Threshold Network Patches Linux Flaw, Keeps tBTC Minting and Redemptions Paused

Threshold Network said on Nov. 1 that all tBTC node operators had either patched their servers or taken nodes offline after a Linux kernel vulnerability, while new minting and Bitcoin redemptions remained paused. In a security update, Threshold disclosed a separate incident in the wider infrastructure of one operator that drained about 0.5 ETH from the Ethereum account its tBTC node uses to pay transaction fees. The incident was unrelated to the kernel flaw, the node was already offline, and the operator found no evidence that signing key material was accessed. The tBTC bridge lets Bitcoin holders bring BTC into DeFi, with deposited Bitcoin secured by groups of network operators. The pause blocks new conversions into and out of the token through the bridge. Threshold said tBTC continues to transfer normally on Ethereum and Layer 2 networks. It said it found no evidence that the kernel vulnerability was used to exploit a tBTC node. It said tBTC remains fully backed and that it had seen no unauthorized minting or movement of Bitcoin. The flaw, CVE-2026-98432, affects the Linux kernel IPv4 networking subsystem. Red Hat rates it critical in an advisory and says an unauthenticated remote attacker could exploit it to execute code without user interaction. Systems accepting inbound TCP connections are most directly exposed, according to the advisory. The fee-paying account is separate from the collective signing process required to move bridge Bitcoin. Threshold documentation says 51 of the 100 signers for a wallet must collaborate to produce a signature. Threshold reiterated that no single operator can move the funds. Bitcoin balances independently checked by The Defiant were enough to cover the Ethereum token supply. Six large wallets identified in the Threshold explorer held a combined 4,320.33 BTC, calculated from confirmed balances in mempool.space Bitcoin records. Etherscan showed total Ethereum supply of 4,185.16 tBTC during reporting. The Aave Ethereum Core tBTC reserve remained frozen, with about $136.3 million supplied, according to its interface. Aave froze the reserve on Oct. 31 after Threshold paused the bridge. The freeze blocks new tBTC deposits and additional borrowing against the token. Repayments, withdrawals and liquidations continue, according to Aave risk service provider LlamaRisk. The freeze does not change health factors for existing positions or trigger liquidations, LlamaRisk said. It plans to propose restorative measures once it is assured that tBTC operations have returned to normal. Threshold first announced the bridge pause on Oct. 30. It has warned users not to send BTC to previously generated deposit addresses or repeat pending transactions. Deposits and redemptions already in progress will complete after operations resume. Threshold gave no restart time in its latest update. It said bridge functionality would resume once security maintenance was complete and nodes were back online on patched systems. It promised another update within 24 hours, or sooner if anything changes.