When direct use of stolen stablecoins became risky, decentralised lending offered another path. The attacker deposited about $59.9M in stolen USDT on Aave as collateral and borrowed about $43.8M worth of ETH against it, according to LlamaRisk figures.

The borrowed ETH was valuable precisely because it escapes the control mechanism that applies to USDT and USDC. Tether and Circle can freeze their own tokens, but ETH has no issuer able to do the same, so the loan converted exposure from a freezable token into one that is not.

The scale of the issuer response should not be understated. Tether froze about $1.567B in USDT and Circle froze about $823M in USDC. Elliptic estimates the total frozen at about $2.84B, while Binance says about $3B was frozen.

Those figures, however, sit alongside an overall hack of about $6.3B. Elliptic estimates the attacker still controls about $3.33B in assets that cannot be frozen by a centralised token issuer, a remainder larger than the frozen total on Elliptic's estimate.

The Aave episode shows how that remainder was preserved. Rather than holding only tokens that could be seized at the issuer level, the attacker used a protocol to obtain an asset class outside that reach.

For observers, the point is not that lending protocols caused the hack, but that they form part of the environment in which recovery must be attempted. Freezes work at the token-issuer layer; they do not automatically extend to lending positions or to the assets borrowed through them.

The freezes were therefore significant but incomplete. They demonstrate what centralised control can achieve, and, through the Aave loan, what it cannot, in an ecosystem where decentralised tools remain available to anyone, including an attacker.