In brief
- A new report from blockchain intelligence firm TRM Labs says that crypto exchange HTX has kept operating under the same brand following UK sanctions, while rebuilding its on-chain infrastructure.
- HTX has rotated wallets across TRON, Ethereum, BNB Smart Chain, and Solana, creating a “continuous moving target for compliance professionals,” TRM Labs said.
- The exchange told Decrypt the activity reflects “routine, security-driven platform operations,” and rejected any characterization implying otherwise.
Crypto exchange HTX has rebuilt its underlying wallet infrastructure in the weeks since the UK sanctioned it, rotating deposit and hot wallets on a rapid cycle, blockchain intelligence firm TRM Labs said in a report Tuesday.
The exchange has “rebuilt its on-chain plumbing,” TRM Labs said, with the result that address-list screening “cannot keep pace”
The Office of Financial Sanctions Implementation designated Huobi Global S.A., the entity behind HTX, on May 26, the first time the UK applied the measure to a crypto exchange of that size. The package of sanctions targeted crypto exchanges and the “A7 network,” which British authorities said was “used by Russia to evade existing restrictions” and channel funds to fuel its invasion of Ukraine. In the announcement, the UK government flagged HTX as a “major global cryptocurrency exchange” suspected of having channeled more than $1.5 billion to the Kremlin.
A moving target
In the weeks following the sanctions, TRM Labs said, HTX stayed live under the same brand but began cycling its wallets across TRON, Ethereum, BNB Smart Chain, and Solana, retiring each hot wallet and funding address within hours and shifting activity to fresh ones.
The effect, according to the firm, is a “continuous moving target.” A block list built on specific HTX addresses “goes stale within hours,” TRM said, and would clear most activity the exchange has run since the designation, because that flow moves through addresses no list has seen. The firm argued that screening keeps pace only when it tracks the behavior behind the rotating wallets, recognizing each new address as it comes online.
TRM framed the response as a pattern it has tracked across well-resourced sanctioned entities, which it said rarely disappear and tend to adapt. It compared HTX‘s wallet rotation to the playbook Russian exchange Garantex ran after its own designation. After a March 2025 takedown, Garantex’s operators spun up a successor, Grinex, and migrated liquidity through the ruble-pegged stablecoin A7A5. HTX, by contrast, kept the same brand and rebuilt at the wallet level, TRM said.
The report also noted that the U.S. Treasurys OFAC and the EU have not designated HTX, so freeze obligations fall only on UK-regulated firms, even as TRM urged others to treat the exchange as an “elevated sanctions-evasion risk.”
HTX responds
An HTX spokesperson told Decrypt that the behavior flagged in the report is benign. “The technical activities referenced in TRMs report reflect routine, security-driven platform operations common across the industry,” the spokesperson said. “We categorically reject any characterization implying otherwise and have no further comment.”
The exchange has contested the UK action before. After the May designation, HTX told Decrypt the listed entity, Huobi Global S.A., is “distinct from the online HTX exchange,” and said user funds were safe and global operations unaffected—though OFSI emphasised that it considers HTX as subject to the UKs financial sanctions due to its ownership by Huobi.
The UKs financial regulator, the FCA, had separately launched enforcement action against HTX earlier this year over illegal promotions to British customers, prompting the exchange to restrict new UK sign-ups.
HTX is owned and advised by Justin Sun, the billionaire crypto entrepreneur whose U.S. fraud case was settled by the SEC earlier this year. The exchange reported more than $3 trillion in trading volume in 2025.
