Threshold Network said on Oct. 31 that it had suspended minting and redemptions for tBTC as it responds to CVE-2026-98432, a recently disclosed critical vulnerability in the Linux kernel.
tBTC is a cross-chain asset backed 1:1 by BTC and is used to bring Bitcoin into ecosystems such as Ethereum for DeFi activity including lending and liquidity mining. With both minting and redemption paused, users cannot complete the standard two-way conversion between BTC and tBTC for now.
In an additional statement released on Nov. 2, Threshold said tBTC remains fully backed and that no loss of funds has occurred.
Reserve data still exceeds circulating supply
According to the project, wallets associated with the Threshold bridge hold about 4,320 BTC, worth more than $330 million. Circulating tBTC stands at about 4,185, leaving reserves ahead of supply by roughly 135 BTC.
The team also said it has not found any record of unauthorized tBTC minting or transfers.
After Threshold published its notice, Aave said it had paused new tBTC deposits and borrowing. Data shown on Aave's website indicated that total tBTC reserves were worth about $137 million and were frozen.
Linux kernel bug was the immediate trigger
Threshold linked the suspension directly to CVE-2026-98432, a flaw recently disclosed in the Linux kernel.
Red Hat said in a security advisory published on Oct. 30 that the bug affects the Linux kernel's IPv4 network subsystem. It is a Use-After-Free vulnerability rated "Important." During concurrent handling of TCP connection requests, a race condition between memory release and access could let an attacker trigger memory corruption through crafted network requests and potentially achieve remote code execution. The attack path does not require local server privileges or user interaction.
Anthropic said in research disclosed on Oct. 27 that one of its internal AI models had successfully built an exploit for the vulnerability. According to that disclosure, the exploit achieved remote code execution on Linux servers running a Multipath TCP, or MPTCP, listening service and obtained a Root Shell, without prior server login credentials and without any action from the server administrator.
tBTC relies on distributed node operators to jointly manage Bitcoin reserves tied to the bridge. If an attacker were to target the servers used by those operators, they could try to steal sensitive information from the machines, disrupt node operations, or look for a way to obtain signing authority. If enough nodes were compromised, the security of the bridge could come under threat and user assets could be put at risk.
Threshold says the move is precautionary
Threshold said all tBTC node operators have either applied security patches to their servers or temporarily taken nodes offline while waiting for kernel versions with fixes. The team added that it has not found any evidence that the vulnerability has been used to attack tBTC nodes.
The project described the halt as a preventive measure rather than an emergency response after a confirmed breach. Pausing minting and redemptions is meant to avoid processing new cross-chain asset operations before node infrastructure completes security maintenance.
Threshold's security report published the same day also said that about 0.5 ETH was transferred out of an Ethereum account used by one node operator to pay transaction fees for tBTC node activity. The report said that incident was unrelated to the Linux kernel flaw, that the relevant node was already offline at the time, and that the operator found no evidence that signing key material had been accessed.
On Threshold Network, the account used to pay fees is separate from the collective signing process required to move bridged Bitcoin. According to the project's documentation, moving tBTC requires cooperation from 51 out of 100 signers to generate a signature, meaning no single operator can move funds alone.
Liquidity discount risk is now in focus
Based on the reserve figures, 4,320 BTC backing about 4,185 tBTC implies a reserve coverage ratio of about 103.2%, with an excess buffer of roughly 135 BTC on paper.
Still, full reserves do not mean holders can redeem at any time. Under normal conditions, users can convert tBTC back into BTC through the protocol. While redemptions are paused, they can only seek liquidity in the secondary market. Even without losses in the underlying collateral, restricted exit routes can create a liquidity discount.
As of publication, tBTC had not shown a clear depeg. CoinGecko data showed tBTC at about $78,460, while BTC on Binance was about $78,520, putting tBTC at a discount of roughly 0.11% to BTC and still broadly in line with its peg.
Quoted aggregate prices do not necessarily reflect execution for larger trades, especially with the redemption channel shut. On-chain depth and slippage remain relevant. Uniswap data showed that 1 tBTC could be swapped for 78,437 USDT or 78,360 USDC as of publication, with ETH-denominated pricing in roughly the same range.
No reopening date yet
For Threshold, the issue now is not limited to patching node servers. The protocol also has to manage liquidity risk during the suspension.
As of publication, Threshold had not announced a specific timeline for restoring service. The team said only that the bridge would reopen after security maintenance is completed, nodes return to operation, and systems are confirmed to be running patched software. For now, the absence of any reported fund loss remains the central point in the project's update.
