Circle has opened the highest-volume cross-chain channel in the entire market, but will other issuers be willing to cede control of their cross-chain lifeline to it?
Written by Sanqing, Foresight News
On November 2, Circle co-founder and CEO Jeremy Allaire announced via tweet that its Cross-Chain Transfer Protocol (CCTP) is now open to all token issuers, framing the move as a "major unlock" for asset issuers. Back on October 30, Circle published an integration guide on its developer blog walking ERC-20 token issuers through the process of connecting to CCTP.
Launched in April 2023, CCTP previously served almost exclusively USDC. According to DefiLlama data, between the start of its tracking in January 2024 and November 2, 2026, CCTP recorded a cumulative cross-chain transfer volume of $182.05 billion. As of November 3, its trailing 30-day transfer volume hit $17.61 billion, ranking first among all cross-chain bridges tracked by DefiLlama (the combined volume of all tracked bridges over the same period reached $48.76 billion), with LayerZero coming in second at $12.48 billion.
Prior to the release of the third-party integration guide, non-USDC assets on CCTP were limited to Circle’s own products: cirBTC, EURC, and WETH. Per Circle’s own tweet, the cumulative cross-chain volume of these assets had only just crossed $100 million as of mid-October.
Two Months In: From a USDC-Exclusive Dedicated Line to a Public Cross-Chain Channel
CCTP’s expansion has been concentrated over the past two months: On September 2, Circle’s euro stablecoin EURC was integrated into CCTP; on September 16, Circle’s self-built Layer 1 chain Arc launched its public mainnet; on September 23, Bitcoin-supported token cirBTC was added to the protocol; and on October 30, the third-party integration guide was released. Over the same period, the legacy CCTP V1 version used for USDC has been subject to gradually decreasing transfer limits starting October 31, with contracts scheduled to be paused on December 1, requiring developers to migrate to V2 before that deadline.
The underlying verification mechanism remains unchanged: After tokens are burned or locked on the source chain, Circle-operated signature service Iris issues a proof of transfer, based on which an equivalent amount of tokens is minted or unlocked on the destination chain. Third-party tokens use a separate set of entry contracts, with transfer rate limits, per-transaction caps, and pause rights enforced via independent management contracts for each token. Cross-chain fees are quoted on a per-transaction basis via Iris, and paid in the source chain’s native gas token.
Existing ERC-20 tokens do not require chain migrations to integrate, and can be configured as a "custom connection": Issuers can choose either a burn-and-mint model (which requires granting minting permissions to CCTP’s management contract) or a lock-and-unlock model on the token’s native chain, while all other supported chains default to burn-and-mint. Token ownership, pause permissions, and rate limits are all set by the issuer, with Circle explicitly stating in its documentation that it has no authority to take over these parameters.
New tokens can be deployed directly as native cross-chain tokens via the protocol. Assets without a dedicated active issuer, such as WETH, use a "no-owner connection" model: tokens are locked on their native chain, and wrapped versions are minted on other chains, with no default rate limits in place. Circle retains the right to take over operations in special scenarios such as security incidents.
Signature Verification Is Fully Centralized to Circle
By their underlying cross-chain mechanism, mainstream cross-chain bridges can be broadly divided into two categories.
The first category covers token standard and messaging protocols that execute token burning or locking on the source chain at the contract level, followed by minting of equivalent tokens on the destination chain. CCTP, LayerZero’s Omnichain Fungible Token (OFT) standard, Wormhole’s Native Token Transfer (NTT) protocol, and Chainlink’s Cross-Chain Transfer (CCT) built on its Cross-Chain Interoperability Protocol (CCIP) all fall into this group. The second category includes intent-based liquidity bridges such as Across and Relay, where market makers pre-fund transactions on the destination chain, with no required involvement from token issuers. By opening to third parties, CCTP is directly competing with players in the first category.
These token standards are largely similar in their asset models: New tokens use a burn-and-mint model, while tokens deployed without modifications to their native chain contracts use a lock-and-mint model across other chains, with issuers retaining control over rate limits and pause rights during custom configuration.
The core difference lies in which entity confirms the burning or locking event on the source chain: OFT allows issuers to select their own combination of Decentralized Verifier Network (DVN) nodes, with issuers such as Tether (USDT0), Ondo, and PayPal even running their own proprietary DVNs. Wormhole relies on signatures from at least 13 out of its 19 Guardian nodes. Chainlink’s default verification is performed by a committee network of 16 node operators, with the option to add additional verifiers. By contrast, all CCTP signatures are provided by Circle’s Iris service.
Verifier configuration directly impacts asset security. On April 18, 2026, KelpDAO’s OFT-based rsETH cross-chain bridge was exploited, resulting in approximately $292 million in losses. According to LayerZero’s post-incident statement, KelpDAO had only configured a single DVN — the one operated by LayerZero Labs — at the time of the attack. Exploitors compromised the RPC node used by this DVN to forge fraudulent cross-chain messages. Following the incident, KelpDAO migrated its cross-chain setup to Chainlink CCIP.
In an assessment published on the Aave governance forum in September 2026, risk assessment firm LlamaRisk noted that CCTP’s signature threshold is set to 2/2, with all signers fully controlled by Circle. The CrossChainTokenService contract on Arc is an upgradeable contract with no multi-sig or timelock protections, and all management contracts for individual tokens resolve their implementation logic through this core contract when executing calls. In other words, while parameters for custom connections are set by issuers, upgrade rights for the underlying core contract remain in Circle’s hands.
OFT allows issuers to configure their own set of verifiers, with flexibility on how many nodes to include. By contrast, CCTP does not allow — or even require — issuers to configure their own verifiers, relying entirely on Circle’s Iris service. For USDC holders, this setup introduces no new trusted entity. For other token issuers, however, integrating with CCTP means ceding full control of cross-chain verification to a single company: Circle.
Token Issuers Are in No Rush to Switch Bridges
While CCTP currently ranks first in cross-chain volume, nearly all of that volume comes from USDC itself. Outside of the USDC ecosystem, many large token issuers have already integrated with competing standards.
Per a June 2026 post from LayerZero, over 830 tokens have adopted the OFT standard, including Tether’s USDT0, Ethena’s USDe, PayPal’s PYUSD, and Ondo’s USDY. In October 2026, Canadian dollar stablecoin CADC also announced its adoption of the OFT standard.
Tether’s USDT cross-chain infrastructure is also built on OFT. USDT0 is issued by Everdawn Labs on the OFT standard, pegged 1:1 to USDT; Tether also made a strategic investment in LayerZero Labs in February 2026.
Since its launch, USDT0 crossed $100 billion in cumulative transaction volume as of June 2026, with DefiLlama recording a trailing 30-day cross-chain volume of $2.9 billion. For tokens already integrated with OFT, switching to CCTP would require full reconfiguration of contracts and minting permissions across every supported chain.
That is not to say issuers never switch bridges. KelpDAO, for example, migrated from LayerZero OFT to Chainlink CCIP following the rsETH exploit. As for intent-based bridges like Across and Relay, which recorded trailing 30-day volumes of $5.67 billion and $4.65 billion respectively, these tools only transfer existing tokens already present on the destination chain, and do not influence issuers’ choice of token standard.
Chain coverage is another limiting factor. Per Circle’s August announcement, the CCTP V2 version used for USDC supports 27 chains. However, according to Circle’s public contract address documentation, non-USDC tokens are currently only deployed on Ethereum, Avalanche, OP Mainnet, Arbitrum, Base, Polygon PoS, and Arc — all of which are EVM-compatible chains. By comparison, LayerZero disclosed in June 2026 that OFT tokens are already supported across over 170 chains.
With verification fully centralized to Circle, non-USDC tokens limited to transfer across only a small set of EVM chains, and a long list of large issuers already running production workloads on OFT, there is currently insufficient incentive for these issuers to make the switch to CCTP.