Original ｜Odaily Planet Daily (@OdailyChina)
Author｜Golem (@web3_golem)
On October 31, the Bitcoin cross-chain protocol Threshold Network announced the suspension of tBTC minting and redemption functions in response to the recently disclosed high-risk Linux kernel vulnerability CVE-2026-98432.
This news quickly triggered market concerns about the security of tBTC assets. As a cross-chain asset backed 1:1 by BTC, the core value of tBTC lies in enabling Bitcoin to enter ecosystems such as Ethereum to participate in DeFi activities such as lending and liquidity mining. The simultaneous suspension of minting and redemption channels means that users temporarily cannot complete the two-way exchange between BTC and tBTC through the normal process.
On November 2, Threshold Network issued a further statement emphasizing that tBTC remains fully reserve-backed and that no loss of funds has occurred.According to statistics, there are approximately 4,320 BTC in the Threshold Network cross-chain bridge wallet, worth more than $330 million, while the circulating tBTC is approximately 4,185, with reserves exceeding circulation by about 135 BTC. The team has also not found any unauthorized tBTC minting or transfer records.
tBTC minting and redemption on the Threshold Network official website have been suspended
However, after Threshold Network's announcement was released, Aave announced the suspension of new tBTC deposits and borrowing. Aave's official website shows that the total reserve value of tBTC is approximately $137 million and is currently frozen.
Preventive avoidance of CVE-2026-98432 exploitation
The direct cause of this suspension of tBTC minting and redemption is the recently disclosed Linux kernel vulnerability CVE-2026-98432.
According to a security advisory released by Red Hat on October 30, the vulnerability exists in the IPv4 network subsystem of the Linux kernel, is a Use-After-Free vulnerability, and has been rated as "critical." During the concurrent processing of TCP connection requests, due to a race condition between memory release and access, an attacker may trigger memory corruption through carefully crafted network requests and even achieve remote code execution. This means that an attacker can attempt to launch an attack over the network without obtaining local server privileges or user interaction.
According to research disclosed by Anthropic on October 27, its internal AI model has successfully constructed an exploit for this vulnerability, achieving remote code execution on a Linux server running a Multipath TCP (MPTCP) listening service and obtaining a Root Shell with the highest privileges. The entire process does not require the attacker to obtain server login credentials in advance, nor does it require any action by the server administrator.
tBTC relies on distributed node operators to jointly manage the cross-chain Bitcoin reserves. Attackers can target the servers of tBTC node operators and may further attempt to steal sensitive information on those servers, interfere with node operations, or even seek opportunities to obtain node signing permissions. Then, as long as an attacker controls enough nodes, it may threaten the security of the cross-chain bridge, ultimately leading to the theft of user assets.
Threshold stated that, for security reasons, all tBTC node operators have applied security patches to their servers or temporarily taken nodes offline while waiting for a fixed kernel version to be released. At present, the team has not found any evidence that the vulnerability has been used to attack tBTC nodes.
Threshold's action this time is a preventive measure rather than emergency stop-loss after confirming an attack. The suspension of minting and redemption is mainly to avoid continuing to process new cross-chain asset operations while node infrastructure has not yet completed security maintenance.
However, today's Threshold security report stated that about 0.5 ETH was transferred out of an Ethereum account used by a node operator to pay tBTC node transaction fees. But this incident is unrelated to the Linux kernel vulnerability. At the time of the incident, the relevant node was already offline, and the operator also found no evidence that signing key material had been accessed.
On Threshold Network, the account that pays fees is completely different from the collective signatures required to transfer bridged Bitcoin. According to official documentation, transferring tBTC requires 51 of 100 signers to collaborate to generate a signature, and no single operator can transfer funds.
Has tBTC depegged?
From the reserve data, the 4,320 BTC held in reserve by Threshold Network corresponds to about 4,185 circulating tBTC, with a reserve coverage ratio of about 103.2%, leaving an on-paper reserve surplus of about 135 BTC.
But full reserves do not mean users can complete redemption at any time. For holders, under normal circumstances tBTC can be exchanged for BTC through the protocol, while during the suspension of redemption, users can only seek liquidity through the secondary market.This means that even if the underlying assets are not lost, restricted exit channels may still create a liquidity discount.
But as of press time, tBTC has not shown an obvious depeg. CoinGecko shows that tBTC is quoted at about $78,460, while BTC on Binance is quoted at about $78,520. tBTC is currently at a discount of about 0.11% to BTC and still basically maintains its peg to BTC.
It should be noted that aggregated quotes are not equivalent to the actual execution prices of large trades. Especially with the redemption channel suspended, on-chain trading depth and slippage are also worth attention. As of press time, according to Uniswap data, 1 tBTC can be exchanged for 78,437 USDT or 78,360 USDC, and the price is basically the same when exchanged for ETH.
For Threshold, what needs to be solved now is not only the vulnerability repair of node servers, but also avoiding liquidity risk during the suspension period. As of press time, Threshold has not announced a clear recovery time and only stated that it will reopen the cross-chain bridge after completing security maintenance, restoring node operations, and confirming the use of patched systems. But the fact that no loss of funds has occurred is still the most important good news at present.
