Crypto exchange HTX rebuilt parts of its wallet infrastructure in the weeks after the U.K. sanctioned the entity behind it, rapidly rotating deposit and hot wallets in a way that makes static address screening hard to maintain, blockchain intelligence firm TRM Labs said in a report published Tuesday.
TRM said HTX had effectively “rebuilt its on-chain plumbing,” leaving address-list screening unable to keep up.
Wallet activity shifted after the U.K. designation
The Office of Financial Sanctions Implementation, or OFSI, designated Huobi Global S.A. on May 26. The U.K. identified that company as the entity behind HTX. It was the first time Britain had applied that measure to a crypto exchange of that size.
The sanctions package targeted crypto exchanges and the “A7 network,” which British authorities said was used by Russia to evade existing restrictions and move funds supporting its invasion of Ukraine. In its announcement, the U.K. government described HTX as a “major global cryptocurrency exchange” suspected of having channeled more than $1.5 billion to the Kremlin.
According to TRM, HTX stayed live under the same brand in the weeks that followed, but began cycling wallets across TRON, Ethereum, BNB Smart Chain, and Solana. Each hot wallet and funding address was retired within hours, the firm said, with activity redirected to fresh addresses.
TRM described the result as a “continuous moving target.” A block list built around specific HTX addresses, it said, can go stale within hours because most of the exchange activity conducted after the designation now flows through wallets that were not previously identified. In TRM’s view, screening only keeps pace when it tracks the behavior behind the rotating wallets and recognizes each new address as it appears.
TRM compared the pattern with other sanctioned entities
TRM said the response fits a pattern it has tracked among sanctioned entities with substantial resources. Those entities rarely disappear outright, the firm said, and usually adjust their operating methods instead.
The report compared HTX’s wallet rotation with the playbook used by Russian exchange Garantex after its own designation. After a March 2025 takedown, TRM said, Garantex operators launched a successor called Grinex and moved liquidity through the ruble-pegged stablecoin A7A5. HTX took a different route, according to the report: it kept the same brand while rebuilding at the wallet level.
TRM also noted that HTX has not been designated by the U.S. Treasury’s Office of Foreign Assets Control, or OFAC, nor by the European Union. That means formal asset-freeze obligations apply only to firms regulated in the U.K., even as TRM urged others to treat HTX as presenting an “elevated sanctions-evasion risk.”
HTX said the activity was routine security work
An HTX spokesperson told Decrypt that the conduct described in the report was benign. “The technical activities referenced in TRM's report reflect routine, security-driven platform operations common across the industry,” the spokesperson said. “We categorically reject any characterization implying otherwise and have no further comment.”
HTX had already challenged the U.K. action after the May designation. At the time, the exchange told Decrypt that Huobi Global S.A., the listed entity, is “distinct from the online HTX exchange,” and said user funds were safe and global operations were unaffected. OFSI, however, said it considers HTX subject to U.K. financial sanctions because of its ownership by Huobi.
Separate U.K. enforcement action also hit HTX this year
Separately, the U.K. Financial Conduct Authority, or FCA, launched enforcement action against HTX earlier this year over illegal financial promotions aimed at British customers. That move led the exchange to restrict new sign-ups from the U.K.
HTX is owned and advised by crypto entrepreneur Justin Sun. The report noted that Sun’s U.S. fraud case was settled with the Securities and Exchange Commission earlier this year. HTX reported more than $3 trillion in trading volume in 2025.