Threshold Network’s tBTC bridge is back online after a nine-day security pause, but key constraints remain for users: an Aave Ethereum reserve holding about $120 million worth of tBTC is still frozen, preventing new deposits and fresh borrowing against the token. The development matters for anyone using tBTC as “institutional BTC” access to DeFi because the bridge’s restart does not immediately restore the full liquidity and leverage pipeline around the asset.
On Sunday, Threshold said the bridge’s underlying network restarted after security-patched node operators reconnected. These independent operators authorize Bitcoin movements and handle tBTC deposits and redemptions, but Threshold also warned that the application will not accept new deposits—or mint and redeem tBTC—until enough operators are online.
Key takeaways
- Threshold resumed onchain bridge operations after a nine-day pause tied to a Linux kernel vulnerability.
- The bridge app will not accept new deposits or redemptions until sufficient node operators are reconnected; Threshold did not provide a specific restart timeline.
- Aave has frozen its tBTC reserve on Ethereum, limiting new tBTC inflows and borrowing even as the bridge restarts.
- Threshold reported no evidence of unauthorized Bitcoin transfers or tBTC minting, and said it expects pre-pause requests to process as operators return.
Bridge restart depends on operator quorum
Threshold’s tBTC bridge relies on a decentralized set of independent node operators that collectively authorize Bitcoin movements and process deposits and redemptions. In its Sunday update, the project attributed the restart to security-patched operators reconnecting to the network, restoring the bridge’s ability to process onchain activity.
However, the return to operation comes with a practical bottleneck. Threshold said requests submitted before the shutdown are expected to be processed as more operators come back online. At the same time, it clarified that the bridge application will not accept new deposits or run minting and redemptions until enough operators are connected to meet the operational needs of the system.
Threshold did not specify when the bridge app will reopen for new activity, leaving users to watch for gradual capacity restoration as additional nodes return.
Why the pause happened: patched Linux vulnerability
Threshold initially halted the bridge on Oct. 30 after operators addressed a critical Linux kernel vulnerability that could enable remote attackers to execute code on unpatched servers. According to Threshold, the team found no evidence that the flaw had been exploited against tBTC nodes during the period leading up to the halt.
The nine-day pause and subsequent restart underscore the operational security assumptions that underpin token bridges. While the bridge’s token issuance and redemption ultimately occur onchain, its safety depends on the integrity and patch status of the infrastructure operated by the network’s independent validators.
Aave reserve still frozen, limiting DeFi functionality
The bridge’s restart does not fully restore tBTC’s usability in the same way it did before the security incident. On Oct. 31, Aave froze its tBTC reserve on Ethereum Core to prevent additional exposure while redemptions were unavailable. That restriction prevents new tBTC deposits into the reserve and stops the token from adding borrowing power through Aave markets.
Importantly, the Aave freeze is not a blanket lockout of all user actions. The restriction stops new supply and borrowing against tBTC, while existing users can still withdraw and repay loans.
In addition, Aave’s reserve freeze is tied to risk controls rather than the bridge restart alone. Aave risk provider LlamaRisk said it would propose restoring the reserve after Threshold’s operations return to normal, suggesting the reserve will remain constrained until the bridge reaches stable, post-pause conditions.
Reported bridge balances and monitoring status
Threshold said it is monitoring both custody and token supply consistency. The project reported that roughly 4,320 BTC remains in bridge wallets against about 4,185 tBTC in circulation, and it stated there is no detection of unauthorized Bitcoin transfers or token minting during the pause period.
That mismatch—wallet BTC exceeding circulating tBTC—does not necessarily indicate wrongdoing by itself, since bridge flows can be in different stages between deposit, minting, and redemption. In this case, Threshold’s emphasis on the absence of unauthorized activity is intended to reassure users that the system remained intact while operator vulnerabilities were mitigated.
Still, for users relying on tBTC liquidity, the main issue is access timing: even if bridge infrastructure is restarting, Aave’s reserve freeze means borrowing demand and new capital inflows may remain muted until both the bridge app and the Aave reserve constraints are lifted.
What to watch next
Traders and DeFi participants should watch for two signals: when Threshold indicates enough node operators are online to resume accepting new deposits and minting/redemptions, and whether Aave (via governance and risk review) moves to restore the tBTC reserve after bridge operations normalize. Until then, the restart improves system health, but the biggest liquidity and leverage bottlenecks for tBTC users appear to persist on the Aave side.
