NewsCryptoHTX Rotated On-Chain Wallets After UK Sanctions, TRM Labs Says

HTX Rotated On-Chain Wallets After UK Sanctions, TRM Labs Says

Author: Decrypt·

Key Takeaways

  • TRM Labs reported that HTX rotated wallets across four blockchains and retired each address within hours after UK sanctions, creating what it called a continuous moving target for compliance screening.
  • The UK Office of Financial Sanctions Implementation designated Huobi Global S.A. on May 26, 2025, marking the first UK sanctions action against a crypto exchange of that scale over suspected Russian sanctions evasion exceeding $1.5 billion.
  • HTX stated the wallet rotation reflected routine security-driven operations and rejected any characterization implying otherwise, while maintaining that the sanctioned entity is distinct from the online exchange.
  • Neither the US Treasury's OFAC nor the European Union has designated HTX, meaning asset-freeze obligations currently apply only to UK-regulated firms.
  • TRM Labs compared HTX's infrastructure rebuild to Garantex's post-sanctions approach, noting that well-resourced sanctioned entities typically adapt rather than disappear.
HTX Rotated On-Chain Wallets After UK Sanctions, TRM Labs Says

Blockchain intelligence firm TRM Labs, whose sanctions-screening tools are used by crypto exchanges and financial institutions worldwide, said in a Tuesday report that crypto exchange HTX continued operating under the same brand after UK sanctions while rebuilding its on-chain infrastructure.

According to TRM Labs, HTX rotated deposit and hot wallets across TRON, Ethereum, BNB Smart Chain, and Solana in the weeks after the sanctions, creating a “continuous moving target for compliance professionals.” The exchange told Decrypt that the activity reflected “routine, security-driven platform operations” and rejected any characterization suggesting otherwise.

TRM said HTX had “rebuilt its on-chain plumbing,” arguing that conventional address-list screening “cannot keep pace” when wallets are retired and replaced rapidly.

The UK’s Office of Financial Sanctions Implementation designated Huobi Global S.A., the entity behind HTX, on May 26. It was the first time the UK had applied such a measure to a crypto exchange of that size. The sanctions package targeted crypto exchanges and the “A7 network,” which British authorities said was “used by Russia to evade existing restrictions” and move funds to support its invasion of Ukraine. In its announcement, the UK government described HTX as a “major global cryptocurrency exchange” suspected of having channeled more than $1.5 billion to the Kremlin.

A moving target

TRM Labs said that, in the weeks after the designation, HTX remained active under the same brand but began cycling wallets across TRON, Ethereum, BNB Smart Chain, and Solana. The firm said the exchange retired each hot wallet and funding address within hours, then shifted activity to newly created addresses.

The result, TRM said, is a “continuous moving target.” A block list based on specific HTX addresses “goes stale within hours,” the firm said, and would miss most of the activity the exchange has processed since the designation because the flows move through addresses not yet captured by existing lists. The challenge highlights a structural gap between traditional and crypto-based sanctions enforcement: while conventional measures rely on freezing assets held at identifiable institutions, blockchain infrastructure can be reconstituted rapidly through addresses not yet linked to any known entity.

TRM argued that screening can keep pace only when it tracks the behavior behind rotating wallets and identifies each new address as it appears. The firm presented HTX’s response as part of a broader pattern it has observed among well-resourced sanctioned entities, which it said rarely disappear and often adapt their infrastructure.

The report compared HTX’s wallet rotation with the approach used by Russian exchange Garantex after its own designation. Following a March 2025 takedown, Garantex operators launched a successor, Grinex, and moved liquidity through A7A5, a ruble-pegged stablecoin. HTX, by contrast, continued using the same brand while rebuilding at the wallet level, TRM said.

TRM also noted that neither the U.S. Treasury’s Office of Foreign Assets Control nor the European Union has designated HTX. As a result, freeze obligations apply only to UK-regulated firms, although TRM urged other institutions to treat the exchange as an “elevated sanctions-evasion risk.”

HTX responds

An HTX spokesperson told Decrypt that the activity described in the report was benign.

“The technical activities referenced in TRM's report reflect routine, security-driven platform operations common across the industry,” the spokesperson said. “We categorically reject any characterization implying otherwise and have no further comment.”

HTX has previously challenged the UK action. After the May designation, the exchange told Decrypt that the listed entity, Huobi Global S.A., is “distinct from the online HTX exchange,” and said user funds were safe and global operations were unaffected. OFSI, however, emphasized that it considers HTX subject to UK financial sanctions because of its ownership by Huobi.

Separately, the UK’s Financial Conduct Authority launched enforcement action against HTX earlier this year over illegal promotions to British customers, prompting the exchange to restrict new UK sign-ups.

HTX is owned and advised by Justin Sun, the billionaire crypto entrepreneur whose U.S. fraud case was settled by the SEC earlier this year. The exchange reported more than $3 trillion in trading volume in 2025.