Good Morning Bitcoin, 6 November
Today's Snapshot
- BSV wallet audit ships five fixes in one day
- EDX and BitSafe bring Bitcoin to Canton
- CFTC orders exchanges to drop geographic barriers
Institutions are still deciding what infrastructure to build on top of Bitcoin, and today's stories show three different approaches. BSV's own wallet project is tightening its security posture in public, a Canton Network venue is bringing Bitcoin-backed value into a privacy-enabled trading system and the CFTC is telling every exchange it oversees that geography cannot gate access to derivatives markets. Let's get into it:
BSV wallet project merges five security fixes in a single day
The news
The bsv-blockchain organisation's bsv-wallet repository merged five security fixes on 5 November 2026. Developer icellan authored all of them, and sirdeggen reviewed and merged them. Each fix closed a distinct numbered security report generated by an internal scan, covering remote payment authentication, vault mutation signing and relay socket handling.
Pull request 85 closed security report F16: remote payment roots could previously authenticate using standalone proof-of-work-valid headers without proving they belonged to the canonical chain. The fix now requires an authenticated chain path and network validation before a remote root is accepted or cached. According to the pull request's merge notes, it passed 211 header tests.
Pull request 91 closed security report F22, where vault mutations authenticated a UI snapshot but then signed a separate, unverified storage reread. The fix binds rename, add-key and removal mutations to the exact authenticated metadata snapshot, spanning five commits and 419 passing tests, per the GitHub record.
Pull request 87 closed security report F18, where closing a relay socket during duplicate decryption could leave handler processes running. The fix revokes the socket generation on closure, serializes sequence commits and rejects stale work before dispatch, passing 111 tests across eight suites. It was stacked on an earlier fix, security/f11-scan-fix, which had to merge first. Each pull request's merge notes also flagged that native lifecycle integration and physical-device behaviour remain unverified in local testing.
What's next?
The stacked dependency on security/f11-scan-fix and the stated gaps around native and physical-device testing point to further pull requests addressing the remaining numbered reports from the same internal scan.
The Takeaway
The Takeaway: a numbered internal scan, not scattered bug reports, is what security maturity looks like
Five pull requests closed five distinct numbered reports, all on the same day, with hundreds of passing tests logged against each. That's the signature of a structured audit rather than reactive patching. F16, F18 and F22 were each isolated, fixed and tested independently before merge.
For anyone building wallets or custody tools on BSV, this is the evidence that matters more than a changelog headline. The authentication gap in F16 and the signing gap in F22 are exactly the kind of flaws that turn into stolen funds elsewhere in crypto. Catching them through an internal scan, with the fix stacked on a prior fix rather than merged in isolation, is what a protocol built for enterprise use is supposed to produce.
The honesty in the merge notes about untested native and physical-device behaviour matters too. Builders get a precise boundary of what has been verified and what hasn't, rather than a blanket claim of safety.
EDX Markets and BitSafe launch Bitcoin-backed CBTC trading on Canton Network
The news
EDX Markets, an institution-only digital asset trading venue with its own central clearinghouse, announced a partnership with BitSafe on 5 November 2026 to launch CBTC/USD spot trading. CBTC/USD perpetual contracts are planned for coming weeks, with CBTC/BTC spot trading planned later.
CBTC is BitSafe's Bitcoin-backed digital asset for the Canton Network, maintaining 1:1 backing with Bitcoin through distributed reserve controls and Chainlink Proof of Reserve for transparency verification, according to the companies' announcement. They describe it as the first Bitcoin-backed asset available on Canton's privacy-enabled ecosystem.
Canton Coin will be eligible as collateral for CBTC perpetual trading. The launch also includes zero trading fees for eligible trades, covered withdrawal fees and Canton Coin rewards tied to trading volume. EDX's Chief Commercial Officer David Olsson said the partnership "expands the range of assets available to EDX participants while creating a new point of access to Bitcoin-backed value on Canton." BitSafe CEO Aki Balogh said CBTC "enables firms to put Bitcoin-backed value to work across trading, lending and other financial applications."
What's next?
CBTC/USD perpetual contracts are due in coming weeks, followed later by CBTC/BTC spot trading. Those will be the next markers of how far Canton integration extends.
The Takeaway
The Takeaway: wrapping Bitcoin for a permissioned network is a workaround for a problem BSV already solved
BitSafe had to build distributed reserve controls and add Chainlink Proof of Reserve just to make a Bitcoin-backed token trustworthy enough for institutional trading on Canton. That's infrastructure built to compensate for the fact that Bitcoin itself, as BTC, can't run the lending, trading and asset-transfer logic Canton offers natively.
BSV was restored precisely so that this kind of application layer, trading, collateral and settlement logic, could run directly on-chain rather than through a wrapped representation on a separate privacy network. The incentive structure EDX is using, zero fees and volume-based rewards, is the same demand signal BSV's own infrastructure is built to meet without an intermediary asset.
The first-of-its-kind framing is notable on its own terms: institutions are still inventing new wrapped-Bitcoin products in 2026 because the base layer they started with can't do the job unassisted.
CFTC gives exchanges 30 days to remove domestic geographic access limits
The news
The CFTC issued Release Number 9323-26 on 5 November 2026, interpreting its impartial access requirements under Regulation 38.151(b). The interpretation prohibits domestic geographic restrictions that violate the requirement for competitive, open, fair and impartial access and gives designated contract markets 30 days to eliminate any such restrictions.
Designated contract markets also have 30 days to verify that the intermediaries they rely on aren't themselves impeding compliance with the access requirement, according to the CFTC's release. Any market that is not compliant must submit an explanation to the Commission's Division of Market Oversight, which will evaluate compliance on a case by case basis.
CFTC Chairman Michael S. Selig said: "Derivatives markets must operate on a uniform basis at a national scale in order to achieve the purposes set out in the Commodity Exchange Act." The interpretation applies to every designated contract market the CFTC oversees, not just one named exchange.
What's next?
The 30 day clock runs from the 5 November release. After that, non-compliant markets must explain themselves to the Division of Market Oversight.
The Takeaway
The Takeaway: uniform access, enforced on a deadline, is a harder bar than most ledgers are built to clear
A thirty day deadline backed by a named enforcement path through the Division of Market Oversight leaves no room for an exchange to treat state-by-state access as a business decision. Every designated contract market now has to prove, on the same calendar, that geography plays no part in who can trade.
That bar is easiest to clear for infrastructure where every participant's access was recorded the same way from day one, rather than patched together market by market as demand grew. A payments and data network built for enterprise use at scale is built around exactly that kind of consistency, not retrofitted to meet it under deadline pressure.
The timing is pointed: this access standard lands in the same week exchanges are absorbing newly approved products like single-stock perpetual futures, so the rule and the product expansion are hitting the same market infrastructure at once.
What to Watch
- Stacked wallet fixes - watch bsv-wallet's GitHub for more pull requests closing the remaining numbered reports from the internal scan that produced F16, F18 and F22.
- CBTC perpetuals - EDX and BitSafe plan to launch CBTC/USD perpetual contracts in the coming weeks, another test of Bitcoin-backed collateral on Canton.
- CFTC compliance deadline - designated contract markets have until early December 2026, 30 days from the 5 November release, to drop domestic geographic restrictions or explain themselves to the Division of Market Oversight.
Five fixes merged in a day, a wrapped Bitcoin product launched to do what Bitcoin alone could not and a regulator drawing a hard line on access. The infrastructure questions keep arriving, and BSV keeps answering them at the base layer.