North Korea's crypto operators moved about $38 million in stolen funds through Relay Protocol in roughly seven hours, on-chain analyst Specter reported in work surfaced by WuBlockchain on November 1, 2026. The dollar figure is mid-sized by the standards of state-linked theft. The timeline is the part worth sitting with.
The protocol was a conduit, not a victim
Nothing in Specter's report says Relay Protocol was hacked. The $38 million was already stolen by the time it reached the protocol. Relay, a cross-chain routing layer that lets users bridge value between networks, was the pipe the money ran through, not the hole it leaked from. That distinction matters. Coverage of incidents like this often blurs "a protocol was exploited" with "a protocol was used," and the two call for different responses. A compromised bridge needs a code fix. A bridge used for laundering needs monitoring, address screening, and faster coordination between the protocol, exchanges, and investigators.
For readers who hold crypto, the takeaway is not that Relay failed. It is that the tooling built to make cross-chain transfers fast and frictionless works exactly as well for someone washing stolen coins as it does for a legitimate user. Neutral infrastructure does not check motive.
Seven hours is the real signal
Consider what a seven-hour laundering run compresses. This next part is analysis rather than a direct claim from the report, but the direction is hard to argue with. In older playbooks, moving tens of millions across chains and through mixers could take days. That lag gave exchanges, analytics firms, and investigators a window to flag deposit addresses and freeze funds before they cashed out. A seven-hour cycle closes most of that window. By the time a report is written and circulated, the money has already been split and forwarded.
The practical result is a shift in what on-chain tracing is good for. It stays useful for attribution, tying a flow back to a known group. It gets weaker as a recovery tool, because recovery depends on reaching funds while they are still reachable. When the clock runs in hours instead of days, after-the-fact tracing arrives after the fact in a way that actually bites.
Cross-chain routing has become the laundromat of choice
State-linked groups favor cross-chain routers for a reason that is more operational than clever. Splitting a hoard across several blockchains breaks the single-chain trail that most automated tracing depends on. Each hop adds a network to reconcile, a fresh set of addresses to cluster, and another venue that may or may not cooperate with an investigation. Relay is one of several protocols that make those hops cheap and near-instant. The same design choices that let a trader rebalance across chains in one click let an adversary scatter stolen value before anyone can react.
None of that makes routing protocols illegitimate, and it is worth being precise here rather than painting the category as dirty. These are rails, and rails carry whatever traffic shows up. The uncomfortable part is that the efficiency everyone wanted from cross-chain tooling is the same efficiency an attacker needs.
Control is still the only thing you own
The through-line for ordinary users sits upstream of the laundering, at the moment of theft. Funds that get washed through Relay were taken from somewhere first, usually a custodial account, an exchange balance, or a compromised signer. People who keep assets in self-custody setups and sign transactions deliberately pull themselves out of the largest honeypots that state-linked crews target. That is not a guarantee. Self-custody shifts the risk onto your own key hygiene rather than erasing it, and a leaked seed phrase launders just as fast as a drained exchange.
If you use crypto-linked cards or park a spending balance on an exchange, treat that balance as hot money: the amount you are willing to expose, not your full stack. The $38 million that ran through Relay is a reminder that once funds leave your control and land in an attacker's, the race to recover them is now measured in hours, and the people on the other side have automated their half of it.
Overview
DPRK-linked hackers routed roughly $38 million in stolen crypto through Relay Protocol in about seven hours, per on-chain analyst Specter in findings surfaced by WuBlockchain. Relay was the conduit, not the target. The speed is the warning: cross-chain routing now moves illicit funds faster than tracing and freezing can respond, which turns on-chain forensics into an attribution tool more than a recovery one. For users, the defensible ground is upstream, in how and where funds are held before they can be stolen at all.
