tBTC: A Critical Linux Flaw Paused Threshold's Bitcoin Bridge and Froze $136M on Aave

At 22:35 UTC on Friday 30 October 2026, Threshold Network told the people who use its bitcoin bridge to stop. No new deposits, no new tokens, no new requests to turn tokens back into bitcoin. The reason it gave was "security maintenance". It did not say what was being maintained, or why it could not wait.

Nothing had been stolen. Two days later the cause was public, and it was not in Threshold's own code at all. It was in Linux, the free operating system that runs most of the world's servers, and the flaw was serious enough that the people who keep Solana and Cardano running were told to fix their machines urgently too.

A vault, a receipt and 100 key holders

Bitcoin cannot move onto Ethereum, the blockchain where most crypto lending happens. A bridge gets around that. Threshold's bridge holds real bitcoin in wallets on the Bitcoin network and issues tBTC on Ethereum, one token for each coin held, much like a warehouse receipt for gold. Anyone holding tBTC can lend it, borrow against it or hand it back to the bridge for real bitcoin.

The bitcoin is not held by Threshold the company. Each bridge wallet is controlled by 100 independent operators running Threshold's software on their own servers, and 51 of them must agree before any coin moves, according to Threshold's documentation. It is like a bank vault that opens only when 51 of 100 key holders turn their keys together. On 26 October Threshold said tBTC had carried $5.2 billion across the bridge in six years.

That design spreads the risk across 100 machines. It also means the bridge is only as safe as the operating systems those 100 machines run.

The flaw

The Linux kernel, the core of the operating system, gave the bug the number CVE-2026-98432 and published it on 15 October 2026. The official record, issued by the Linux kernel's own team, scores it 9.8 out of 10 on CVSS, the industry's standard severity scale. Few bugs score higher.

The fault sits in the code that answers the first knock of a new internet connection. In rare timing conditions, the system goes on using a piece of memory after it has already handed that memory back, the way a clerk might keep reading from a form that has been shredded and replaced with someone else's. In the worst case, that lets an outsider take over the machine. AlmaLinux, which publishes one of the main free versions of Linux for servers, said on 30 October that the flaw can be used over the network with no password and no action by the victim, and that it dates back to Linux version 4.4, released in early 2016. Eric Dumazet wrote the fix, AlmaLinux said, and fixes reached the official kernel in mid October.

The loudest claim about the bug concerns who built the first working attack on it. On 27 October the Frontier Red Team at Anthropic, the company that makes the Claude AI models, published a post saying that "after initial prompting, Claude wrote an exploit" for a flaw in Linux's networking code. The post said the work used an unreleased internal research model, and that the exploit let a remote attacker run any command as the system's top-level administrator on Linux servers that use multipath TCP, a feature that lets one connection travel over several network routes at once. The post does not say how this particular bug was first found. The Go programming language's security team and AlmaLinux both tied the Anthropic post to CVE-2026-98432 in their own advisories. Go noted that its programs have switched multipath TCP on by default since version 1.24, and both it and AlmaLinux warned that turning the feature off is not a complete fix.

Nobody has reported the flaw being used against a crypto company.

The pause, and the freeze that followed

Threshold's first post, on 30 October, said the pause was "a precaution while security maintenance is completed". Holding, sending and using tBTC were not affected. On 31 October at 17:51 UTC it added that "tBTC remains fully backed and no funds have been lost", with 4,320 BTC sitting in the bridge wallets against about 4,185 tBTC in circulation, and no unauthorized minting. The Defiant checked the wallets and found the same, 4,320.33 BTC against 4,185.16 tBTC. Neither post named Linux. CryptoSlate noted on 1 November that Threshold had still not identified the issue.

The pause mattered most at Aave, the largest crypto lending market, which works much like a broker's margin account: deposit an asset as collateral, borrow against it. About 1,760 tBTC, worth about $136.6 million and roughly 42% of all tBTC, was deposited on Aave's main Ethereum market, CryptoSlate reported. If the bridge stopped paying out real bitcoin for a long time, that collateral could become harder to sell or price.

LlamaRisk, a risk adviser paid by Aave's members, recommended a pre-emptive freeze, and Aave's guardian, a group of signers with emergency powers, carried it out at 10:01 UTC on 31 October, LlamaRisk wrote on Aave's governance forum. New tBTC deposits were blocked and tBTC stopped counting towards new loans. Existing positions were left alone: holders could still repay and withdraw, and nobody was forced to sell because of the freeze. Aave's own post called it "a routine, proactive step" and said its contracts were not affected. Gauntlet, a firm that manages lending funds, pulled about 65,000 of roughly 704,000 digital dollars from a tBTC loan market on Morpho, another lending service, CryptoSlate reported.

The cause, two days later

On 1 November Threshold said that every tBTC node operator had either patched its servers or taken its node offline in response to the Linux flaw, The Defiant and TokenPost reported. It said it had found no evidence the flaw was used against any tBTC node, and that bitcoin moves only with signatures from a majority of independent operators, so "no single operator can move the funds".

It disclosed one more thing. In a separate incident, someone drained about 0.5 ETH from the Ethereum account one operator uses to pay transaction fees. Threshold said it was unrelated to the kernel flaw, that the node was already offline, and that the operator found no sign its signing keys had been reached.

By then the warning had spread. Intersect, the member body that coordinates Cardano's development, urged stake pool operators, the people who run the computers that record Cardano's transactions, to "install a fixed Linux kernel", TokenPost reported on 31 October. At 00:07 UTC on 2 November Anza, the company that writes Solana's main validator software, posted an alert to validators marked "URGENT" and "Action Required". The Defiant reported that operators on Ubuntu, whose fixed kernel was still being prepared, were told to filter incoming traffic and switch off two networking features in the meantime.