Threshold says bridge holding about 4,320 bitcoin remains paused over Linux flaw

When a service that lets bitcoin holders carry their coins into other markets shuts its door, those holders lose the easy way in and the easy way out until it reopens. That is where users of tBTC have been since at least Oct. 31, when Threshold said new deposits, mints and redemptions "remain paused," and on Sunday Threshold Network said the bridge stays shut until its operators finish patching servers [1].

A bridge, here, is a system that takes bitcoin on one blockchain and issues a matching token on another. tBTC is that token: Threshold's stand-in for bitcoin on Ethereum, meant to be worth one bitcoin each.

What Threshold said

"tBTC remains fully backed, and no funds have been lost," Threshold Network said in a post on X at 1:47 p.m. ET Nov. 1. "About 4,320 BTC sits in the bridge wallets against roughly 4,185 tBTC in circulation, and we've seen no unauthorized minting or movement of BTC" [1].

The post gives a reason for keeping the bridge closed. "As a precaution against a recently disclosed Linux kernel vulnerability (CVE-2026-98432), which can allow remote code execution on unpatched servers, every tBTC node operator has either patched their servers or taken their nodes offline until a fixed kernel is available," it said. Le Coin could not independently confirm that vulnerability listing. The kernel is the core of the Linux operating system; remote code execution means an outsider could run commands on a machine. "So far, we have not found evidence that this vulnerability was used to exploit any tBTC node," Threshold said [1].

The mechanism

Threshold's bridge depends on node operators, independent parties that run the servers holding shares of the keys to the bitcoin. "tBTC wallets require a majority of independent operators to sign any Bitcoin transaction, so no single operator can move funds," the post said [1]. If enough of those servers are offline for patching, the bridge cannot process new deposits or withdrawals.

Threshold set the condition for reopening, not a date. "Bridge functionality will resume once security maintenance is complete and nodes are back online on patched systems," it said, adding: "We'll post the next update within 24 hours, or sooner if anything changes" [1]. That puts the next promised update at about 1:47 p.m. ET today, Nov. 2.

The evidence

The post reported a separate matter, which Threshold kept apart from the bridge's backing. Its "no funds have been lost" line sits in the paragraph about the bitcoin in the bridge wallets. Lower down, Threshold said that earlier on Nov. 1, "one node operator reported a security incident in its broader infrastructure, unrelated to the kernel vulnerability, in which the Ethereum account its tBTC node uses to pay transaction fees was drained of about 0.5 ETH." It added that "the operator's tBTC node was already offline at the time, and the operator has found no evidence that its signing key material was accessed" [1].

Figure 1. tBTC's backing, by Threshold's count

Sources: Threshold post on X, 1:47 p.m. ET Nov. 1, 2026 [1]. Dollar values are Le Coin calculations at a bitcoin price of $77,548, Powered by CoinGecko API, as of 8:21 a.m. ET Nov. 2 [2]. The difference is Le Coin's arithmetic on Threshold's rounded figures.

On Threshold's numbers, the bitcoin in the bridge exceeds the tBTC issued against it by about 135 coins. Threshold's figures are rounded, and its post points readers to an on-chain explorer to check them [1].

The backing figures match the Threshold post of 1:51 p.m. ET Oct. 31 that the Nov. 1 post quotes, which said 4,320 BTC sat in the bridge against roughly 4,185 tBTC [1].

The objection

Threshold's case is that nothing has gone wrong: the coins are there, the vulnerability has not, so far as it has found, been used against its nodes, and the operator incident involved about 0.5 ETH on a node that was already offline. A cautious shutdown, on that reading, is the system working.

The counterpoint is in the same post. A bridge that pauses whenever enough operators must patch at once depends on how fast its operators can patch, and the operator incident shows that operators' wider systems matter too.

The tell (Le Coin's view)

Le Coin's view: The number to watch is not the 4,320. It is the next update. Threshold has tied reopening to a condition it controls only in part, since operators need "a fixed kernel" before some nodes come back. Today's post should say how many operators are back on patched systems. If it does not, the pause is open-ended by Threshold's own terms.

Stop

Threshold Network says tBTC remains fully backed and no funds have been lost. Its bridge stays paused until node operators are back online on patched systems. The next update is promised by about 1:47 p.m. ET today.

Sources

1. Threshold Network (@TheTNetwork), "tBTC pause and security update," post on X, Nov. 1, 2026, 1:47 p.m. ET. https://x.com/TheTNetwork/status/2116965471157203243
2. Powered by CoinGecko API, bitcoin price, Nov. 2, 2026, 8:21 a.m. ET. https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd&include_last_updated_at=true

Holding the Corner.

Not financial advice.