Threshold Network has suspended tBTC minting and redemptions after a high-severity Linux kernel vulnerability raised concerns over the security of servers operated by the protocol's distributed signer network. The precaution blocks the protocol's primary route for converting Bitcoin into tBTC and back, leaving holders dependent on secondary-market trading until node operators complete security updates.
The network said on Nov. 2 that it had detected no loss of Bitcoin reserves, unauthorized tBTC minting, or suspicious transfers related to the kernel issue. Bridge wallets held about 4,320 BTC, according to Threshold Network, while approximately 4,185 tBTC remained in circulation. That leaves reserves exceeding issued tokens by roughly 135 BTC, equal to a collateral coverage ratio of about 103.2%.
tBTC is designed to represent Bitcoin on Ethereum-compatible networks without relying on a single custodian. Its security model depends on a distributed set of node operators collectively managing Bitcoin held in bridge wallets. Suspending new minting and redemptions removes the most sensitive operational activity while those operators address the server-level vulnerability.
Linux flaw prompted preventive shutdown
The pause followed disclosures around CVE-2026-98432, a use-after-free vulnerability affecting the Linux kernel's IPv4 subsystem. Red Hat described the issue on Oct. 30 as severe, warning that crafted network requests during concurrent TCP connection handling could potentially result in remote code execution.
A use-after-free flaw occurs when software continues to access a portion of memory after it has been released. Attackers can sometimes exploit the resulting memory corruption to run unauthorized code. In this case, the concern for Threshold was not a weakness in tBTC's smart contracts or Bitcoin reserve design, but the possibility that a vulnerable Linux host could be compromised before it completed a required task.
Anthropic said on Oct. 27 that an internal AI model had produced an exploit capable of gaining remote code execution against a Linux server running a multipath TCP, or MPTCP, listening service. According to Anthropic's account, the exploit resulted in a root shell, granting the highest level of system control, without requiring pre-existing login credentials or administrator interaction.
For a protocol that uses multiple operators to coordinate Bitcoin custody, a remote compromise of an operator's infrastructure could expose sensitive information, interrupt its participation in the network, or create an attempt to obtain signing authority. Threshold said its operators had either applied available mitigations or taken their nodes offline while awaiting fixed Linux kernel versions.
The network said it has found no indication that CVE-2026-98432 was used against any tBTC operator. The shutdown is intended to prevent fresh cross-chain operations from being processed until the operator infrastructure is running patched software and has been reviewed for a return to service.
Bitcoin collateral remains locked
Threshold's reserve figures place the immediate focus on operational access rather than a collateral shortfall. The Bitcoin backing tBTC remains in bridge wallets, while users cannot currently use the protocol to redeem tBTC directly for BTC.
The distinction is practical for token holders. A token can remain fully backed while its normal redemption mechanism is unavailable, and its market price can then depend more heavily on decentralized exchange liquidity and buyer demand. CoinGecko data cited alongside the announcement showed tBTC trading close to Bitcoin, with tBTC priced at about $78,460 and Bitcoin near $78,520, a gap of roughly 0.11%.
That narrow discount suggests the market had not assigned a large immediate risk premium to tBTC at the time of the cited prices. Yet the limited deviation should not be read as a guarantee of stable trading conditions if the pause lasts longer or selling demand increases. Without live protocol redemptions, arbitrage traders cannot readily buy discounted tBTC and redeem it for Bitcoin through Threshold's usual process.
A security report released Nov. 2 also recorded roughly 0.5 ETH leaving an Ethereum account used by one tBTC node operator to pay transaction fees. The report said the event was unrelated to the Linux kernel vulnerability and happened after the relevant node had already gone offline.
Threshold's documentation separates such fee-paying accounts from the collective signing system that controls bridged Bitcoin. Moving Bitcoin from tBTC bridge custody requires approval from 51 of 100 signers, according to the protocol's documentation. A compromise of one operator or an account used for gas payments would therefore not, by itself, authorize a movement of reserve Bitcoin.
Aave restricts tBTC activity
Aave has also frozen new tBTC deposits and borrowing connected to the asset. Its interface showed roughly $137 million worth of tBTC reserves locked in the lending protocol.
The restriction prevents users from opening fresh tBTC-backed positions or adding new tBTC supply while direct redemptions remain closed. Existing positions are subject to Aave's established risk parameters, but the halt reduces the chance that new lending activity builds around an asset whose primary conversion channel is temporarily unavailable.
The response reflects a familiar risk-management problem for wrapped or bridged assets: collateral may remain intact, while a disruption to minting, redemption, or custody operations can affect liquidity and the ability to settle price differences across markets. Lending protocols generally treat those operational constraints as relevant even when no direct loss has occurred.
Threshold has not set a timetable for reopening minting and redemption. The network said services will resume after security work is complete and operators have been confirmed to be running patched systems.
Until then, tBTC holders seeking to exit into other assets would need to rely on secondary-market venues rather than direct Bitcoin redemption. The reserve surplus and 51-of-100 signing threshold provide evidence that the bridge's collateral controls remain in place, while the shutdown shows that those controls also depend on the security of the operators running the systems behind them.
While tBTC redemptions pause, explore secure centralized alternatives and deep liquidity on Toobit’s crypto markets today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
