North Korean hackers move $38M through Relay Protocol in 7 hours

North Korean hackers move $38M through Relay Protocol in 7 hours

Relay's transaction screening system was switched on, but the DPRK-linked transfers kept flowing anyway

North Korean hackers moved about $38 million through Relay Protocol in seven hours, according to an on-chain analyst who tracked the flows. The activity took place on October 31, 2026.

Seven hours, $38 million, one bridge

Relay Protocol is a cross-chain bridge. Users send assets on one network and receive them on another. The protocol supports transfers across more than 85 networks, with a median processing time of approximately 2.7 seconds.

Research compiled on the incident found that approximately $38 million was bridged through Relay within the seven-hour window. Relay’s know-your-transaction (KYT) system was activated during the episode, yet the illicit transfers reportedly continued without interruption.

One specific Tron address was identified in connection with the activity observed on October 31. That detail matters because it gives investigators and compliance teams a concrete thread to pull on as they trace where the funds went next.

A tale of two protocols

The most telling part of the findings is a compar...