HTX wallet rotation bypasses UK sanctions screening, TRM says

Crypto exchange HTX has rebuilt its on-chain infrastructure to rapidly cycle deposit and hot wallets across TRON, Ethereum, BNB Smart Chain, and Solana, according to a Tuesday report by blockchain intelligence firm TRM Labs. The exchange systematically retires and replaces these addresses within hours. This creates a moving target that renders traditional address-list screening obsolete almost immediately.

For compliance teams at regulated financial institutions, the tactic represents a critical blind spot. Static blocklists of known HTX addresses "go stale within hours," TRM Labs warned, clearing the vast majority of the exchange's post-sanctions transaction flow because funds move through previously unseen addresses. Effective screening now requires behavioral tracking to identify newly generated wallets as they come online, rather than relying on historical address data.

TRM Labs framed the rapid infrastructure rebuild as an emerging playbook among well-resourced sanctioned entities. The firm compared HTX's wallet rotation to the tactics of Russian exchange Garantex. Following a March 2025 takedown, Garantex operators launched a successor platform called Grinex and migrated liquidity through a ruble-pegged stablecoin. HTX opted to keep its dominant brand and instead rebuild its plumbing at the wallet level.

The UK's Office of Financial Sanctions Implementation (OFSI) designated Huobi Global S.A., the entity behind HTX, on May 26. The sanctions targeted HTX as part of a broader crackdown on the "A7 network," which British authorities claim Russia uses to bypass restrictions and fund its invasion of Ukraine. The UK government flagged HTX as