North Korean Hackers Move $38 Million via Relay Protocol in Just Seven Hours

On October 31, 2026, North Korean hackers successfully moved around $38 million through the Relay Protocol in a span of just seven hours, according to an analysis by an on-chain expert. This incident has drawn attention to the effectiveness of Relay's compliance systems, specifically its know-your-transaction (KYT) features.

Relay Protocol is a cross-chain bridge that facilitates asset transfers across more than 85 networks, with an average processing time of about 2.7 seconds. Despite the activation of its KYT system during the illicit transfers, the hackers managed to continue their operations without interruption.

Research into the incident highlighted a specific Tron address linked to the activity, providing a potential lead for investigators. This event marks a significant moment in the ongoing scrutiny of North Korean cyber operations, which have been increasingly sophisticated in targeting digital asset platforms.

In contrast to previous attempts by DPRK-linked actors to transfer funds through THORChain, which were less effective, Relay's infrastructure allowed for a rapid movement of large sums. The incident raises critical questions about the adequacy of compliance measures within cross-chain protocols and the potential for regulatory scrutiny.

Moving forward, the focus will be on whether Relay will enhance its KYT system's response to flagged transactions and how other platforms might adjust their compliance protocols in light of this incident.