tBTC pause and security update
tBTC remains fully backed, and no funds have been lost. About 4,320 BTC sits in the brid | Hanami
tBTC pause and security update
tBTC remains fully backed, and no funds have been lost. About 4,320 BTC sits in the bridge wallets against roughly 4,185 tBTC in circulation, and we've seen no unauthorized minting or movement of BTC. You can verify the backing on-chain here: https://app.threshold.network/explorer?tab=wallets
As a precaution against a recently disclosed Linux kernel vulnerability (CVE-2026-98432), which can allow remote code execution on unpatched servers, every tBTC node operator has either patched their servers or taken their nodes offline until a fixed kernel is available. So far, we have not found evidence that this vulnerability was used to exploit any tBTC node.
Separately, earlier today, one node operator reported a security incident in its broader infrastructure, unrelated to the kernel vulnerability, in which the Ethereum account its tBTC node uses to pay transaction fees was drained of about 0.5 ETH. The operator's tBTC node was already offline at the time, and the operator has found no evidence that its signing key material was accessed.
tBTC wallets require a majority of independent operators to sign any Bitcoin transaction, so no single operator can move funds.
Bridge functionality will resume once security maintenance is complete and nodes are back online on patched systems.
We'll post the next update within 24 hours, or sooner if anything changes.