Frozen funds are not returned funds. About $2.84B has been frozen, on Elliptic's estimate, against an overall hack of about $6.3B, and freezing stops movement without returning anything to victims.

The frozen total is made up of issuer actions. Tether froze about $1.567B in USDT and Circle froze about $823M in USDC, while Binance says about $3B was frozen.

Even that total leaves a large shortfall against the scale of the theft, and Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer.

Conversion before the freezes widened the gap. The hacker converted about $786M in stablecoins into ETH and TRX before the freezes took effect.

Use of lending markets is also documented. Per LlamaRisk, about $59.9M in stolen USDT was deposited as collateral on Aave, and about $43.8M worth of ETH was borrowed against it.

The mechanics explain why freezing is limited. USDT and USDC can be frozen by their issuers, whereas ETH and Bitcoin have no central issuer with that same power.

The issuer freezes were a major intervention, yet they did not resolve the theft. What remains is a larger pool of assets outside centralised control, and that is where the story now leads.