North Korean Hackers Moved $38 Million Through Relay Protocol in Seven Hours

North Korean hackers moved about $38 million through Relay Protocol in seven hours on October 31, 2026, according to an on-chain analyst who tracked the flows. Crypto Briefing reported the transfers took place while the bridge's transaction screening was switched on.

How the Relay Transfers Unfolded

Relay is a cross-chain bridge: users send assets on one network and receive them on another. The protocol supports transfers across more than 85 networks, with a median processing time of approximately 2.7 seconds, according to the report. Research compiled on the incident found that approximately $38 million was bridged through Relay within the seven-hour window.

Relay's know-your-transaction (KYT) system was activated during the episode, yet the illicit transfers reportedly continued without interruption. One specific Tron address was identified in connection with the activity observed on October 31. That detail gives investigators and compliance teams a concrete thread to pull on as they trace where the funds went next.

The findings also compare Relay with THORChain, another cross-chain protocol. The same DPRK-linked actors previously failed to move comparable volumes as quickly on THORChain. Relay's cumulative volume exceeded $8.5 billion across 75+ chains by early 2026, and its network coverage has since grown to more than 85 chains.

Relay's Earlier Cross-Chain Moves

Pump.fun replaced Relay with its own Pump Bridge for cross-chain trades on October 21, 2026, Crypto Briefing reported. Internal tests showed Pump Bridge executes trades about twice as fast and cuts errors by 92%, reducing the error rate from over 10% to below 1%, and the platform charges no extra bridging fees.

Relay, described as a blockchain settlement layer for onchain payments, had processed over $20 billion in crosschain volume across more than 100 million transactions on 85+ blockchain networks, Coingecko reported on June 5, 2026. That made it the number one source of transactions on the Base network.

Other Crypto Security Incidents This Week

Hackers hijacked 12 DeFi websites registered with Name.com and stole about $138,000 in crypto, TradingView reported on October 31, 2026. Ten domains were suspended, and the attack used Step Drainer malware.

Chainalysis disclosed on October 31, 2026 that an AI-assisted hacker accessed customer names and emails, The Block reported. The firm found no evidence of access to investigation contents or unencrypted passwords.

CFTC Chairman Michael Selig said blockchain records give investigators a strong chance of tracing funds stolen in the Binance hack, which cost about $6.34 billion, TradingView reported on October 30, 2026.

What to Watch After the Relay Flows

The report flags whether Relay publishes a response or adjusts how its KYT system acts on flagged funds, and where the Tron-linked funds surface after the bridge. It also raises whether other protocols tighten their own controls.