Chainlink rolls out CCIP 2.0 for crypto bridge security controls

Traders Union
All News
Crypto
Chainlink CCIP 2.0 bridge security

Highlights

Chainlink launched CCIP 2.0, allowing companies to add custom security checks on cross-chain transfers, supplementing its standard 16-operator verifier network.
The upgrade follows Kelp DAO's April $292 million hack, which was linked to insecure bridge configuration, prompting Kelp to switch its rsETH token to Chainlink.
CCIP 2.0 retires Chainlink's separate Risk Management Network backstop, leaving customers to rely on the default network or add optional external verifiers like Infosys and Nethermind.

Bridge upgrade follows DeFi security breach

As first reported by CoinDesk, Chainlink releases Cross-Chain Interoperability Protocol, CCIP, 2.0 on Monday, adding tools that let companies build their own security checks into transfers between blockchains on top of Chainlink's default 16-operator verifier network.

The upgrade comes months after April's $292 million hack at Kelp DAO, one of the year's biggest DeFi breaches. The attack was blamed on a LayerZero bridge configuration that depended on a single verifier, and Kelp later moved its rsETH token to Chainlink.

CCIP, first launched in 2023, is designed to let blockchains exchange messages and move funds even though they cannot communicate directly. In bridge systems, verifiers confirm that a transaction took place on one chain before funds are released on another, making verifier design a central part of security.

CCIP 2.0 offers companies a menu of verifier options, including operating their own checks or using external providers such as Infosys and Nethermind. "Historically, legacy bridges have lost billions due to insecure infrastructure, while in-house builds are slow and expensive," Johann Eid, Chainlink Labs' chief business officer, says in a statement.

Security model shift draws industry attention

Chainlink says its own network of 16 independent node operators still checks every transfer, regardless of what additional layers a customer chooses to add. The company says users should not have to be cross-chain security infrastructure experts to move assets across blockchains.

At the same time, the upgrade changes a safeguard that Chainlink had previously highlighted in its marketing. Its Risk Management Network no longer acts as a separate backstop for transaction review, with the company saying that role can now be handled through optional outside verifiers instead.

That means users who do not add extra verifiers appear to rely on one verification network rather than two. Existing Chainlink users are automatically moved to the new version, while the company says only that Aave and Maple are starting to adopt some of the upgrade's other features and has not yet named any institution using the new verifier setup.

Agrobank’s RM203.8 million loss from nearly 3,000 unauthorised transactions highlighted how weaknesses in cyber controls can be exploited through critical digital connection points in the payments chain. Our earlier article noted that the incident, involving abuse of an interface connector, raised broader concerns about whether banks’ monitoring and security investments are keeping pace with evolving threats as financial services become more digital.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.