Threshold Network says its tBTC bridge is running again onchain after a nine-day shutdown, but the bitcoin backing the token had not moved by Monday morning. Node operators are reconnecting on patched servers, the project said late on Sunday, and deposits, mints and redemptions will restart once enough of them are back. Until then the bridge app stays off, and users with requests stuck since October 30 are still waiting.
What Threshold said
“The tBTC bridge has resumed onchain following the completion of security maintenance,” Threshold said on Sunday. “Node operators are reconnecting on patched systems, and the bridge will return to full operation as more of them come back online.”
The project said redemption requests and deposits made before the pause “remain safe and will be processed as operators reconnect.” It repeated that about 4,320 BTC sits in the bridge wallets against roughly 4,185 tBTC in circulation. It also told users not to send BTC to a deposit address generated before the pause or to resubmit a pending transaction. Once the app is back, users should start a new deposit instead of reusing an old address. Threshold said it will post again when the interface is fully re-enabled.
On Friday, Threshold had said it expected operators to begin reconnecting from about midnight UTC on Saturday, pending final security checks. Sunday’s post is the first to say the bridge itself is running. The project has not said how many operators are online or how many it needs before the app reopens.
A kernel bug, not a hack
When AltcoinReporter first covered the pause on October 31, Threshold had described it only as security maintenance. The next day it named the cause: a recently disclosed Linux kernel vulnerability, CVE-2026-98432, that can allow remote code execution on unpatched servers. Every tBTC node operator either patched or took its node offline, and Threshold said it found no evidence the flaw was used against any tBTC node.
The same update disclosed a separate problem. One operator reported an incident in its wider infrastructure, unrelated to the kernel bug, in which the Ethereum account its tBTC node uses to pay transaction fees was drained of about 0.5 ETH. Its node was already offline, and the operator found no evidence its signing key material was accessed. That node stayed offline as a precaution.
The reason a single compromised server is not fatal is the bridge’s design. “tBTC wallets require a majority of independent operators to sign any Bitcoin transaction, so no single operator can move funds,” Threshold said. The flip side is that the bridge cannot move bitcoin at all until enough of those operators are back. In a November 2 update the project said interim fixes such as packet filtering reduce the risk but do not remove it. Operators had to rebuild on Linux distributions that already shipped the fix, or wait for Ubuntu’s official kernel patch.
What the chain shows
AltcoinReporter rechecked the numbers on Monday. The tBTC contract on Ethereum reported a supply of 4,185.165 tBTC, almost unchanged from 4,185.155 on October 31.
On the Bitcoin side, the 56 wallet addresses that Threshold’s reserve explorer listed on October 31 still held a combined 4,320.46 BTC, according to the public block explorer mempool.space. That is the same total as nine days ago. The last confirmed transaction touching any of them was a sweep of a 0.01 BTC deposit into the largest wallet, about 75 minutes after the pause began on October 30. Nothing has moved since. One caveat: any wallet created after October 31 would not be on that list.
In practice, “resumed onchain” has not yet meant bitcoin going out to redeemers. The first sweeps of pending deposits and the first redemption payouts will be the clearest sign that the signing groups are working again.
Aave’s freeze and the exit so far
The pause has already changed where tBTC sits. Aave froze its tBTC market on Ethereum Core on October 31 after a recommendation from risk manager LlamaRisk. Users can still repay and withdraw, but they cannot supply new tBTC. The supply of Aave’s tBTC receipt token has since fallen to about 1,596.9, worth roughly $119 million at Monday’s price, from about 1,757.9 on October 31. That means around 161 tBTC has been pulled out of the market during the shutdown.
LlamaRisk wrote in the Aave governance thread that it would propose restorative measures once Threshold’s operations return to normal. No such proposal had been posted there as of Monday.
The token itself has held up. CoinGecko showed tBTC at $74,330 on Monday against $74,516 for bitcoin, a gap of about 0.25%.
What to watch next
Three things will show whether the restart is real for users. The first is the bridge app coming back, which Threshold has promised to announce. Next come bitcoin transactions from the reserve wallets, which would mean redemptions are being paid. The third is a move by LlamaRisk to unfreeze tBTC on Aave. A full account of what the maintenance changed would also help: Threshold has said which vulnerability it patched against but has not published a post-incident report.
FAQ
Was any tBTC or bitcoin lost? Threshold says no. It reports no funds lost and no unauthorized minting, and AltcoinReporter’s checks found the listed reserve wallets unchanged at about 4,320 BTC against about 4,185 tBTC in supply.
Can I mint or redeem tBTC now? Not through the app yet. Threshold says the interface returns once enough node operators are online, and requests made before the pause will be processed as operators reconnect. Do not send BTC to an old deposit address.
Why did the pause last nine days? Bitcoin held by tBTC can only move when a majority of independent operators sign. Operators had to patch or rebuild their servers against a Linux kernel vulnerability, and the bridge could not run until enough of them were back.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
