Threshold Pauses tBTC Minting and Redemptions After Linux Flaw
Threshold Network has paused tBTC minting and redemptions while it carries out security maintenance following disclosure of Linux kernel vulnerability CVE-2026-98432. The flaw could enable remote code execution on vulnerable servers. Threshold says tBTC node operators have patched their systems or taken nodes offline, with no evidence the vulnerability was used to attack the network.
Threshold reports about 4,320 BTC in reserves against roughly 4,185 tBTC in circulation, a coverage ratio of around 103.2%. It has found no reserve losses or unauthorised tBTC minting. Separately, about 0.5 ETH was taken from an operator’s fee-paying account; the operator said its node was offline and found no evidence that signing keys were accessed. Threshold says moving bridge reserves requires signatures from a majority of independent operators, so a single operator cannot transfer the BTC alone.
Aave has also paused new tBTC deposits and borrowing. Although tBTC was trading near BTC, at about a 0.11% discount at the time reported, protocol redemptions remain unavailable, leaving holders exposed to secondary-market liquidity and slippage risks. Threshold initially said it would provide an update within 24 hours, but has not announced a reopening date; services are expected to resume after security work is complete.
Bearish
The pause is a short-term negative for tBTC because holders cannot redeem through the protocol, and the security uncertainty may weaken confidence and increase selling or discount risk. Aave’s suspension of new tBTC deposits and borrowing also reduces utility and available DeFi liquidity. The reported 0.11% discount was modest, but traders should watch the market price against BTC, order-book depth, and slippage while redemptions are unavailable.
The impact may be limited if maintenance is completed promptly. Reserves reportedly exceed circulating tBTC, no unauthorised minting or reserve loss has been found, and the bridge requires signatures from a majority of independent operators. These factors reduce evidence of an active loss or single-operator reserve risk. If Threshold confirms patched infrastructure and reopens redemptions, confidence and the tBTC peg could recover. If the pause is prolonged or new security concerns emerge, a wider discount and weaker demand could persist. Overall, the immediate risk to tBTC is bearish, while the longer-term effect depends on the security review and resumption of redemptions.