Threshold Says tBTC Is Fully Backed After Aave Freeze

Threshold Network said on 1st November 2026 that tBTC remained fully backed following its precautionary bridge pause and Aave's earlier restriction on the asset. In its security update, the project said it had detected no unauthorised creation of tBTC or movement of Bitcoin (BTC).

Threshold reported about 4,320 BTC in bridge wallets against roughly 4,185 tBTC in circulation at the time. Those are the project's figures, dated 18:47 UTC on 1st November. Its documentation describes tBTC as a bridge between Bitcoin and decentralised finance, allowing Bitcoin holders to use the asset in applications such as lending.

Maintenance And A Separate Operator Incident

Threshold said its node operators, which run the computers supporting the bridge, had either installed fixes or taken their nodes offline as a precaution against a reported Linux kernel vulnerability, a flaw in the operating system's core. It said it had found no evidence that the vulnerability had been used to exploit a tBTC node.

The same update reported a separate incident earlier that day. According to Threshold, one operator's account for paying Ethereum (ETH) transaction fees had been drained of about 0.5 ETH in a wider infrastructure breach. Threshold described that incident as unrelated to the kernel vulnerability and said the operator's tBTC node was already offline when it happened.

Threshold said the operator had found no evidence that its signing key material, used to authorise transactions, had been accessed. The project said a majority of independent operators must approve a Bitcoin transaction from a tBTC wallet, so one operator alone cannot move those funds.

Its update tied the return of bridge functionality to completed security maintenance and nodes operating on patched systems. It did not announce that minting and redemptions had resumed.

What Aave's Earlier Freeze Changed

Aave's 31st October transaction froze Ethereum Core tBTC at 10:01:11 UTC and set its collateral loan-to-value ratio to zero. That ratio limits borrowing relative to the value of pledged assets. The transaction retained the 78% liquidation threshold, the percentage used to assess whether collateral adequately covers an existing debt.

LlamaRisk said in its governance response, dated 31st October, that the action aimed to stop Aave's exposure to tBTC growing during the pause. It said the restriction applied only to Ethereum Core tBTC; its Base and Arbitrum reserves had been frozen in earlier deprecation rounds.

Our earlier Aave report covers the wider market freezes and proposed borrowing-rate relief.

Aave's freeze documentation distinguishes blocking new deposits and borrowing from blocking every operation. Repayments, withdrawals and liquidations remain possible under a freeze. Withdrawals depend on available liquidity and must leave outstanding borrowing sufficiently supported.

Retaining a liquidation threshold does not keep a loan's health factor, Aave's measure of collateral coverage, constant. Its liquidation guide explains that changes in collateral value or debt can alter that measure. Our guide to borrowing and control in DeFi explains how collateral and administrator permissions affect lending positions.

In its 31st October response, LlamaRisk said it would propose restorative measures after receiving assurance that Threshold's operations had returned to normal. Threshold's later backing statement did not announce an Aave unfreeze.