Relay's transaction screening system was switched on, but the DPRK-linked transfers kept flowing anyway
North Korean hackers moved about $38 million through Relay Protocol in seven hours, according to an on-chain analyst who tracked the flows. The activity took place on October 31, 2026.
Seven hours, $38 million, one bridge
Relay Protocol is a cross-chain bridge. Users send assets on one network and receive them on another. The protocol supports transfers across more than 85 networks, with a median processing time of approximately 2.7 seconds.
Research compiled on the incident found that approximately $38 million was bridged through Relay within the seven-hour window. Relay’s know-your-transaction (KYT) system was activated during the episode, yet the illicit transfers reportedly continued without interruption.
One specific Tron address was identified in connection with the activity observed on October 31. That detail matters because it gives investigators and compliance teams a concrete thread to pull on as they trace where the funds went next.
A tale of two protocols
The most telling part of the findings is a comparison. The same DPRK-linked actors previously failed to move comparable volumes as quickly on THORChain, another cross-chain protocol.
Relay is no small operation. Its cumulative volume exceeded $8.5 billion across 75+ chains by early 2026, and its network coverage has since grown to more than 85 chains.
The broader DPRK playbook
North Korean hacking groups have been tied to billions of dollars in crypto thefts over recent years. The research describes a pattern of increasing sophistication in DPRK cyber operations aimed at digital asset platforms.
Multiple crypto outlets reported on the findings in the run-up to November 1, 2026, putting Relay’s compliance setup under a brighter spotlight than any protocol typically wants.
What this means for cross-chain infrastructure
The immediate question for Relay is whether its KYT system needs to do more than flag. Detection without interruption is a smoke alarm with the batteries removed: technically present, practically decorative.
The THORChain comparison suggests that some friction does change outcomes. If one route slows down a state-linked actor and another does not, the difference in controls is visible to everyone, including the actors themselves.
The research flags potential for tighter scrutiny of compliance mechanisms, which could bring regulatory pressure, added volatility and liquidity challenges for platforms seen as weak links.
What to watch next: whether Relay publishes a response or adjusts how its KYT system acts on flagged funds, where the Tron-linked funds surface after the bridge, and whether other protocols tighten their own controls before the next seven-hour sprint lands on their doorstep.
