Stopping transfers is not the same as recovering about $6.3B. About $2.84B has been frozen, on Elliptic's estimate, which means the frozen assets cannot move, but it does not mean they have been handed back.

Issuer freezes built that total. Tether froze about $1.567B in USDT, Circle froze about $823M in USDC, and Binance says about $3B was frozen.

Beyond the frozen sum, Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer.

The sequence helps explain the split. Before the freezes, the hacker converted about $786M in stablecoins into ETH and TRX.

On Aave, per LlamaRisk, about $59.9M in stolen USDT was deposited as collateral, and borrowing against it produced about $43.8M worth of ETH.

Freezing depends on an issuer. USDT and USDC can be frozen by their issuers, whereas ETH and Bitcoin have no central issuer with that same power.

Freezing billions was a serious blow to the attacker, but it was not a solution. The funds that escaped issuer control still dominate the aftermath, and they show the limits of centralised power over decentralised money.