The next phase is not freezing: it is following funds that no issuer controls, and that shift defines where the Binance hack story goes from here.

Freezing produced striking numbers. Tether froze about $1.567B in USDT, Circle froze about $823M in USDC, Elliptic estimates the total frozen at about $2.84B, and Binance says about $3B was frozen.

Those numbers invited celebration, but they cover only part of an overall hack of about $6.3B. Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer.

The early moves explain part of that remainder. Before the freezes, the hacker converted about $786M in stablecoins into ETH and TRX, a conversion that carried funds past the point where a stablecoin issuer could stop them.

Per LlamaRisk, about $59.9M in stolen USDT was deposited as collateral on Aave, and about $43.8M worth of ETH was borrowed against it, another documented step toward ETH holdings.

USDT and USDC can be frozen by their issuers, but ETH and Bitcoin have no central issuer with that same power, so the remaining holdings sit in a category where freezing is not an option.

Following those funds is slower and less dramatic than a freeze announcement, yet it is the work that remains: tracing movements, preserving evidence of transfers, and watching for contact with services that can act. The freezes were significant, but they did not solve the problem, and the unfrozen billions are the bigger story.