The recovery effort after the Binance hack ran into a complication that no issuer freeze could undo: a loan. The attacker had deposited about $59.9M in stolen USDT on Aave as collateral and borrowed about $43.8M worth of ETH against it, per LlamaRisk.

That loan changed the attacker's position. Instead of holding only USDT, which Tether can freeze, the attacker held ETH, which no central issuer can freeze in the same way, alongside whatever stablecoins remained.

Tether froze about $1.567B in USDT and Circle froze about $823M in USDC. Elliptic estimates the total frozen at about $2.84B, while Binance says about $3B was frozen, a difference that reflects differing estimates rather than a single agreed total.

The overall hack is estimated at about $6.3B. Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer, meaning the unfrozen portion remains the dominant part of the story.

The Aave loan helps account for that balance. It shows value being deliberately shifted into an asset class designed to operate without a central issuer, using a protocol that does not ask an issuer for permission.

For the wider market, the episode is instructive. Centralised controls can be swift and large, and they can strand billions in stablecoins, but they operate only where a central issuer exists.

In a decentralised ecosystem, that boundary matters more than the headline freeze total. The freezes were significant, yet they did not solve the problem, and the ETH borrowed on Aave is a reminder of why the unfrozen billions will shape what happens next.