Hackers targeting Balancer have successfully transferred 195 frozen stS tokens, valued at approximately $3 million, using the Permit authorization method. The tokens were moved from the Sonic address 0xf19…fae2 to a new address 0x0e9c…44D5, where they were subsequently exchanged for WBTC and ETH. The freeze was ineffective because it only impacted the native S token, not the ERC20 tokens like stS, which can utilize the permit() method. This method allows for off-chain signatures that do not require the frozen address to pay S, enabling the hackers to bypass the freeze.