$38 million moved across a bridge in 7 hours: even after the FBI called for interception, the stolen funds kept moving
First, the latest developments: according to tracking by on-chain analyst Specter, relayed by Wu Blockchain on November 1, North Korea-linked hackers moved about $38 million through the Relay cross-chain bridge in 7 hours, in activity that took place on October 31. The key point isn’t the amount—$38 million is only a fraction of the total $6.3 billion. The key points are twofold: first, Relay’s self-described KYT transaction monitoring system was switched on at the time, but failed to stop the transfers; second, the movement was still ongoing when the analysis became public. Relay has yet to provide a detailed response.
The contrast with yesterday’s other story makes the picture clearer: on October 31, THORChain mistakenly issued a double refund of 10 units of $ETH due to an Ethereum reorganization, triggering an emergency halt and objectively slowing the laundering of the same batch of stolen funds. One incident accidentally held them up; the other had safeguards in place by design, but they failed. The FBI’s October 31 warning called on the industry to block the associated addresses. Today’s news amounts to the first quantified evidence that the “call to action” fell short.
I should also make my view clear upfront: this is an analyst’s tracking conclusion, not official confirmation from the FBI or Relay, and the amount and route remain subject to official and on-chain verification. But the broader point is clear: simply “calling for interception” isn’t enough. If a bridge’s risk controls can spot suspicious activity but can’t stop it, then it effectively has no risk controls. Three things to watch next: whether Relay responds and adds blocking measures; where these bridged funds go next; and what Binance’s phased resumption of withdrawals today actually looks like—as of this round of research, there’s still no official word that withdrawals have actually begun to resume.
Prices before publication (Beijing time, November 1, 10:40; checked against two sources, both within ≤0.1%): $BTC at about $77,710 (24h +0.34%), $ETH at about $2,265.5 (24h +0.86%), and $BNB at about $702.5 (24h -0.35%). The broader market showed no unusual movement in response to this news.
Risk warning: movements of stolen funds are not market signals, and interception does not mean recovery. This article does not constitute investment advice.
One question, pick one: Should cross-chain bridges have the authority to directly freeze suspicious funds being bridged—yes or no?
#Binance #安全事件 #ETH #Cross-chainBridge
First, the latest developments: according to tracking by on-chain analyst Specter, relayed by Wu Blockchain on November 1, North Korea-linked hackers moved about $38 million through the Relay cross-chain bridge in 7 hours, in activity that took place on October 31. The key point isn’t the amount—$38 million is only a fraction of the total $6.3 billion. The key points are twofold: first, Relay’s self-described KYT transaction monitoring system was switched on at the time, but failed to stop the transfers; second, the movement was still ongoing when the analysis became public. Relay has yet to provide a detailed response.
The contrast with yesterday’s other story makes the picture clearer: on October 31, THORChain mistakenly issued a double refund of 10 units of $ETH due to an Ethereum reorganization, triggering an emergency halt and objectively slowing the laundering of the same batch of stolen funds. One incident accidentally held them up; the other had safeguards in place by design, but they failed. The FBI’s October 31 warning called on the industry to block the associated addresses. Today’s news amounts to the first quantified evidence that the “call to action” fell short.
I should also make my view clear upfront: this is an analyst’s tracking conclusion, not official confirmation from the FBI or Relay, and the amount and route remain subject to official and on-chain verification. But the broader point is clear: simply “calling for interception” isn’t enough. If a bridge’s risk controls can spot suspicious activity but can’t stop it, then it effectively has no risk controls. Three things to watch next: whether Relay responds and adds blocking measures; where these bridged funds go next; and what Binance’s phased resumption of withdrawals today actually looks like—as of this round of research, there’s still no official word that withdrawals have actually begun to resume.
Prices before publication (Beijing time, November 1, 10:40; checked against two sources, both within ≤0.1%): $BTC at about $77,710 (24h +0.34%), $ETH at about $2,265.5 (24h +0.86%), and $BNB at about $702.5 (24h -0.35%). The broader market showed no unusual movement in response to this news.
Risk warning: movements of stolen funds are not market signals, and interception does not mean recovery. This article does not constitute investment advice.
One question, pick one: Should cross-chain bridges have the authority to directly freeze suspicious funds being bridged—yes or no?
#Binance #安全事件 #ETH #Cross-chainBridge
