In this case it looks like the attacker managed to swap some stablecoins into ETH before they were frozen.