Chainlink launched CCIP 2.0 on Monday, September 28, 2026. The main change is a new Cross-Chain Verifier (CCV), which lets a token issuer or institution require its own approval before a cross-chain transfer executes. Decrypt and Unchained both link the release to the April 2026 Kelp DAO exploit.
What happened at Kelp DAO
In April, hackers linked to North Korea’s Lazarus Group drained about $292 million from Kelp DAO, per Decrypt. Kelp’s bridge ran on LayerZero with a single verifier. Decrypt reports that LayerZero later called that setup a mistake and stopped supporting it for new deployments. The two sides dispute who approved it: Kelp says LayerZero approved the setup, and LayerZero says it went against its own recommendations. Unchained reports that Kelp recently sued LayerZero and is moving its rsETH token to CCIP. Decrypt adds that Kraken and Lombard Finance also moved to Chainlink.
What CCIP 2.0 changes
Chainlink’s default Committee Verifier, made up of 16 independent node operators who must agree, still signs every transfer. An issuer can now add its own CCV, run by itself or by an outside provider, and that CCV must also sign before the transfer executes on the destination chain. Infosys and Nethermind are among the firms building CCVs for clients, and starter kits are available on Amazon Web Services and Google Cloud, per Decrypt. Issuers can also add KYC, anti-money laundering and sanctions screening to a transfer, and choose how long a transfer waits for finality.
The Risk Management Network is being retired as a standalone safeguard. Chainlink says the optional verifiers can now do that second review, and its documentation states the network’s automated offchain role is no longer active in current CCIP deployments.
| Works well | Be careful |
|---|---|
| A second, independent verifier removes one single point of failure. | The extra verifier is optional. It only helps if issuers add one and configure it well. |
| Issuers can run the CCV themselves or hire a provider such as Infosys or Nethermind. | A weak or poorly run CCV adds little. |
| Compliance screening and finality settings can be added per transfer. | Smart contract bugs, key theft and misconfiguration remain possible. |
| Chainlink says CCIP secures more than $84 billion in cross-chain token value (company-reported). | Chainlink’s figures, including more than $15 billion moved onto CCIP in the last four months, are not independently audited. |
The verdict, with caveats
CCIP 2.0 reduces one kind of risk. It does not make bridges safe. No source says it would have prevented the Kelp hack, which used LayerZero. Adoption is also thinner than the launch list suggests. Eighteen companies are listed as launch partners, but Decrypt notes that Fidelity said the upgrade “has the potential to support” broader distribution, and Further Asset Management only “intends to partner.” Those are statements of intent. Per Unchained, Aave, Maple and Re adopted the faster finality option for their tokens, and Lombard is building custom verification with CCVs. Decrypt does not mention Aave or Maple, and adoption of the new verifier system by those firms is not confirmed.
Why It Matters to You
If you hold a bridged token, the safety of your holding depends on how its issuer configured verification. CCIP 2.0 gives issuers a tool to require more than one check, and it is live now. It does not tell you which tokens have done so, so ask whether an issuer publishes its verifier setup. This is not investment advice, and any bridge carries smart contract and operational risk. A related effort on another network is covered in Ethereum Economic Zone Tests Atomic L1-to-L2 Call on Mainnet.
Quick answers
Would CCIP 2.0 have prevented the Kelp hack? No source says so. The point is that a second, independent verifier removes one single point of failure.
Does CCIP 2.0 make cross-chain transfers safe? No. It adds an optional extra check, and the other risks listed above remain.
Who runs the extra verifier? The issuer, or an outside provider such as Infosys or Nethermind.
Sources
- Decrypt: Months After the $292M Kelp Hack, Chainlink Lets Institutions Add Their Own Bridge Checks (Sep 28, 2026)
- Unchained: Chainlink Upgrade Gives Institutions Their Own Sign-Off on Cross-Chain Token Transfers (Sep 28, 2026)