Analyst Says North Korean Hackers Moved $38M Through Relay Protocol in 7 Hours Despite Its Transaction Monitoring

Since the on-chain activity began on Oct. 31, on-chain analyst Specter says North Korean hackers have run about $38 million in crypto through Relay Protocol in roughly seven hours. Wu Blockchain relayed his findings at 01:42 UTC on Nov. 1, and he said the transfers were still going at the time of his post.

Relay is a cross-chain bridge. A user sends assets on one network and receives them on another. The protocol supports more than 85 networks, with a median processing time of about 2.7 seconds. Its cumulative volume passed $8.5 billion across 75-plus chains by early 2026.

That speed is the product. It is also the problem.

What Specter says happened

Specter's central charge is that Relay says it runs a Know Your Transaction (KYT) monitoring system, and that system did not block the transfers. Crypto Briefing's write-up of the research goes further and says the KYT system was active during the episode while the DPRK-linked transfers kept moving.

The research also identifies one specific Tron address tied to the activity observed on Oct. 31. That gives compliance teams and investigators a concrete lead to follow.

Specter also drew a comparison with THORChain, another cross-chain protocol. He said North Korean hackers would have struggled to move that much value through THORChain in the same window. He did not lay out the technical reason for the difference.

The attribution to North Korea rests on Specter's analysis. No government statement connecting these particular flows to Pyongyang appears in the reporting, and the original theft the money came from has not been identified.

Relay was used, not necessarily breached

Nobody has said Relay was hacked. The crypto outlet SpendNode, in its own analysis, points out that the $38 million was already stolen before it reached the protocol. On that reading, Relay was the pipe the money ran through, not the hole it leaked from.

SpendNode argues the two situations call for different fixes. A compromised bridge needs a code patch. A bridge used for laundering needs address screening, monitoring and faster coordination with exchanges and investigators. In its words, neutral infrastructure "does not check motive."

That is a fair description of how bridges work. It does not answer why a monitoring system that Relay says it runs did not stop flows Specter says were identifiable as North Korean.

Relay has not provided a detailed explanation. It is not clear whether the protocol has taken any further action on the transactions, such as blocking the flagged address or freezing anything it could reach.

Why seven hours matters

Speed cuts into the time investigators have to act. SpendNode's analysis, which it labels as its own inference rather than a finding from Specter's report, is that older laundering runs through chains and mixers could take days. That lag gave exchanges and analytics firms a window to flag deposit addresses before cash-out.

A seven-hour cycle shrinks that window. By the time a report circulates, funds can already be split and forwarded.

Splitting a pile of stolen crypto across several blockchains also breaks the single-chain trail that most automated tracing relies on. Each hop adds a network to reconcile and another venue that may or may not cooperate. Tracing still works for attribution. It works less well for recovery.

Crypto Briefing says the research points to possible tighter scrutiny of compliance mechanisms, which could bring regulatory pressure and liquidity challenges for platforms seen as weak links. That is a forecast from the outlet, not an announced action. No regulator has announced an investigation of Relay, and no charges have been filed against it.

What to watch

Three things will show whether this was a one-night embarrassment or a lasting problem for Relay.

First, whether Relay publishes a response and changes how its KYT system treats flagged funds, moving from flagging to blocking.

Second, where the money tied to the identified Tron address surfaces after leaving the bridge. If it reaches exchanges that freeze it, the exposure is limited. If it keeps hopping, the seven-hour run becomes a template.

Third, whether Specter or other analysts publish a final tally. The $38 million figure covers the first seven hours, and he said the transfers had not stopped when he posted.