Suspected North Korean hackers reportedly transferred $38 million through Relay Protocol in seven hours. The activity raises questions about Relay’s ability to interrupt high-risk transaction
Suspected North Korean hackers moved approximately $38 million through Relay Protocol in seven hours, according to on-chain investigator Specter, raising concerns about the effectiveness of transaction-screening controls in cross-chain infrastructure.
Relay’s compliance and team are so bad that DPRK manage to bridged $38M (still bridging) in just 7 hours through the @RelayProtocol Bridge, and they couldn’t stop it despite claiming to have an active KYT system.
DPRK couldn’t laundered that amount within such a short timeframe through THORChain, but Relay opened the door.
so bad for you guys….
Address: TNhpfKq83wufEKGjBhQFnT7jnxYmyBzH6F
Stay Relay.
— Specter (@SpecterAnalyst) October 31, 2026
The transfers were reportedly still ongoing when the findings emerged. On-chain monitoring accounts, including Lookonchain, subsequently highlighted activity associated with the suspected attackers.
Specter questioned why Relay’s Know Your Transaction (KYT) monitoring had not prevented the movement of funds. The reported amount remains investigator-attributed, with no independently reconciled transaction list establishing the complete flow.
Relay facilitates transfers between blockchain networks using a model in which specialized participants, known as solvers, complete transactions on behalf of users.
According to Relay’s technical documentation, the process involves a deposit on the originating blockchain and a corresponding transaction executed by a solver on the destination network.
This arrangement reduces the steps required to move assets across chains. It also creates a narrow window for compliance intervention.
A suspicious wallet can be identified by a monitoring system, but that information must reach the execution process before the destination payment is completed. Once a solver has settled the transfer, blocking the original transaction may no longer prevent the recipient from accessing the assets.
Relay’s terms of service reserve the right to block, delay or suspend transactions based on sanctions screening and other risk assessments.
The unanswered issue is whether Relay flagged the relevant wallets before execution, alerted its solvers in time and had the technical means to stop settlement.
The available reporting does not establish which of those controls, if any, failed during the suspected transfers.
The reported figures imply a substantial rate of cross-chain movement.
On-Chain Activity Relay Protocol: Reported Transfer Activity Suspected North Korea-linked fund movements Metric Value Total transfers $38M Observation period 7 hours Average hourly flow $5.43M Average flow per minute ~$90,500 Equivalent 15-minute flow ~$1.36M Source: Specter’s reported transfer volume and observation period. Shorter-period values are calculated averages, not verified transaction rates.At that average pace, a 15-minute delay in identifying or acting on suspicious activity would correspond to roughly $1.36 million in transfers, assuming activity continued at the same rate.
That does not mean Relay experienced a 15-minute detection delay. The calculation illustrates how quickly the value of an intervention can diminish when transfers are automated.
Transaction-level evidence would provide a more useful assessment than the aggregate figure alone. Source-chain deposits, destination-chain payments, execution timestamps and wallet-risk classifications could reveal whether the transfers passed through screening before suspicious activity was identified.
The available reporting does not establish whether the reported funds remained under the attackers’ control after reaching their destination networks or were subsequently converted through other services.
Specter argued that the suspected attackers would have struggled to move the same amount through THORChain over a comparable period.
The comparison draws attention to differences in cross-chain liquidity and execution capacity, but it does not establish that THORChain maintains stronger anti-money-laundering controls.
Transfer volume depends on several factors, including available liquidity, supported assets, route capacity and network conditions.
A protocol that processes fewer transactions may simply have less available liquidity. Conversely, faster execution does not necessarily indicate inadequate screening.
A meaningful compliance comparison would require evidence that the same high-risk addresses attempted transfers through both protocols and that one service rejected transactions the other permitted.
Without those records, the reported difference in throughput remains a useful investigative lead rather than proof of a specific compliance failure.
The reported activity concerns the movement of suspected illicit funds through Relay, not a confirmed exploit of the protocol’s smart contracts.
There is no established evidence in the reviewed reports that ordinary Relay users lost assets because of these transfers.
That distinction separates two types of risk.
Technical security risk concerns whether attackers can exploit smart contracts, drain liquidity or compromise customer assets.
Compliance and counterparty risk concerns whether a service can identify and restrict transactions associated with stolen funds, sanctioned entities or other prohibited activity.
For ordinary users, the allegations do not establish that Relay’s contracts are unsafe. For liquidity providers, exchanges and institutional counterparties, however, unresolved questions about screening effectiveness could influence risk assessments and decisions about interacting with particular wallets or routes.
The most consequential evidence would be a transaction-level account from Relay showing when the suspected addresses were screened, whether alerts were generated and whether any transfers were blocked.
Until that information is available, the reported $38 million flow demonstrates the scale of activity investigators are examining, but not the precise cause of any failure to intervene.
The post North Korea Hackers Route Millions via Relay KYT Gaps appeared first on ETHNews.
