Threshold Network says every tBTC node operator has either patched its servers or taken nodes offline after a critical Linux kernel vulnerability prompted security maintenance. The November 1 update narrowed the immediate operational concern but did not reopen the bridge: new BTC deposits, tBTC minting and new redemption requests remain paused, and the project has not announced a restart time. Threshold said it found no evidence that the kernel flaw was used against a tBTC node, no unauthorized minting and no unauthorized movement of bridge Bitcoin.

The bridge pause remains in force

tBTC lets users move Bitcoin into decentralized-finance applications by depositing BTC and receiving an Ethereum-based token. Threshold's pause blocks new conversions through the bridge in either direction. Existing tBTC can still be held, transferred and used on Ethereum and supported Layer 2 networks. Deposits or redemptions already in progress are expected to finish after operations resume, but users were warned not to send Bitcoin to previously generated deposit addresses or repeat pending transactions. Those instructions describe a precautionary operating restriction, not a suspension of the tBTC token itself.

Related reporting: BTCPay Links Hot-Wallet Sweeps to Servers on Version 2.4.1 or Older

A critical Linux flaw triggered the response

The maintenance followed disclosure of CVE-2026-98432, a use-after-free flaw in the Linux kernel's IPv4 networking code. Red Hat rates the issue critical and says a remote, unauthenticated attacker may be able to execute code on a vulnerable machine without user interaction. Systems accepting inbound TCP connections are especially exposed. Threshold's update says operators addressed that risk by applying patched software or taking nodes offline, but it does not claim that the vulnerability was exploited against the bridge. The distinction matters because a severe flaw can justify emergency controls even when no compromise has been confirmed.

A separate fee-account loss is not the bridge incident

Threshold also disclosed that one operator experienced an unrelated incident in its broader infrastructure. About 0.5 ETH left the Ethereum account used by that operator's tBTC node to pay transaction fees. The node was already offline, and the operator reported no evidence that its signing-key material had been accessed. Threshold said one operator cannot move bridge Bitcoin alone because wallet transactions require cooperation from a majority of independent signers. The small fee-account loss should therefore not be described as a loss of tBTC reserves or as evidence that the Linux flaw reached bridge keys.

Backing is reported intact while Aave limits new exposure

Threshold reported roughly 4,320 BTC in bridge wallets against about 4,185 tBTC in circulation and said the token remains fully backed. Independent checks cited in The Defiant's report compared the identified Bitcoin wallets with Ethereum supply and found sufficient reserves at the time of reporting. Separately, Aave froze the tBTC reserve on its Ethereum Core market on October 31. That freeze stops new tBTC supply and prevents tBTC from adding borrowing power, but users can still repay and withdraw, liquidations continue, and existing health factors were not changed by the freeze itself.

Reopening still depends on a completed remediation

The next material confirmation will be Threshold's announcement that bridge maintenance is complete and patched nodes are back online. The project said functionality would resume only after a full remediation, leaving the duration uncertain. Aave also said it would consider restorative measures after receiving assurance that tBTC operations had normalized. Until those steps are separately confirmed, users face two distinct restrictions: the bridge cannot accept new mints or redemptions, and Aave's Ethereum Core market cannot take new tBTC supply or count tBTC toward additional borrowing power. Neither restriction proves a reserve shortfall, but both remain active risk controls.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.