Threshold Says All tBTC Operators Patched or Went Offline Over Linux Kernel Flaw

Every tBTC node operator has either patched its servers or taken its nodes offline in response to a Linux kernel vulnerability, Threshold Network said on Nov. 1, even as new minting and Bitcoin redemptions on the bridge remain paused.

The same security update disclosed a separate incident in one operator's wider infrastructure, in which roughly 0.5 ETH was drained from the Ethereum account that the operator's tBTC node uses to cover transaction fees. Threshold said the incident was unrelated to the kernel flaw, that the node was already offline, and that the operator had found no evidence its signing key material was accessed.

The tBTC bridge enables Bitcoin holders to move $BTC into DeFi, with deposited Bitcoin secured by groups of network operators. Minting refers to the creation of new tBTC when Bitcoin is deposited into the bridge, while redemption is the process by which holders have their underlying Bitcoin released back to them. While the pause stops new conversions into and out of the token via the bridge, Threshold notes that tBTC is still transferring normally across Ethereum and Layer 2 networks.

No Evidence of Node Exploitation

Threshold reported no indication that the kernel vulnerability had been used against a tBTC node, adding that “tBTC remains fully backed” and that it had observed no unauthorized minting or movement of Bitcoin.

Loading post from X…

The flaw, tracked as CVE-2026-98432, sits in the Linux kernel's IPv4 networking subsystem. Because the kernel is the core of the operating system, remediating a flaw at this level requires patching the operating system itself on each affected server, a process that generally calls for taking machines offline. Red Hat's advisory rates it critical, warning that an unauthenticated remote attacker could exploit it to execute code with no user interaction required; systems accepting inbound TCP connections face the greatest direct exposure.

The drained fee-paying account stands apart from the collective signing process needed to move bridge Bitcoin. Threshold's technical documentation specifies that 51 of a wallet's 100 signers must cooperate to produce a signature. Threshold reiterated that no single operator can move the funds.

Independent checks by The Defiant found Bitcoin balances sufficient to cover the Ethereum token supply. Six large wallets identified in Threshold's explorer held a combined 4,320.33 $BTC, based on confirmed balances in mempool.space's Bitcoin records, while Etherscan showed a total Ethereum supply of 4,185.16 tBTC at the time of reporting.

Aave Restrictions Remain in Place

On the DeFi side, Aave's Ethereum Core tBTC reserve remained frozen with roughly $136.3 million supplied, according to its interface. The lending protocol froze the reserve on Oct. 31 following Threshold's bridge pause.

LlamaRisk, Aave's risk service provider, said the freeze bars new tBTC deposits and additional borrowing against the token, while repayments, withdrawals and liquidations continue. It added that the freeze does not alter existing positions' health factors or trigger liquidations, and that it intends to propose restorative measures once it has assurance that tBTC operations have returned to normal.

Threshold first announced the bridge pause on Oct. 30 and has cautioned users against sending $BTC to previously generated deposit addresses or repeating pending transactions. Deposits and redemptions already in progress will complete once operations resume, it said.

The latest update offered no restart timeline, stating that bridge functionality would return only after security maintenance is complete and nodes are back online on patched systems. Threshold committed to another update within 24 hours, or sooner if conditions change.