Threshold Network suspended tBTC operations without disclosing the specific security issue or setting a reopening date, but stated existing tBTC remains transferable across Ethereum and layer-2 networks

Overview Debates Related claims Topics Sources

Cc9f267dcNews eventClaim

Aave's guardian multisig froze new deposits and borrowing on its Ethereum V3 Core tBTC reserve

Risk manager Gauntlet placed the tBTC-backed market on Gauntlet's emergency exclusion list and withdrew approximately 65,000 USDC from Gauntlet's Ethereum Morpho USDC Core vault on October 31, 2026

THORChain's emergency pause halted trading on chains including Tron, Ethereum, and Bitcoin, temporarily preventing further laundering by the October 29, 2026 Binance hackers

Threshold Network stated on October 31, 2026 that no funds were lost and investigators found no unauthorized token minting on the tBTC bridge

The FBI published a sanctions list of 608 Ethereum, 19 Bitcoin, and 1 Solana address tied to the October 29, 2026 Binance hack, specifically urging DeFi platforms, node operators, THORChain THORNode operators, and RPC nodes to block them

Aave risk service provider LlamaRisk recommended the immediate freeze of tBTC on Aave's Ethereum V3 Core market following Threshold Network's operational suspension

Aave's freeze on its Ethereum V3 Core tBTC reserve allows existing users to continue repaying loans, withdrawing eligible collateral, and executing liquidations under existing risk parameters

Threshold Network reported on October 31, 2026 that tBTC remained fully backed with 4,320 BTC held in bridge wallets against 4,185 tBTC in circulation

Threshold Network instructed users on October 31, 2026 not to send Bitcoin to previously generated deposit addresses or repeat pending transactions during its Bitcoin bridge suspension

Hackers deposited stablecoins into Tron DeFi protocols like JustLend for non-freezable depository receipt tokens to evade issuer freezes

Aave's tBTC markets on the Base and Arbitrum networks were already frozen prior to October 31, 2026 during earlier asset deprecation rounds

An Ethereum chain reorganization caused THORChain to double-refund a 10 ETH deposit on October 31, 2026, triggering an emergency pause across 10 connected chains

THORChain's emergency pause mechanism was activated after an Ethereum reorg caused a duplicate 10 ETH refund to be processed, catching the anomaly post-transaction rather than preventing it beforehand

THORChain paused trading and swaps across 12 of the 13 chains it supports after an Ethereum reorganization triggered a double refund error on October 31, 2026

THORChain kept outbound signing active on most affected chains during the October 31, 2026 swap pause, allowing existing payments to proceed while new swaps remained blocked

The hijacked websites include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, StakePoint, Flap, and Kintsu, while their underlying smart contracts remained unbreached

Hackers hijacked at least 12 decentralized finance websites registered through Name.com in a DNS hijacking attack that rewrote domain records to redirect users to malicious frontend infrastructure

The 12 DeFi websites hijacked through the Name.com DNS attack were injected with Step Drainer, a Malware-as-a-Service toolkit that compromised frontends to harvest unlimited token approvals and signatures across more than 20 blockchain networks

Cloakd, the developer behind FluxBeam, stated on X that its Name.com representative maintained the DNS hijacking incident originated with third-party issuers rather than Name.com itself

Security researchers noted that registrar-level domain hijacking bypasses smart contract security controls and standard URL inspection, creating single-point-of-failure supply chain risks across decentralized finance protocols