Unfreezable holdings now dominate the aftermath, with Elliptic, a blockchain analytics firm, estimating that the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer.

By contrast, the frozen holdings are well documented. Tether froze about $1.567B in USDT, Circle froze about $823M in USDC, and the total frozen is about $2.84B on Elliptic's estimate, while Binance says about $3B was frozen.

The path to the unfrozen position ran through conversion. Before the freezes, the hacker converted about $786M in stablecoins into ETH and TRX.

Aave figures add detail to the trail. Per LlamaRisk, about $59.9M in stolen USDT was deposited as collateral, and about $43.8M worth of ETH was borrowed against it.

The incident overall is estimated at about $6.3B, so the unfrozen estimate alone represents a major share of the loss.

Only some assets answer to an issuer. USDT and USDC can be frozen by their issuers, but ETH and Bitcoin have no central issuer with that same power.

The freezes mattered, but they did not close the case. The billions that sit beyond any issuer's reach are the larger story, and they expose how far centralised controls can go in a system built to resist them.