Threshold Network said Nov. 1 that every tBTC node operator had patched its servers or taken nodes offline in response to a Linux kernel vulnerability, while new minting and Bitcoin redemptions remained paused.
In its security update, Threshold also disclosed a separate incident in one operator’s broader infrastructure that drained about 0.5 ETH from the Ethereum account its tBTC node uses to pay transaction fees. Threshold said the incident was unrelated to the kernel flaw, the node was already offline, and the operator had found no evidence its signing key material was accessed.
The tBTC bridge lets Bitcoin holders bring BTC into DeFi, with deposited Bitcoin secured by groups of network operators. The pause blocks new conversions into and out of the token through the bridge, though Threshold says tBTC continues to transfer normally on Ethereum and Layer 2 networks.
Threshold said it had found no evidence that the kernel vulnerability had been used to exploit a tBTC node. It also said “tBTC remains fully backed” and it had seen no unauthorized minting or movement of Bitcoin.
https://x.com/i/status/2116965471157203243
The flaw, CVE-2026-98432, affects the Linux kernel’s IPv4 networking subsystem. Red Hat’s advisory rates it critical and says an unauthenticated remote attacker could exploit it to execute code without user interaction. Systems accepting inbound TCP connections are most directly exposed, the advisory says.
The fee-paying account is distinct from the collective signing process needed to move bridge Bitcoin. Threshold’s technical documentation says 51 of a wallet’s 100 signers must collaborate to produce a signature. Threshold reiterated that no single operator can move the funds.
Bitcoin balances independently checked by The Defiant were sufficient to cover the Ethereum token supply. Six large wallets identified in Threshold’s explorer held a combined 4,320.33 BTC, calculated from confirmed balances in mempool.space’s Bitcoin records. Etherscan showed a total Ethereum supply of 4,185.16 tBTC during reporting.
Aave Restrictions Remain
Aave’s Ethereum Core tBTC reserve remained frozen, with about $136.3 million supplied, according to its interface. Aave froze the reserve on Oct. 31 following Threshold’s bridge pause.
The freeze blocks new tBTC deposits and additional borrowing against the token, but repayments, withdrawals and liquidations continue, according to Aave risk service provider LlamaRisk. The freeze itself does not change existing positions’ health factors or trigger liquidations, LlamaRisk said. It plans to propose restorative measures once it has assurance that tBTC operations have returned to normal.
Threshold first announced the bridge pause on Oct. 30. It has warned users not to send BTC to previously generated deposit addresses or repeat pending transactions, and says deposits and redemptions already in progress will complete after operations resume.
Threshold gave no restart time in its latest update, saying bridge functionality would resume once security maintenance was complete and nodes were back online on patched systems. It promised another update within 24 hours, or sooner if anything changes.