Instead of simply trying to spend stolen USDT directly, the attacker placed it to work as collateral. About $59.9M in stolen USDT was deposited on Aave, and about $43.8M worth of ETH was borrowed against that deposit, per LlamaRisk.

The distinction matters. A deposit on a lending protocol is not a withdrawal to a bank account, and it does not require the permission of the token issuer. The borrowed ETH could then be held or moved as an asset that no central issuer can freeze in the way Tether can freeze USDT.

Issuers did act at scale. Tether froze about $1.567B in USDT, Circle froze about $823M in USDC, and Elliptic estimates about $2.84B was frozen in total, a figure Binance described as about $3B.

Yet the overall hack is estimated at about $6.3B, and Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer. The Aave borrow sits squarely in that unfrozen portion of the story.

Viewed in that light, the freeze was a partial remedy rather than a resolution. It removed a large pool of issuer-controlled tokens from circulation, but it could not reach value that had already been transformed into ETH through decentralised lending.

The episode exposes a structural tension in crypto markets. Centralised issuers can police their own tokens, but decentralised protocols and bearer assets such as ETH and Bitcoin operate without a central authority able to impose the same freeze.

That tension is the bigger story here. The freezes were significant, and they changed the attacker's options, but they did not solve the problem, because the ecosystem offers routes around issuer control that do not depend on any single company.