablecoin issuer can freeze tokens at an address because it controls issuance and can enforce a block. Tether used that authority to freeze about $1.567B in USDT, and Circle used it to freeze about $823M in USDC.

Elliptic estimates the total frozen at about $2.84B, and Binance says about $3B was frozen. Those figures describe a substantial intervention, but one confined to assets with an issuer behind them.

ETH has no such issuer, and neither does Bitcoin. No central company can freeze ETH or Bitcoin holdings in the way Tether and Circle froze USDT and USDC, so value held in those forms remained outside the freeze mechanism.

The attacker moved before the net closed. About $786M in stablecoins was converted into ETH and TRX before the freezes, a shift from freezable tokens toward assets beyond an issuer's reach.

Per LlamaRisk, about $59.9M in stolen USDT was deposited as collateral on Aave, with about $43.8M worth of ETH borrowed against it. The episode shows stolen stablecoins being deployed while the freeze response was still forming.

Out of an overall hack of about $6.3B, Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer. The lesson is structural: where no issuer holds a switch, a freeze cannot be the answer.