DPRK-linked hackers moved about $38 million through Relay Protocol in seven hours on Oct. 31, 2026, according to an on-chain analyst who tracked the flows. Research compiled on the incident found that approximately $38 million was bridged through Relay within that window. Relay's know-your-transaction (KYT) system was activated during the episode, but the illicit transfers reportedly continued without interruption.
Relay's role and the Tron trail
Relay Protocol is a cross-chain bridge that lets users send assets on one network and receive them on another. The protocol supports transfers across more than 85 networks, with a median processing time of approximately 2.7 seconds. One specific Tron address was identified in connection with the activity observed on Oct. 31, giving investigators and compliance teams a concrete thread to follow as they trace where the funds went next.
Comparison with THORChain
The findings also compare Relay with another cross-chain protocol. The same DPRK-linked actors previously failed to move comparable volumes as quickly on THORChain. Relay's cumulative volume exceeded $8.5 billion across 75 or more chains by early 2026, and its network coverage has since grown to more than 85 chains.
Broader DPRK activity
North Korean hacking groups have been tied to billions of dollars in crypto thefts over recent years. The research describes a pattern of increasing sophistication in DPRK cyber operations aimed at digital asset platforms. Multiple crypto outlets reported on the findings in the run-up to Nov. 1, 2026, putting Relay's compliance setup under closer scrutiny.
Compliance questions
The immediate question for Relay is whether its KYT system needs to do more than flag suspicious activity. The THORChain comparison suggests that some friction can change outcomes: if one route slows down a state-linked actor and another does not, the difference in controls is visible. The research flags potential for tighter scrutiny of compliance mechanisms, which could bring regulatory pressure, added volatility and liquidity challenges for platforms seen as weak links.
What to watch next
- Whether Relay publishes a response or adjusts how its KYT system acts on flagged funds.
- Where the Tron-linked funds surface after the bridge.
- Whether other protocols tighten their own controls before a similar episode occurs.
