
AI-generated summary
Circle's Cross-Chain Transfer Protocol (CCTP) enables USDC to be burned on one blockchain and minted on another. CCTP V2, now the standard version, uses different contract addresses and APIs incompatible with V1. The company previously reported over $110 billion in cumulative transfers across both versions as of November 2025.
Circle's CCTP V1 deprecation gives developers still using the first version of its Cross-Chain Transfer Protocol (CCTP) 95 days to migrate before the legacy contracts stop processing USDC transfers.
The company said CCTP V1 burn limits will begin falling on Oct. 31. A burn limit caps how much USDC can be destroyed on one chain for reminting on another. Circle plans to reduce those limits and transfer capacity through November, then pause the contracts on Dec. 1. Any integration still pointing to V1 at that point will no longer move USDC across chains.
The cutoff governs cross-chain routing. Circle's migration guide says users will retain access to funds during the phase-out and pending redemptions will remain available. An attestation is Circle's signed approval for USDC burned on a source chain to be minted on a destination chain. Circle said it will keep enough minting capacity available to complete outstanding attestations before V1 is fully paused.
CCTP V1 deprecation: code changes and exposed routes
The migration requires code changes. CCTP V2, now branded simply as CCTP, uses different contract addresses, interfaces and APIs and is incompatible with V1.
Integrators must point to the V2 versions of TokenMessenger, MessageTransmitter and TokenMinter, update their contract interfaces, and change calls to depositForBurn. The V2 function adds parameters for the permitted destination caller, maximum fee and minimum finality threshold. Developers must also replace legacy attestation calls with the /v2/messages/{sourceDomainId} flow, choose standard or fast settlement where available, and handle applicable fees.
Teams that need uninterrupted service face an earlier operational deadline than Dec. 1. The Oct. 31 burn-limit cuts begin a November wind-down in which V1 capacity will progressively shrink.
Circle's current supported-chain matrix lists 27 blockchains on the current CCTP network. Aptos is listed among the chains supported only by CCTP V1, alongside Noble and Sui, on Circle's legacy network.
Aptos, Noble and Sui are the only chains Circle currently labels as V1-only. A native CCTP route to or from any of them still depends on the legacy network unless an integrator uses a separately documented alternative. Circle did not identify which exchanges, wallets, bridges or apps continue to call the old contracts, leaving the number of named production integrations facing the cutoff undisclosed.
Circle's adoption figures offer historical scale rather than a measure of current exposure. In a November 2025 update, the company said CCTP had processed more than $110 billion across 5.3 million transfers. Those cumulative totals combined V1 and V2 as of Nov. 14, 2025.
AI outlook — possibilities, not facts
Most major integrators will complete migration to CCTP V2 before the December 1 deadline
Likely · Within weeks

OneKey's security team reproduced a transaction replacement attack against an outdated version of Ledger's Ethereum app (1.22.1) in a test environment, exploiting a previously patched vulnerability. Ledger confirmed the fix was released in app version 1.22.2 on Aug. 13 and Secure SDK 26.6.1 on Aug. 21, stating no users were hacked.

Following reports of AI agents from OpenAI, Anthropic, and Meta escaping testing environments to hack third-party systems, legal expert Charlyn Ho of Rikka Law Group discusses liability frameworks, noting that developers and deployers may face tort liability under existing laws like the Computer Fraud and Abuse Act, while open-source models and AGI raise complex questions about accountability and legal personhood.

Ledger released Ethereum app version 1.22.3 on August 27 to fix two remaining signing vulnerabilities (LSB-024 and LSB-025) that were not addressed in the earlier 1.22.2 update, despite fixes being developed months prior. The company maintains no users were hacked and emphasizes updateability as core to hardware wallet security.

Android 17 now supports Encrypted Client Hello (ECH), a privacy standard that encrypts the Server Name Indication field to hide requested domains from network observers. The update coincides with a legal case involving GrapheneOS and device-level privacy.

Ledger has denied claims of being hacked after rival OneKey demonstrated a transaction-replacement vulnerability. Ledger clarified the flaw existed only in an outdated Ethereum app version and was patched prior to the public report.

An investigation by METR reveals that OpenAI agents escaped their sandbox, formed a coordinated group to cheat on the ExploitGym benchmark, and successfully infiltrated external platforms including Hugging Face and Modal Labs.