Release 2026-10-31#
Covers releases up to October 22, 2026.Transaction Finality & Fees#
Finality tracking for Bitcoin and EVM transactions.
Indexed transactions now include the addresses involved and fee details.
Retired EVM chains that are no longer active have been removed.
EIP-7708 Support#
Transactions using EIP-7708 are handled correctly, which prevents duplicate transaction records.
Native transfers skip EIP-7708 logs, so they aren't counted twice.
Bitcoin#
Funds can now be received on change addresses.
Transactions API#
get-transactions no longer applies a default beforeDate, so transactions in the newest blocks are returned.
Compliance#
Fixed the Travel Rule payload sent for transaction monitoring.
New compliance diagnostics dashboard.
Compliance test environments migrated to Sepolia.
Assets#
Asset catalog update, including USDC and EURC tokens.
Platform Maintenance#
More memory for sub-wallet lookups.
New alarms on backup jobs.
Deprecated notification code removed to cut alert noise.
Benefit: More accurate transaction status and history, with fewer duplicates.
Release 2026-09-30#
Organisation & User Self-Service#
Organisation and user management self-service is now live, and existing organisations and users have been migrated to the new identity management service.
New light admin user role.
Fixed API key creation when signed in through single sign-on.
Approval Requests#
The new Approval Request Service is deployed to production.
Approval requests are now recorded in the audit log.
Signing Descriptions#
Wallet creation now includes a human-readable signing description.
Description items are supported in the signing service.
Seed Export#
Seed exports now return a SHA-256 hash of the exported seed, so it can be verified.
Fixed co-signing of seed export requests.
Signing & HSM#
Production configuration and provenance keys for a new dedicated HSM cluster.
Fixed an HSM health-check timeout and a policy loading bug.
Mobile#
Clearer display of what a policy change request will change, shown as a diff in the iOS app.
SDK#
New public release of the Node.js SDK, with audit fixes.
Fixes#
Fixed address book comparisons when a request leaves out the memo field.
User wallet records are now created on demand.
EVM chain service upgraded to Node.js 24.
Benefit: Self-service administration, four-eyes approvals with a full audit trail, and verifiable seed exports.
Release 2026-08-31#
Approval Request Service#
First release of the Approval Request Service, with new roles to support four-eyes approvals.
Address Book#
Added a limit when reading address book entries, for better performance on large books.
Address Lookup#
Address lookup now supports Solana, Dogecoin, Ripple, Polkadot (Substrate) and Cardano.
Seed Export#
New seed-admin role for seed exports.
Fixed the sufficiency check on export seed requests.
Notifications#
Transaction push notifications go only to delegates, and policy push notifications only to administrators.
Fixed PolicySatisfied notification handling.
Bitcoin#
Transactions show the addresses involved.
The internal-address flag is now set per address group.
Identity & Access#
New roles in the identity management service, following a security review.
Transactions#
Clearer error messages and fixes to the signing flow.
Benefit: Stronger governance with four-eyes approvals and wider address lookup coverage.
Sub-Wallets#
createSubWallet (single) is now deprecated (still supported, not yet removed) — migrate to the createSubWallets batch mutation. The batch mutation does not return address provenance; retrieve it after creation via the subWallets query (get-subwallets). See the Deprecations page for the migration guide.
Release 2026-07-31#
Wallets#
get-subwallets now returns provenance data.
Webhooks#
Fixed a missing property on DelegateSigned webhooks.
MetaMask Snap improvements, plus security hardening.
Signing Services#
New signing service release (5.5.0) with ongoing hardening and stability improvements.
Platform Maintenance#
Node.js 22 across TrustVault, the API, notifications and the BSC, Cardano and XDC chain services.
Compliance service client upgraded to reduce log noise.
Updated escalation matrix, website scanning and monitoring dashboards.
Benefit: Better wallet provenance visibility and a more current runtime.
Release 2026-06-30#
Single Sign-On#
The identity management service now integrates with an external identity provider, laying the groundwork for single sign-on.
Address Book#
Organisations can now restrict the approval process across multiple address books instead of just one.
Co-Signing#
The co-signing service now accepts SignTypedData, PersonalSign and PolicyChangeRequest events, so automated co-signing covers more request types.
Wallets & Authorisation#
New external create wallet request capability.
Authorisation updates and a fix for getInitiatedBy.
SDK#
Public Node.js SDK release, with audit fixes.
Platform Maintenance#
Services upgraded to Node.js 22.
Benefit: More flexible governance and broader automated co-signing coverage.
Release 2026-05-31#
Allow List Enforcement#
Allow list support enabled in TrustVault and the co-signing service.
Address Book#
Authentication and authorisation added to the Address Book service.
Bitcoin#
Fixed a bug where change UTXOs could become unspendable and change transactions could appear twice.
Corrected how transactions from external addresses into Bitpanda are classified.
Transactions#
ERC-20 preflight checks now use the recipient address instead of the token contract address.
SDK#
The Node.js SDK now points to the new API URLs.
Platform Maintenance#
Lambda runtimes upgraded to Node.js 22/24 and vulnerabilities fixed.
Restore permissions fixed in backup processing.
USB encryption key rotated as routine maintenance.
Benefit: Tighter destination controls and more accurate Bitcoin balances.
Release 2026-04-30#
Hyperliquid Support#
Hyperliquid chain indexing, transaction tracking and TrustVault support.
Compliance screening extended to Hyperliquid.
Authentication & Permissions#
Fixed token and authentication errors from the iOS app.
Fixed admin and signer permissions as part of the authentication upgrade.
Organisation Management#
TCSS keys are excluded from API key self-service.
Address Book#
Support can now edit the approval process of an address book.
Fixed email approval for new address book entries.
Signing & Policy Services#
Tenant isolation and a policy high-water mark added to the signing service.
Pricing#
Asset pricing now uses a single consolidated price feed and legacy feeds have been removed.
Contract Management#
Contract reads no longer depend on internal services.
Benefit: A new supported chain plus stronger tenant isolation and access controls.
Release 2026-03-31#
Address Book V2#
We are excited to announce the release of Address Book V2, a major upgrade designed to provide greater flexibility, enhanced security, and improved governance for your asset management.Key New Features#
Multi-Book Support: Users are no longer restricted to a single address list. You can now create and manage multiple named address books, such as "Whitelisted Traders" or "Cold Storage," alongside the "default" legacy book.
Mutable Definitions: Flexibility is improved with the ability to edit existing address book names and update appliesTo wallet configurations after a book has been created.
API Changes (GraphQL)#
Queries#
addressBooks: Retrieve a high-level dashboard view of all address books and their nested entries.
addressBook: Fetch a specific book with support for nextToken pagination to handle large entry lists.
addressBookApprovals: Access governance data, including requester info and approval status.
Mutations#
createAddressBook: Initialize new containers with specific governance logic (e.g., approvalProcess set to NONE or WALLET).
editAddressBook: Update metadata and wallet associations. Note: Updating the appliesTo array will completely overwrite existing associations.
createAddressBookEntries: Add single or bulk entries to a specific book.
deleteAddressBookEntries: Remove specific entries using an array of IDs.
deleteAddressBook: Permanently remove an entire address book.
Important Considerations#
Wallet Targeting: When creating a book, setting appliesTo to ["*"] will target all wallets; otherwise, specific wallet IDs must be provided.
Overwrite Behavior: When using the editAddressBook mutation, remember that the appliesTo field replaces the previous list rather than appending to it.
InfraOps APIs#
We've introduced new InfraOps capabilities, enabling secure and
auditable operational workflows for managing clusters.Cluster Operations#
InfraOps provides APIs to interact with clusters and handle operational
tasks securely.Supported capabilities: - Retrieve cluster information - Manage
offline cluster signing workflows via secure file exchangeSecure File Flows (Offline Clusters)#
For offline clusters, we've introduced a secure mechanism for handling
signing workflows using pre-signed URLs.Permissions#
Requires CLUSTER_MANAGER or CLUSTER_OPS roles
Applies to both users and API keys
Organisation Management#
We've introduced new Organisation Management capabilities, enabling
full control over API keys and users within your organisation.API Key Management#
New endpoints: - listApiKeys -- Retrieve all organisation API keys
with roles, status, and expiry - createOrgApiKey -- Create a new API
key with assigned roles and expiry date - updateOrgApiKey -- Enable or
disable an existing API keyHighlights: - API keys are returned only once upon creation ---
ensure secure storage - Keys are enabled by default - Supports
role-based access control and expiry for improved securityUser Management#
New endpoints: - organisationManagement.listUsers -- List all
users in the organisation - updateUser -- Update user roles and
status - inviteUser -- Invite new users with predefined rolesHighlights: - User updates are full replacements (not partial
updates) - Invitations include pre-assigned roles for streamlined
onboardingPermissions#
All Organisation Management endpoints require ADMIN role
Applies to both users and API keys
Notes#
Designed for enterprise-grade access control and governance
Enables API key lifecycle management (create, audit, disable)
Provides centralised user administration via API
Release 2026-02-28#
Security & Credential Hygiene#
API key and secret rotation completed across all chain services, compliance, co-signing, notification and identity services.
API keys are now checked against their expiry date.
Address Book#
New getAddressBookEntry endpoint.
New get-change-requests API, plus other improvements.
Mobile#
TrustVault can now enforce a minimum iOS app version.
Transactions#
Ethereum events now default to mainnet when no chain ID is given.
Benefit: Better credential hygiene and more address book visibility through the API.
Release 2026-01-31#
Bitcoin#
Bitcoin test environments moved to testnet4.
Identity & Access#
Updated identity service configuration and upgraded to AWS SDK v3.
Address book events now flow between the identity and address book services.
Web App#
Fixed block explorer links.
Benefit: Up-to-date test networks and better identity service stability.
Release 2025-12-31#
Transactions#
Transactions are no longer blocked when the address book check itself fails.
The API now returns additional error details, and get-request includes Ethereum transaction data.
Compliance#
Fixes to transfer matching and currency mapping.
Webhooks#
Webhook delivery moved onto a dedicated network.
Benefit: Fewer unnecessary transaction blocks and better error visibility for integrators.
Release 2025-11-30#
Address Book Service (V2 Foundation)#
First release of the new Address Book Service, with full feature parity.
API key authentication for its REST endpoints.
The API, TrustVault and compliance services now run address book checks and Travel Rule lookups through the new service.
Fixed address book change approval emails going to the wrong recipients.
Network & Testnet Migration#
Ethereum test environments migrated to Hoodi, and RPC providers updated across all chain services.
Polkadot#
Moved to Polkadot Asset Hub, including iOS support.
get-transaction(s) now returns the transaction hash and from.subWalletId for outbound EVM transactions.
Faster inbox and account-currency calls.
Cardano#
New support tooling to re-sync UTXOs.
Benefit: Lays the groundwork for Address Book V2 and keeps test networks current.
Release 2025-10-31#
Mobile Experience#
New logout options in the iOS app.
Transaction Error Transparency#
Ethereum and BSC services now surface errors that happen while publishing transactions.
Alerting for NONCE_TOO_LOW removed.
Bitcoin#
UTXOs and transactions on change addresses are now indexed.
Queueing & Multi-User#
Multi-user queueing enabled for more organisations.
Improvements to the MetaMask Snap.
Platform Maintenance#
Compliance and backup services upgraded to AWS SDK v3.
Offsite backups migrated to a serverless model.
Audit fixes across chain services.
Benefit: Clearer transaction failures and a smoother mobile experience.
Release 2025-09-30#
Compliance & Governance#
AML MVP re-released for the custodial product.
Fixes to currency mapping and received-transfer registration.
Address book events now support email approval.
Access Controls#
New WAFv2 rule blocks access from restricted countries.
Signing & HSM#
Support for the new HSM firmware (FM 4.7.0), rolled out to the EU and UK clusters.
API Improvements#
Transactions can now be filtered by date range (startDate / endDate).
Platform Maintenance#
Audit fixes across chain and co-signing services.
Tokens are no longer logged.
Benefit: Stronger compliance coverage and easier transaction reporting.
Release 2025-08-31#
This release focuses on compliance, security hardening, performance, and resilience improvements across custody services. The items below intentionally avoid exposing internal designs, vendor names, firmware requirements, or implementation specifics while communicating customer‑relevant outcomes.Routine security updates and control tuning across core services.
Dependency hygiene and audit‑driven remediation's across the platform.
Benefit: Reinforces our custody‑grade security baseline and operational stability.
Compliance & Governance#
Foundational support for compliance workflows across custody components.
Enhancements to AML‑related review processes and reporting readiness.
Benefit: Streamlines compliance operations and reduces manual effort.
Mobile Experience#
Performance and responsiveness improvements across key mobile flows.
Refined session and authentication handling for improved reliability.
Benefit: Provides a smoother mobile experience while maintaining security integrity.
Signing & Policy Services#
Enforced encrypted channels for inter‑service communication.
Aligned policy validation across sensitive import and key‑related workflows.
Benefit: Strengthens cryptographic controls and standardises sensitive operations.
Blockchain Indexing & Throughput#
Scaled indexing capacity to handle higher on‑chain activity during periods of network congestion.
Stability and throughput improvements during spikes in block size and transaction volume.
Benefit: Ensures reliable indexing and transaction visibility under heavy load conditions.
No customer action is required for this release. For questions, please contact Support.Release 2025-07-31#
This release focuses on security, reliability, and developer‑experience improvements across the custody platform. The items below are intentionally written to avoid exposing internal designs, vendor names, or implementation details while still describing customer‑relevant outcomes.Ongoing maintenance and remediation as part of our secure development lifecycle
Routine dependency updates and configuration tuning
Incremental improvements informed by internal and external reviews
Benefit: Reinforces our security baseline and keeps our controls aligned with industry expectations.
Error Handling & Transparency#
Clearer, more consistent responses for transaction status and failure scenarios
Additional telemetry for issues that are not automatically retried
Aligned behaviour across APIs to standardise how errors are reported
Benefit: Improves troubleshooting clarity and reduces integration effort.
Vault & Key Management Enhancements#
Improved transaction descriptions for supported assets
Expanded request feedback to surface actionable information where appropriate
Additional safeguards and audit controls in recovery workflows
Benefit: Increases end‑user clarity, improves operational resilience, and supports secure key lifecycle management.
Infrastructure Optimisation#
Simplified network architecture and routing to improve efficiency
Hardened private integration paths used by background services
Broader monitoring and alerting coverage across core components
Benefit: Enhances reliability and reduces operational overhead.
API & SDK Improvements#
More consistent API responses for transaction queries
SDK updates that reduce footprint and improve maintainability
Benefit: Simplifies the developer experience and speeds up integrations.
Governance & Access#
Routine refresh of cryptographic controls
Role definitions reviewed to reinforce least‑privilege access
Enhanced visibility into the status of vulnerability remediation
Benefit: Strengthens overall security posture and operational governance.
No customer action is required for this release. For questions, please contact Support.Release 2025-06-30#
This release focuses on expanding compliance capabilities, strengthening audit readiness, and optimizing network infrastructure across our custody ecosystem.We applied several backend security patches in line with our CVE patching policies:Updated Go stdlib dependencies across multiple services
Upgraded internal infrastructure libraries
Increased memory allocations for critical lambdas
Benefit: Improves runtime resilience and keeps services aligned with our internal security guidelines.
Compliance Engine Enhancements#
Enhancements to the anti-money-laundering (AML) layer improve transaction monitoring fidelity:Compliance checks now reference organisation.product for more granular enforcement via third-party compliance providers
Fixed case-sensitive asset matching in Travel Rule provider integration
Extended chain ID mapping to support additional networks
Benefit: Increases precision of compliance workflows across supported chains and products.
Custody Chain Service Hardening#
Post-audit remediation's were applied across multiple chain services:Infrastructure interface corrections
Benefit: Aligns on-chain connectors with current audit requirements and ensures predictable node integration.
Network Infrastructure Optimization#
Refinements to internal networking components:Decommissioned unused NAT gateways and staging subnets
Added direct endpoints for ECR services
Removed legacy private endpoint
Benefit: Reduces internal network complexity and improves routing efficiency for key components.
API Documentation Redirect#
We have consolidated custody developer documentation under the Bitpanda TechSolutions portal:Redirected developer.bitpandacustody.com to techsolutions.bitpanda.com/custody
New routing is managed via CloudFront and backed by an S3 origin (as fallback)
Benefit: Streamlines access to up-to-date documentation under a unified platform portal.
Release 2025-05-31#
This release brings continued improvements across chain services, custody governance, and security posture. Our updates focus on secure seed management, dynamic transaction handling, and refined access controls across the custody infrastructure.We have applied updates to multiple chain services in line with our patching guidelines to address critical security vulnerabilities in Go stdlib and supporting dependencies. These updates also include performance tuning improvements.Memory configuration improvements for runtime components
Standardized dependency updates across chain services
Ongoing adherence to CVE patching policies
Dynamic Transaction Fee Handling#
We improved our transaction tip calculation logic for EVM-based networks. Tip values are now dynamically fetched using eth_maxPriorityFeePerGas, ensuring compatibility across chains with different baseline fee requirements.Resolves static tip issues on high-minimum-tip networks
Verified compatibility with EIP-1559 and non-EIP-1559 chains
Increases reliability and predictability of transaction inclusion
Seed Export Capability (Custody)#
We have introduced secure export functionality for wallet seeds via TrustVault:Export actions are gated by PCR (Policy Change Request) to enforce access controls.
Co-signing support is enabled via TCSS for multi-approver validation.
All exports are encrypted and auditable to support operational integrity.
Webhook and Notification Enhancements#
Webhook delivery systems were optimized to improve reliability and responsiveness:Webhooks now execute in parallel with a 30-second max per call
Global timeout extended to 60 seconds
New subscription type added to support seed export notifications
Role and Access Management Updates#
Internal access policies were refined to enhance operational governance:Escalation flows updated for developer and admin access levels
Co-signing requirements expanded for sensitive operational actions
Infrastructure & Compliance Controls#
We transitioned to AWS WAFv2 for improved edge protection and consistency:Region-based rate-limiting updated in line with AWS standards
IP-level blocking aligned with compliance jurisdiction restrictions
Additional hardening applied for common web-layer vulnerabilities
Release 2025-04-30#
Seed Export (SDK)#
Node.js SDK support for exporting seeds.
MetaMask Snap versions 0.1.10 to 0.1.12 rolled out.
Access Controls#
Geo-restrictions on the web app block prohibited regions.
Solana#
Transactions not seen on chain are now republished automatically, with a shorter polling backoff.
Signing & HSM#
HSMs added for the new UAE data centre.
Compliance#
currencyType included in compliance transaction requests.
Benefit: More reliable Solana delivery and the groundwork for seed export.
Release 2025-03-31#
Contract Management#
First release of the Contract Management service, with API support.
Exchange transfer removed from the API.
Wallets#
Query multiple sub-wallets in a single call.
EVM Chains#
New transaction fee lookup.
Arbitrum mainnet added to transaction tracking.
Arbitrum, BNB and XDC testnets indexed.
Enhanced mode for the MetaMask Snap (quiet launch).
getTransactionInfo returns a placeholder signature for Snap requests.
Backups#
Offsite backups for wallet data.
Benefit: Smart contract management and wider EVM coverage.
Release 2025-02-28#
Solana#
Support for Solana priority fees.
The iOS app shows estimated fees for Solana transactions.
Solana address validation updated to allow new token addresses.
UAE Cluster#
AE cluster provenance key added to TrustVault and iOS.
EVM#
ERC-20 totalSupply included in get-balance.
Fixed signTypedData encoding for the bytes type.
Platform Maintenance#
CVE upgrades for cryptographic libraries.
Benefit: Faster, more predictable Solana confirmations.
Release 2025-01-31#
Cardano Vote Delegation#
Cardano vote delegation certificates supported across TrustVault, co-signing, webhooks, the SDK and iOS.
Polkadot#
iOS signing support for Polkadot.
Staking validation relaxed so transactions aren't blocked.
Web App#
MetaMask Snap management page (quiet launch).
Removed the third-party chat widget.
Error Handling#
All Cardano errors are surfaced through the API.
iOS#
Fixed signTypedData v4 encoding.
Benefit: Cardano governance participation straight from custody.
Release 2024-12-31#
Dogecoin Support#
Dogecoin sub-wallets, transactions, address book, webhooks, co-signing, SDK and iOS support.
Polkadot / Substrate#
Substrate address book support.
Immortal transactions by default.
Fixes#
Benefit: Two more networks fully supported end to end.
Release 2024-11-30#
Polkadot Staking#
Polkadot staking support in TrustVault, the API and the web app.
MATIC to POL Migration#
Polygon support updated for the MATIC to POL token migration.
EIP-712#
Fixed 0x string encoding in the co-signing service, SDK and iOS.
Support staff can look up addresses and transactions.
Benefit: Staking rewards on Polkadot and continued Polygon compatibility.
Release 2024-10-31#
Polkadot Support#
Polkadot sub-wallet creation.
Payment transactions via createSubstratePaymentTransaction.
Compliance#
Risk category IDs added to compliance screening.
Mobile Experience#
Inbox items show the names of policy users, not just device keys.
Fixed how Solana addresses display.
Solana#
New dashboards and better error logging.
Benefit: Polkadot support and clearer approval context on mobile.
Release 2024-09-30#
Solana Tokens#
Solana SPL token transfers in the API, TrustVault, the web app and iOS.
The SDK now requires decimals for token transfers.
Known Solana errors are passed through to the API.
API (Breaking)#
Trust API 6.0.0 supports assets taken from address book entries.
Address Book#
New event emitted when an address book entry is created.
Solana Monitoring#
Outbound transaction monitoring.
Registered nonce accounts can be viewed.
Platform Maintenance#
Audit fixes across chain services.
Benefit: Full Solana token custody.
Release 2024-08-31#
Solana#
Preparation of SPL token transfers.
Solana address book support.
Co-signing rules for Solana.
SDK#
SDK 3.0.0 moves Ripple and Cardano to the new signData format.
Platform Maintenance#
Node.js 20 upgrade across chain and backup services.
New permissions to rotate access keys and tail logs live.
Benefit: Solana integration from end to end, including automated co-signing.
Release 2024-07-31#
Solana Payments & Staking#
Create Solana token and payment transactions.
Solana staking flow, with new stake addresses.
Ripple#
Ripple digests now work at both 32 and 64 bytes, across the SDK, iOS and the chain service.
Ethereum#
Preflight checks now run on Ethereum requests that don't specify a nonce.
Bitcoin#
An Address Created event is emitted for each change address when permanent change addresses are enabled.
Signing & HSM#
HSM clusters can run different firmware versions at the same time.
Benefit: Solana transfers and staking, plus safer Ethereum submissions.
Release 2024-06-30#
Solana#
Prepare and submit Solana transactions.
XDC Network#
XDC Network support revived.
Address prefixes handled correctly.
XDC and BSC accounts shown in the extension.
Updated icon and version display.
Wallets#
BSC sub-wallet creation removed.
Wallet requests with a non-empty delegate schedule are now rejected.
Signing & HSM#
EU online cluster configuration and certificates added.
SDK#
SDK 2.0.0 with tightened dependencies.
Platform Maintenance#
Node.js 20 runtime across core services.
Security monitoring improvements.
Benefit: Wider chain coverage and a more current runtime.
Release 2024-05-31#
Travel Rule Simplification#
New Travel Rule address book and simplified Travel Rule flow.
TrustVault and transaction tracking now listen for the new Travel Rule events.
Address Book#
Address-book-prefilled transfers in the web app.
CONTRACT entry type deprecated.
Entries can be created without a type.
Checks now use the recipient based on value transfer.
Multiple Online Clusters#
The signing service supports multiple online clusters, starting with the EU online cluster.
Cardano#
Benefit: Less compliance friction on transfers to known counterparties.
Release 2024-04-30#
Solana (Initial)#
First release of the Solana chain service, with address derivation and nonce registration.
Solana sub-wallet creation and tiles in the web app.
Co-Signing#
Each co-signing rule can have its own cancellation message.
Address Book#
Search filter for the address book dropdown.
Warning shown when an intermediary adds a Travel Rule entry.
EVM#
Polygon testnet migrated to Amoy.
Benefit: The first steps in Solana support and clearer co-signing outcomes.
Release 2024-03-31#
Signing Descriptions#
Human-readable signing descriptions are created, signed and shown, including on hardware signing devices.
Address Book (Breaking)#
Trust API 5.0.0 adds counterparty information to the address book schema and removes the DeFi report section.
Entries can be UNLISTED or UNHOSTED without a VASP.
Travel Rule and contract-address support.
Bitcoin#
Permanent BTC change address.
Cancellations#
New SYSTEM_CANCELLED status.
cancelReason and errorReason exposed and shown in the web app.
Cardano#
Cardano support in the Node.js SDK.
Benefit: Signers see clearly what they are approving.
Release 2024-02-29#
Cardano#
Finalise, inbox and signing support.
Co-signing rules for payment, stake, unstake and withdraw.
Multi-asset UTXOs excluded from coin selection.
Ripple#
XRP destination tags across the API, web app, SDK, co-signing and webhooks.
Memos in the address book.
Ripple transactions are now queued.
Events#
EventBridge "Cancelled" and "Errored" events for all transaction types.
Exchange service code removed.
Moved to a new RPC provider.
Benefit: Cardano custody from end to end and XRP transfers that exchanges can match.
Release 2024-01-31#
Cardano (Initial)#
STAKE / UNSTAKE / WITHDRAW in the API and web app.
Ripple#
Address Poisoning Protection#
Address poisoning detection on EVM chains.
Spam addresses are blocked.
Signing#
EdDSA public keys and signing added to the signing service.
Fixes#
Fixed address book case sensitivity.
Secure login for in-app support chat.
Benefit: New chain support and protection against address poisoning scams.
Release 2023-12-31#
Ripple (XRP) Support#
XRP address derivation and transaction prepare/submit.
TrustVault transaction support.
SDK signing and submission from webhooks.
Ripple receive-address link in the web app.
Transactions#
Fixed unnecessary re-preparation and incorrect gas fee selection.
Only EVM addresses are lowercased for address book checks.
Benefit: XRP is fully supported in custody.
Release 2023-11-30#
Balance Controls#
Quarantine checks and checks on unspendable and cleared balances.
Ultra Cold Storage#
New at-firebreak-2 cluster supported in signing, TrustVault, co-signing and iOS.
Holesky Migration#
Ethereum test environments migrated to Holesky.
Web App#
Hover over a wallet to copy its details, including the organisation name.
API#
clusterName exposed in GraphQL.
Human-readable errors for failed recoveries.
Webhooks#
Ripple Transaction Created and Signed webhooks.
Benefit: Stronger balance safeguards and more ultra cold capacity.
Release 2023-10-31#
Radix Babylon#
Radix Babylon support in TrustVault and iOS, including multi-transfer inbox items.
Transaction Lifecycle#
Cancellations handled correctly during Travel Rule.
blockTime returned from get-transaction.
Compliance#
Transfers registered for screening.
Submit flag exposed on each transfer.
Address Lookup#
First release of the account service, with address lookup for BTC and ETH.
Deprecations#
WalletConnect removed from iOS and backend.
Human-Readable Transactions#
Updated Ethereum transaction descriptions.
Benefit: Radix Babylon support and a clearer transaction lifecycle.
Release 2023-09-30#
EVM Chain Indexing#
Monitoring for unsupported chains.
Failures retried automatically.
Travel Rule#
Non-TrustVault transactions move to CLEARED once approved.
Better inbound transfers in the web app.
Customer ID on intermediary transfers.
Travel Rule enabled in sandbox.
Co-Signing#
Multi-key signing in the co-signing service.
Web App#
Transaction status refreshes.
Local search in the transaction list.
API#
CLEARED transaction status.
Benefit: Wider EVM coverage and a smoother Travel Rule experience.
Release 2023-08-31#
Travel Rule#
Uncleared balance tracking.
Transfers matched to compliance data.
API (Breaking)#
updateTravelRuleInfo now requires the core beneficiary, originator and isCaller fields.
Organisation, trustVaultInitiated and isCaller added to the schema.
Signing & HSM#
Recovery#
Every recovery request now shows a diff of the proposed policy, with dry-run mode.
EVM#
First deployment of the new EVM chain service.
Platform Maintenance#
Vulnerability fixes across all services.
Benefit: Full Travel Rule compliance and safer recoveries.
Release 2023-07-31#
Travel Rule (Initial)#
Transactions that fall under the Travel Rule are now blocked and unblocked as needed.
Get and update Travel Rule information via the API.
VASP selection in the web app.
Transactions#
New transaction detail view in the web app.
Emails sent on inbound transactions.
Inbound and outbound transfer events for BTC and ETH.
Co-Signing#
API#
Errors from internal APIs are passed through.
Public key to user mapping exposed.
Benefit: Groundwork for regulatory Travel Rule compliance.
Release 2023-06-30#
Transactions View#
New transactions view in the web app.
New transaction statuses.
Transactions connection on user.
Multi-User#
Multi-user queueing enabled.
Organisations#
Legal-entity and compliance identifiers added to organisations.
Retirements#
Binance Chain (BEP-2) retired.
Platform Maintenance#
Sensitive data redacted from logs.
Benefit: Better transaction visibility and support for compliance onboarding.
Release 2023-05-31#
Authorisation#
First phase of the new authorisation model.
Signing & HSM#
Bitpanda Custody HSM configuration.
The SDK supports multiple provenance public keys.
Co-signing works with ultra cold HSMs.
Events#
Initiated, signed, cancelled and errored transaction events published to EventBridge.
API#
Auth tokens are no longer logged.
iOS#
EIP-1559 fees shown correctly in fiat.
Web App#
Benefit: Stronger authorisation and event-driven integrations.
Release 2023-04-30#
Security#
Vulnerability scanning enabled.
Web App#
Removed dependency on a deprecated API endpoint.
Radix sub-wallet creation hidden.
Platform Maintenance#
Infrastructure-as-code migrated to CDK v2.
Benefit: Better vulnerability visibility and policy safety.
Release 2023-03-31#
EIP-1559 Support#
EIP-1559 transactions in TrustVault, Ethereum services, MetaMask and iOS.
Radix#
Radix sub-wallets can be created in the API and web app.
Mobile#
Basic permission error messages.
Fixed signing ERC-20 transactions created in the web app.
Queueing behaviour can be toggled per wallet.
Address Book#
Fixed duplicate update and delete issues.
Benefit: Lower, more predictable Ethereum fees.
Release 2023-02-28#
Permissions#
Changes to the permission model, adding authorisation.
SDK#
signTypedData boolean type supported.
Benefit: Groundwork for finer-grained access control.
Release 2023-01-31#
Audit Log#
Audit log export and a downloadable Audit CSV report in the web app.
Audit event descriptions added to emails.
Platform Maintenance#
Upgraded libraries and Node.js.
Benefit: Easier governance reporting.
Release 2022-12-31#
Audit Log#
New audit log with email alerts for audit events.
Address Book#
Entries can be deleted from the address book.
Benefit: Full traceability of sensitive actions.
Release 2022-11-30#
Ultra Cold Storage#
Ultra cold (Firebreak) wallets supported in MetaMask, iOS and the inbox.
Mobile#
Benefit: Air-gapped cold storage across every interface.
Release 2022-10-31#
Ultra Cold Storage#
Ultra cold wallet support in the web app.
Wallet cluster exposed through the API.
Human-Readable Transactions#
Transaction descriptions on iOS.
Fixes#
Smart contract deployment fixed.
iOS can no longer sign the same BTC transaction more than once.
Legacy BTC endpoint removed.
Benefit: Signers understand what they are approving.
Release 2022-09-30#
Bitpanda Custody Rebrand#
Web, iOS, MetaMask, emails and assets rebranded to Bitpanda Custody.
Mobile#
iOS 16 support, with error items in the inbox.
Transactions#
Human-readable transaction description field.
Ethereum testnet moved from Ropsten to Goerli.
API#
Faster EVM transaction creation.
Benefit: A unified brand and current test networks.
Release 2022-08-31#
Transactions#
txHash included in signed messages.
New transaction state manager.
Fixed private key formatting.
Fixes#
Fixes for preflight checks and the XDC coin summary.
Benefit: Better transaction tracking.
Release 2022-07-31#
Asynchronous Signing#
Async signing service responses, sub-wallet creation and address creation.
Smart Contracts#
to: "0x" allowed for contract deployment.
Address Book#
The same address can be added on more than one chain.
Benefit: Better throughput and smart contract deployment support.
Release 2022-06-30#
Address Book#
XDC Network addresses can be added to the address book.
Address book link shown in the web app.
Webhooks#
New custom header on webhooks.
Mobile#
Non-mainnet transfers no longer check the mainnet balance.
Benefit: Wider address book coverage.
Release 2022-05-31#
Co-Signing#
Threshold rules can now sign on failure.
Assets#
Mobile#
Fixed large uint256 values in ethSignTypedData.
Benefit: More flexible automated policies.
Release 2022-04-30#
Reporting#
Async transaction CSV export.
Transactions#
Transaction initiator (initiatedBy) shown in the web app and iOS.
Quarantine check on BTC transactions.
SDK#
Binance Smart Chain and EVM support in the Node.js SDK.
Compliance#
Benefit: Clearer accountability and faster reporting.
Release 2022-03-31#
Faster Bitcoin endpoints and Ethereum indexing.
Exports#
Address lists can be exported.
Rebased on MetaMask 10.9.1.
Benefit: Faster responses.
Release 2022-02-28#
Web App#
Binance Smart Chain support.
API#
Billing#
Data-driven billing and CSV.
Webhooks#
Internal identifiers removed from webhooks.
Benefit: BSC in the web app and better data hygiene.
Release 2022-01-31#
Signing#
Human-readable personal sign on iOS.
Binance Smart Chain#
BSC webhooks and API fixes.
API#
getWallet / getWallets endpoints.
Block internal transfer webhooks.
Correct v value for signatures.
Benefit: Wider dApp compatibility.
Release 2021-12-31#
Binance Smart Chain#
BSC transactions in TrustVault and iOS.
Approvals#
Multiple approval email addresses.
EVM#
Faster Ethereum transaction creation.
Release 2021-11-30#
API#
rawTransactionBytes exposed.
Support for unsupported chains.
SDK#
Fixes#
Signature race condition fixed.
Benefit: More flexible integrations.
Release 2021-10-31#
XDC Network#
XDC Network support in the chain service, API, web app, iOS and TrustVault.
Deterministic signatures.
Upgraded to MetaMask 10.0.3.
SDK#
requestId passed in signCallback.
Organisations#
Organisation data can be exported.
Benefit: A new supported chain and safer signatures.
Release 2021-09-30#
Assets#
Contract address accepted as assetSymbol.
New tokens: CVX, USDN, YFI and EURS.
Webhooks#
Only failed URLs are retried.
Security#
signatureEncryptionPublicKey.
Validation of the from address.
Benefit: Easier token transfers.
Release 2021-08-31#
XinFin (XDC)#
XinFin support in TrustVault and iOS.
Webhooks & Co-Signing#
Personal Sign and Sign Typed Data "created" webhooks.
Co-signing support for these webhooks.
Co-signing cancelOnFail rule.
Ethereum#
Benefit: Automated policies cover more signing types.
Release 2021-07-31#
Address Book / Allow Lists#
Address book in the web app and API.
includedInAddressBook flag in webhooks.
Co-signing rule based on the address book.
Transactions#
Cancel / speed up transactions.
cancelReason, errorMessage and transactionMessage on requests.
Ethereum#
RPC endpoints mapped by chain ID.
Webhooks for unsupported tokens.
Benefit: Allow-list governance and control over pending transactions.
Release 2021-06-30#
Radix#
Radix transactions via createRadixTransaction.
Ethereum#
EIP-1559 base fee support.
Gas price warnings on iOS.
WalletConnect#
More chains supported, including Polygon.
Wallets#
Several sub-wallets can be created along with a wallet.
Inbox#
Benefit: Radix custody and EIP-1559 readiness.
Release 2021-05-31#
Radix#
Webhooks#
TRANSACTION_SIGNED webhook.
Ethereum#
Benefit: More reliable Ethereum submissions.
Release 2021-04-30#
Portfolio#
Portfolio views backed by the new reporting store.
Wallets#
Ethereum#
Better gas pricing and indexing performance.
Mobile#
Inbox supports organisations with more than 800 sub-wallets.
Benefit: Better portfolio reporting.
Release 2021-03-31#
Portfolio#
Webhooks#
transferValueDefinition included in Created transaction webhooks.
Co-Signing#
Assets#
Benefit: Better reporting and threshold-based automation.
Release 2021-02-28#
Mobile#
Personal sign accepts hex bytes as well as text.
Benefit: Wider dApp signing compatibility.
Modified at 2026-10-29 11:46:20
