North Korean hackers moved approximately $38 million through Relay Protocol over a seven-hour window, according to an on-chain analyst who tracked the flows. The transfers took place on October 31, 2026.

Seven Hours, $38 Million, One Bridge

Relay Protocol is a cross-chain bridge that allows users to send assets on one network and receive them on another. The protocol supports transfers across more than 85 networks, with a median processing time of approximately 2.7 seconds.

Research compiled on the incident found that roughly $38 million was bridged through Relay within the seven-hour period. Relay's know-your-transaction (KYT) system — a compliance layer that screens transfers against watchlists of addresses tied to illicit activity — was activated during the episode, yet the illicit transfers reportedly continued without interruption.

One specific Tron address was identified in connection with the activity observed on October 31. That detail matters because it gives investigators and compliance teams a concrete thread to pull on as they trace where the funds moved next.

A Tale of Two Protocols

Among the most telling findings is a comparison: the same DPRK-linked actors previously failed to move comparable volumes as quickly on THORChain, another cross-chain protocol.

Relay is no small operation. Its cumulative volume exceeded $8.5 billion across more than 75 chains by early 2026, and its network coverage has since grown to more than 85 chains.

The Broader DPRK Playbook

North Korean hacking groups have been tied to billions of dollars in cryptocurrency thefts in recent years. The research describes a pattern of increasing sophistication in DPRK cyber operations targeting digital asset platforms. Bridges have repeatedly drawn that attention: the 2022 Ronin Bridge exploit, attributed by U.S. authorities to the Lazarus Group, drained roughly $600 million and cemented cross-chain infrastructure as a fixture on the sector's threat map.

Multiple crypto outlets reported on the findings in the run-up to November 1, 2026, placing Relay's compliance setup under a brighter spotlight than protocols typically attract.

What It Means for Cross-Chain Infrastructure

The immediate question for Relay is whether its KYT system needs to do more than flag suspicious transactions. The analysis likens detection without interruption to a smoke alarm with the batteries removed: technically present, practically decorative. Relay's own profile — settlement in roughly 2.7 seconds across more than 85 networks — shows why flagging a transfer and stopping one are two different capabilities at that pace.

The THORChain comparison suggests that some degree of friction does change outcomes. If one route slows down a state-linked actor while another does not, the difference in controls is visible to everyone, including the actors themselves.

The research also flags potential for tighter scrutiny of compliance mechanisms, which could bring regulatory pressure along with added volatility and liquidity challenges for platforms perceived as weak links.

What to Watch Next

Open questions include whether Relay publishes a response or adjusts how its KYT system acts on flagged funds, where the Tron-linked funds surface after leaving the bridge, and whether other protocols tighten their own controls before the next seven-hour sprint lands on their doorstep.

Source: CryptoBriefing