1) The coins belonged to customers, but were in Binance wallets (thus under control of Binance) - that's how exchanges work. You send them your coins, then you can trade.

2) You can't freeze Bitcoin transactions (well, the crypto bros running it could if their majority wanted to, but they don't want to), but some of the stolen coins were stablecoins like USDT and USDC.

And fiat-backed stablecoins are ipso facto centralised (someone needs to 1) take receipt of fiat and issue coins against that, 2) custody that fiat and hold on to it reliably, and 3) return the fiat when given back the coins). You can then with the private key send the coins back to the issuer, but the issuer can refuse to give you the fiat.

However, many stable coin smart contracts are even more powerful: they give the issuer an authorized control account that can add a wallet address to a blacklist. The contract checks that list whenever someone tries to move the token; if the address is blocked, it rejects the transfer. Then the balance can’t be moved.

There’s a small difference: USDC blocks transfers both to and from a blacklisted address. USDT generally blocks the address from sending USDT, though it may still receive USDT. Tether’s contract also has a separate function that can destroy tokens held at a blacklisted address; that is distinct from simply freezing them. Note that when they destroy tokens, Tether keeps the cash - so it's a transfer from the criminals (or whoever held the tokens) to Tether. (Tether can then re-issue the coins and hand them back to law enforcement or the victim, but that's a separate step.)