How CBTC Preserves Bitcoin’s Core Assurances While Inheriting Canton’s Privacy & Atomic Settlement

By Aki Balogh, Co‑Founder & CEO, BitSafe

Bitcoin’s value to institutions isn’t just its price. It’s the assurances behind the asset: predictable supply, verifiable ownership, and the ability to operate without concentrating trust in a single intermediary. The moment Bitcoin is represented on another network, the bar gets higher, not lower. Those assurances have to be preserved—and then augmented with the operational features institutions actually need.

That is the design goal of CBTC on Canton: retain what makes Bitcoin, Bitcoin—while inheriting Canton’s decentralization, privacy, and composable workflows built for regulated finance.

Over the past few weeks we’ve demonstrated this in production through the first‑ever atomic trades between CBTC and Canton Coin on CantonSwap, executed on Canton Network, a public L1 blockchain with privacy. It was a huge moment for liquidity, but the more important story sits under the hood: how decentralization works on Canton and how CBTC uses it to distribute trust through attestation—without sacrificing privacy or settlement finality.

Figure 1: Daily net flows into U.S. spot Bitcoin ETFs since launch highlight why institutions want productive, on-chain uses for BTC.

Decentralization that’s practical, not performative

Canton decentralizes along the two places institutions actually bear risk—local correctness (validators + optional attestor pools validate their own state) and global finality (a BFT super‑validator set orders blocks).

No single actor can see all data or unilaterally change state, and that configurability is exactly what lets CBTC run with independent attestors and atomic DvP on public Canton.

Canton Network's architecture is decentralized by design. Today, anyone can request a validator node (with current sponsorship) and participate in consensus for transactions that they're part of. Canton is the only public L1 network with institutional-grade privacy.

Figure 2: No single node processes all transactions or sees all data—privacy and validation are scoped to the parties involved.

Canton takes a layered approach that maps to how institutions actually transact:

Global ordering and finality via BFT super validators provide deterministic ordering and guaranteed message delivery, allowing validators to consistently and deterministically provide double‑spend protection, and atomic finality across applications—so the state remains consistent and synchronized where it needs to be, but keeps control in the hands of the institutions running validators.

Atomicity across applications means workflows can span multiple ledgers/apps and still settle atomically—either everything commits, or nothing does—enabling true delivery‑versus‑payment. 

And configurable privacy ensures only the parties to a transaction see the data they need, while others rely on cryptographic facts and attestations to trust the outcome.

Preserving “Bitcoin‑ness” while making it usable

When Bitcoin crosses networks, there are often trade-offs between one of two things: either it centralizes control (simpler ops, poor assurances) or it fragments the lifecycle across disparate systems (hard to audit, brittle).

CBTC takes a different path. 

Every CBTC is backed by 1 BTC—that is non‑negotiable. 

Professional validators, like Pier Two, Hashkey Cloud, and Nethermind to name a few, already trusted with billions in digital assets, operate the infrastructure behind CBTC’s lifecycle and policy enforcement.

Mint and burn events are attested, with credentials institutions can verify on‑chain. This process keeps the “provenance” between native BTC and CBTC clear without broadcasting private deal information.

And because Canton lets us compose across applications, the movement of CBTC can be tied atomically to settlement and margining in other apps. 

That is how you move from speculation to workflows.

In short: Bitcoin’s core assurances stay intact, while the operational assurances institutions require—privacy, synchronized state, atomicity—come from Canton.

How Canton specifically enables CBTC’s model

The lifecycle below shows where validator-scoped state and threshold attestation apply

Figure 3: Minting CBTC on Canton: attestor-generated deposit address → BTC sent and confirmed → threshold attestation → CBTC credited.

Figure 4: Burning CBTC: withdrawal request and burn → threshold attestation → BTC delivered to the user’s address after confirmations

A few Canton features are particularly material to CBTC’s design. 

Validator‑scoped state ensures only direct validators and designated attestors see the information they need, making institution‑grade privacy native rather than an add‑on. Then, composable atomic workflows let a CBTC lifecycle event—for example, a mint—tie directly to settlement in other applications such as margin updates, escrow releases, or RWA settlement

Then, interoperability without data leakage means independent apps interoperate through shared logic and proofs rather than shared databases. This allows liquidity to scale and the ecosystem to integrate without forcing everyone into one monolith

Canton provides a validator/attestor model that enforces these rules at the contract level, together with a BFT (Byzantine Fault Tolerance) layer that delivers final ordering and consistency so attested events propagate deterministically across the network.

What institutions will be able to do with CBTC on Canton

• Private OTC derivatives with rapid, atomic margining. Price and settle without broadcasting positions to the world; margin calls settle on‑chain in minutes, not days.
• Collateralized lending: Borrow against CBTC with programmatic controls and privacy, tied to attested lifecycle events.
• Escrow for tokenized‑asset settlement. Use CBTC as programmable escrow to settle tokenized Treasuries, credit, or RWAs with deterministic post‑trade flows

Where we’re headed

We continue to expand the attestation pool by onboarding independent operators, deepening both geographic and organizational diversity.

We’re also exploring CBTC-native yield vaults on Canton with ecosystem partners and external yield providers

The intent is simple: let holders access CBTC across familiar interfaces with the same assurances they already rely on. You’ve seen the first step with CantonSwap; more wallet integrations and experiments are in motion.

Closing

For Bitcoin to become day‑to‑day infrastructure for institutions, it has to preserve the assurances that made it valuable—while picking up the operational guarantees that modern finance demands. 

CBTC on Canton is our answer: Bitcoin’s core qualities, Canton’s privacy, and a decentralized attestation model you can actually audit.