HTX rotates wallets to evade UK sanctions screening, TRM Labs reports
The sanctioned crypto exchange is swapping out hot wallets multiple times a day, turning traditional compliance tools into a game of whack-a-mole.
HTX has repeatedly shifted its onchain activity to new wallets across four blockchains following UK sanctions imposed in May, according to TRM Labs.
The blockchain intelligence firm found that the exchange has regularly replaced hot wallets and funding addresses across TRON, Ethereum, BNB Smart Chain and Solana.
Some addresses were retired within hours before activity moved to newly created wallets, TRM said.
HTX has continued operating under the same name throughout the process. The exchange has replaced infrastructure supporting deposits and customer withdrawals while keeping its public platform active.
TRM found that newly created HTX wallets may not appear immediately in sanctions screening databases. In some cases, the exchange had already moved activity to another address by the time a previously identified wallet was added to a screening list.
As a result, transactions involving newer HTX wallets may not trigger alerts from systems that rely only on previously identified addresses. TRM said most HTX activity following the designation could pass through screening systems that exclusively use static wallet lists.
The UK Foreign, Commonwealth and Development Office sanctioned Huobi Global SA, the entity behind HTX, on May 26 under regulations targeting support for the Russian government.
British authorities said they had reasonable grounds to suspect that Huobi Global provided financial services or resources to companies within the A7 network, including A7 LLC and sanctioned crypto exchange Garantex.
The UK alleged that HTX processed about $1.5 billion for Kremlin aligned entities. The action formed part of Operation Destabilize, a National Crime Agency effort targeting financial networks used to move money on behalf of Russia.
According to TRM, the designation marked the first time the UK had sanctioned a crypto exchange of HTX’s size and the first application of Regulation 17A against a crypto trading platform.
TRM also compared HTX’s activity with other sanctioned crypto businesses.
Following a multinational enforcement action in March 2025, Garantex operators shifted activity to a separate platform called Grinex, while liquidity moved through the ruble pegged A7A5 token.
HTX has retained its brand while replacing wallets supporting its existing operations. TRM said the activity was similar to wallet rotation used by Garantex following its designation in 2022.
TRM said compliance firms are increasingly examining transaction patterns and connections between wallets to identify newly created addresses associated with sanctioned entities.
The UK sanctions apply directly to companies and individuals under British jurisdiction, which are subject to asset freezes and reporting requirements.
HTX has not been sanctioned by the US Treasury or the European Union, meaning compliance obligations differ outside the UK.