What happens next when the biggest holdings cannot be frozen is the question the Binance hack leaves behind, and it is larger than the freeze announcements that preceded it.

The freeze announcements were substantial: Tether froze about $1.567B in USDT, Circle froze about $823M in USDC, Elliptic estimates the total frozen at about $2.84B, and Binance says about $3B was frozen.

But the overall hack is about $6.3B, and Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer. Celebrating the frozen portion alone would mistake a partial intervention for a conclusion.

Part of the remaining sum was secured before issuers acted. The hacker converted about $786M in stablecoins into ETH and TRX before the freezes, placing value in assets where an issuer freeze does not operate in the same way.

Per LlamaRisk, about $59.9M in stolen USDT was deposited as collateral on Aave, and about $43.8M worth of ETH was borrowed against it, showing stolen funds being actively reshaped rather than sitting idle.

USDT and USDC can be frozen by their issuers; ETH and Bitcoin have no central issuer with that same power. That difference means the next phase cannot rely on the tool that produced the first headlines.

Instead, the next phase is tracing and monitoring: following the unfrozen assets, documenting their movement, and looking for moments when they interact with identifiable services. The freezes were significant, but they did not solve the problem, and the unfrozen billions are the bigger story still unfolding.