Threshold Restarts tBTC Bridge; Aave Freezes About $120M in tBTC

By Nathan Brooks

Threshold Network said it had begun gradually resuming on-chain operations of the tBTC bridge after a security patch, while about $120 million in tBTC remained frozen in Aave’s Ethereum Core market.

Cointelegraph reported the restart on Nov. 9, nine days after Threshold halted the bridge on Oct. 30 in response to a critical Linux kernel vulnerability that could permit remote code execution. Threshold said: “There was no evidence the vulnerability had been exploited against tBTC nodes.”

The tBTC bridge allows Bitcoin to be used on other blockchains. Independent node operators jointly approve Bitcoin transfers and process deposit and redemption requests. Operators that applied the patch began rejoining the network, allowing a staged restart rather than an immediate return to every bridge function.

What does this change for tBTC users?

The restart leaves three distinct operating conditions:

• Queued requests: Previously submitted transaction requests will be processed sequentially as node operators return online.
• New bridge activity: New deposits, tBTC minting and redemptions remain restricted until a sufficient number of nodes are fully back online.
• Full restoration: Threshold did not disclose when full service would be restored.

For users, the bridge has resumed a transaction path but not its normal operating model. Submitted requests remain in sequence, while prospective depositors and redeemers still face access limits. The practical constraint is sufficient node participation; the restart does not restore deposit, issuance and redemption capacity.

Aave keeps its risk controls in place

Aave froze tBTC reserves in its Ethereum Core market on Oct. 31, one day after the bridge suspension, to contain risks tied to the shutdown.

• Reserve exposure: The market holds about $120 million in tBTC, and the reserves remain frozen.
• New exposure: New deposits and additional borrowing against tBTC collateral remain restricted.
• Available actions: Existing users can still withdraw assets and repay loans.

LlamaRisk, Aave’s risk-management provider, plans to propose lifting the reserve restrictions once bridge operations are fully restored. The distinction matters: the plan is to propose a change, not to remove the limits immediately, and full bridge restoration is the stated condition. The gradual restart alone therefore does not release Aave’s controls.

The reserve checks remain clean

Threshold said its bridge wallet currently holds about 4,320 BTC, while about 4,185 tBTC are in circulation. It has found “no signs of unauthorized Bitcoin transfers or irregular token issuance” involving the 4,185 tBTC.

The checks address the immediate integrity risks posed by the suspension: Bitcoin moving out of the bridge wallet without approval and tokens issued irregularly. Threshold still limits new deposits, minting and redemptions until enough nodes are fully online, so the findings do not establish that the bridge has returned to normal capacity.

The security issue also remains distinct from an exploit. The Linux kernel flaw created a potential remote-code-execution path, but Threshold reported no evidence that attackers used it against tBTC nodes. Its response was to stop the bridge on Oct. 30, require a patch and bring independent operators back in stages.

For market participants, the next test is operational: whether enough nodes return, the request backlog clears and full functionality is restored. Only after that condition is met can LlamaRisk advance its planned proposal to Aave.

Threshold has disclosed no restoration deadline; until the stated condition is met, Aave’s reserve freeze, covering about $120 million, and its deposit and borrowing limits stay in place.