Chainlink Upgrades its “CCIP” Crypto Bridge Tech with New Security Checks for Apps

Chainlink has released CCIP 2.0, an upgrade that lets applications add their own security checks when moving tokens and messages between blockchains. The release came five months after attackers drained about $292 million in rsETH through a bridge that relied on a single verifier.

What changes for you

For token holders, the immediate effect is limited. Existing applications can use CCIP 2.0 without changing their integrations, according to CoinDesk. The stronger checks only matter if the application using the bridge chooses to add them.

Cross-chain bridges use verifiers to confirm that a deposit happened on one blockchain before releasing the corresponding funds on another. If an attacker can deceive a verifier, the attacker may be able to withdraw money without making the required deposit.

CCIP 2.0 uses Chainlink's default network of 16 independent node operators, which must reach agreement on each transfer. Applications can now add other verifiers on top of that network, either by running them themselves or hiring outside providers such as Infosys and Nethermind.

The change removes a second default check

The upgrade does more than add security options. Chainlink's Risk Management Network, which previously doubled as a separate set of nodes checking transactions, no longer performs that role. Chainlink said independent checks can now come from the optional verifiers.

That leaves two possible configurations:

• An application without custom verifiers uses one verifier network, made up of 16 operators. It previously had two verifier networks.
• An application that adds independent verifiers can place those checks on top of the 16-operator network.

The second arrangement is closer to the structure that the Kelp DAO bridge lacked. The design change does not make CCIP automatically more secure. Its protection depends on which verifiers an application uses and how those systems are governed.

Kelp blamed a single-verifier setup

The release followed the April attack on Kelp's bridge, which ran on LayerZero. Attackers allegedly linked to North Korea's Lazarus Group tricked the bridge's single verifier and drained about $292 million in rsETH, CoinDesk reported.

Kelp said LayerZero staff reviewed its single-verifier setup and did not object. LayerZero said Kelp was responsible for using one verifier rather than several. CoinGecko data showed that nearly half of active LayerZero applications used the same arrangement.

The attack figures and the Lazarus Group attribution have not been independently confirmed in the research reviewed for this article. The report also does not confirm whether Kelp has completed its stated move of rsETH to Chainlink.

Adoption remains unproven

Chainlink has not named any institution using the new optional verifiers. It said Aave and Maple have started adopting other parts of the upgrade, but the source does not identify those features or say that either company has enabled the added verifiers.

The source also names no live blockchain or confirms an effect on the price or supply of LINK. Existing Chainlink integrations can continue on CCIP 2.0, but that does not mean they are using its new security layer.

For applications, CCIP 2.0 offers more control over bridge checks. For holders, it is a new option rather than an automatic upgrade to every transfer. The practical benefit will depend on which applications adopt it and whether they add checks beyond Chainlink's default 16-operator network.