TLDR
- North Korean hackers moved about $38 million in crypto through Relay Protocol in roughly seven hours on October 31, 2026.
- Relay’s Know Your Transaction (KYT) monitoring system was active, but the transfers reportedly kept going.
- On-chain analyst Specter said the same moves would have been harder on THORChain.
- One Tron address was linked to the activity, giving investigators a trail to follow.
- Relay has not given a detailed explanation or said whether it took further action.
North Korean hackers moved about $38 million in crypto through Relay Protocol in roughly seven hours, according to an on-chain analyst. The activity took place on October 31, 2026.
North Korean Hackers Moved $38M Through Relay Protocol in 7 Hours
On-chain analyst Specter reported that North Korean hackers transferred approximately $38 million through Relay Protocol within seven hours, with transfers still ongoing at the time of the post. Despite Relay’s… pic.twitter.com/m1myYDL2Re
— Wu Blockchain (@WuBlockchain) November 1, 2026
Wu Blockchain reported the findings on Nov. 1. It said analyst Specter tracked the flows, and the transfers were still ongoing when the analysis was made public.
How the Transfers Moved Through Relay
Relay Protocol is a cross-chain bridge. Users send assets on one network and receive them on another. The protocol supports transfers across more than 85 networks.
The protocol has a median processing time of about 2.7 seconds. Its cumulative volume passed $8.5 billion across 75 or more chains by early 2026.
Relay has said it runs a Know Your Transaction, or KYT, monitoring system. Research on the incident found the system was active during the episode. The transfers reportedly continued without interruption.
One Tron address was identified in connection with the activity seen on October 31. That detail gives investigators and compliance teams a starting point for tracing where the funds went next.
Specter said moving such a large amount in that time frame would have been harder on THORChain. THORChain is another cross-chain protocol.
The research found the same North Korea-linked actors previously failed to move comparable volumes as quickly there.
Questions Over Relay’s Safeguards
The case has raised questions about whether Relay’s anti-money-laundering and risk-management systems work as intended. It has also renewed debate over how cross-chain protocols block illicit fund flows.
North Korean hacking groups have been tied to billions of dollars in crypto thefts in recent years. The research describes a pattern of rising sophistication in their attacks on digital asset platforms.
Multiple crypto outlets reported on the findings in the lead-up to Nov. 1. Relay’s compliance setup drew attention as a result.
Market data cited in one report showed the Fear Index at 34. It also noted rising Bitcoin dominance and a shift to net outflows of the South Korean won.
One forecast in that report rated the short-term outlook as negative, with a confidence level of 48%. It rated the mid-term and long-term outlooks as neutral.
Relay has not provided a detailed explanation. It was not clear whether the company had taken additional action on the transactions.
As of Nov. 1, no update on the Tron-linked funds or on any change to Relay’s KYT system had been reported.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
