Threshold Network’s tBTC bridge began resuming onchain operations after a nine-day security pause, but the restart did not yet restore normal access for users. An Aave reserve holding about $120 million in tBTC also remained frozen to new deposits and additional borrowing power.
As reported by Cointelegraph on Nov. 9, 2026, at 12:03:08 UTC+8, the recovery depended on security-patched node operators reconnecting to the network.
What the restart means for bridge users
Threshold said on Sunday that the bridge’s underlying network was restarting. Its independent node operators collectively authorize Bitcoin movements and process deposits and redemptions.
Requests submitted before the shutdown were expected to be processed as more operators returned. However, the app would not accept new deposits, minting or redemptions until enough nodes were online. Threshold did not announce a restart date for those functions.
The distinction matters for users: the underlying network resuming activity did not mean the app was ready to accept new requests.
What remains restricted on Aave
Aave froze its tBTC reserve on Ethereum Core on Oct. 31 to prevent additional exposure while bridge redemptions were unavailable.
The freeze blocks new tBTC deposits and prevents the token from adding borrowing power. Existing users can still withdraw and repay loans.
Aave risk provider LlamaRisk said it would propose restoring the reserve after Threshold’s operations returned to normal. That left the reserve’s reopening dependent on a further step, rather than following automatically from the network restart.
Why the bridge paused
Threshold initially halted the bridge on Oct. 30 while operators addressed a critical Linux kernel vulnerability that could allow remote attackers to execute code on unpatched servers. The project said it found no evidence that the vulnerability had been exploited against tBTC nodes.
Threshold also reported that roughly 4,320 BTC remained in bridge wallets against about 4,185 tBTC in circulation, with no unauthorized Bitcoin transfers or token minting detected.