Hassan Maishera
TL;DR
-
Chainlink’s CCIP 2.0 lets companies add their own verifiers to cross-chain token transfers and messages.
-
Chainlink says its network of 16 independent node operators checks every transfer, even when users add other verifiers.
-
The upgrade follows April’s roughly $292 million Kelp DAO bridge exploit, which renewed scrutiny of how cross-chain transfers are verified.
Chainlink announced on Monday that it has launched version 2.0 of its Cross-Chain Interoperability Protocol (CCIP), adding more ways for companies to check transfers between blockchains.
CCIP carries messages and enables token transfers across networks that cannot communicate directly.
To complete a transfer, a bridge must verify activity on the originating chain before allowing the corresponding action on the destination chain. A failure in that process can put funds at risk.
Companies Can Add Their Own Verifiers
With CCIP 2.0, companies can run their own verifiers or use external providers, including Infosys and Nethermind.
Chainlink’s network of 16 independent node operators remains part of the verification process for every transfer. Chainlink describes those operators as checking cross-chain transactions through decentralized consensus.
The change gives asset issuers and applications more control over the checks required before a transfer is completed.
It also changes Chainlink’s previous security arrangement: the separate Risk Management Network, which once provided a second confirmation before messages became executable, no longer performs that role under the new design. Users can add independent checks through the optional verifiers.
That distinction matters when assessing the upgrade. Chainlink’s 16 operators work together as a network; adding another verifier provides a separate check beyond that network.
Kelp DAO Exploit Put Bridge Verification in Focus
The launch comes about five months after attackers drained roughly $292 million from Kelp DAO’s rsETH bridge. The bridge used LayerZero infrastructure and relied on a single verifier in its configuration.
LayerZero said Kelp DAO should have used multiple verifiers. Kelp DAO disputed that account, saying LayerZero staff had reviewed the setup without objecting.
The disagreement highlighted a practical question for bridge operators: who is responsible for selecting and checking a secure verification configuration?
Chainlink says CCIP 2.0 is designed to let users add checks without requiring them to build their own cross-chain security systems.
Existing CCIP users were moved to the new version automatically. Chainlink has named Aave and Maple as adopters of other upgrade features, but has not identified an institution using the new external verifier options.
