HTX wallet rotation tests UK sanctions screening, TRM says

HTX kept moving wallets across blockchains after Britain sanctioned the exchange in May, TRM Labs said Wednesday, giving compliance desks a specific enforcement problem: fixed address lists against a crypto footprint that can keep moving.

According to The Block, TRM followed the wallet changes for seven weeks after the UK’s 26 May designation of Huobi Global S.A., which the government identified as the entity operating HTX. The activity ran across TRON, Ethereum, BNB Smart Chain and Solana, TRM said. For screening teams, that meant four networks and a changing set of wallet identifiers.

Sanctions risk in this case sits inside crypto market plumbing. A broker or exchange can flag a named sanctioned wallet quickly. The harder job is tracking the same counterparty when addresses rotate and activity splits across chains. TRM points to entity-level monitoring, cluster analysis and behavioural screening rather than list management alone.

The weak point, TRM says, is speed.

“HTX is changing its wallets every few hours to stay a step ahead of screening built on static lists.”

Ari Redbord, TRM Labs

Redbord made the argument in remarks reported by The Block. TRM’s own write-up makes the same point in technical terms: a programme built around isolated wallet identifiers can lag an exchange that treats addresses as disposable infrastructure.

HTX rejected the suggestion that the moves were meant to frustrate controls. A spokesperson told The Block that the movements “reflect routine, security-driven platform operations common across the industry.” Large exchanges do rotate hot wallets for treasury, custody and security reasons. Counterparties still have to know whether those wallets map back to a sanctioned entity, and how quickly.

Britain’s case against HTX already carried a geopolitical charge. In its 26 May sanctions package, the government said Huobi Global S.A. had facilitated Russian sanctions evasion and alleged that about $1.5 billion had been channelled back into Kremlin-aligned entities through the network. A separate designation notice formally listed Huobi Global S.A. as the HTX-linked entity subject to restrictions.

“If the Kremlin thinks it can evade our sanctions by hiding behind crypto networks and shadow financial systems, it is gravely mistaken.”

Yvette Cooper, UK government announcement

Why the screening problem matters

By February, the Financial Conduct Authority said it had begun legal proceedings against the exchange over illegal financial promotions in the UK, adding a conduct case to the sanctions scrutiny. The sanctions action and the FCA case put HTX under pressure on more than marketing rules. They also test whether regulators and private-sector compliance teams can follow a changing operational footprint across chains.

For market participants, the gap is practical. A screen that catches one wallet but misses the surrounding cluster can leave exchanges, market makers and over-the-counter desks exposed to the same counterparty through a fresh address hours later. TRM’s example is unusually specific, with four chains, a seven-week window and a named sanctions trigger. Crypto compliance, in other words, is moving from checking lists to mapping behaviour.

Compliance vendors now face a higher bar on attribution and speed. Exchanges have to show that routine wallet management can still be traced by counterparties and regulators. Policymakers get another operational case for blockchain intelligence alongside headline sanctions designations.

TRM’s account remains an allegation, and HTX says the wallet changes reflected ordinary security practice. Still, the episode gives regulators a sharper example of where crypto sanctions enforcement can slip. The gap opens between the moment a name is added to a list and the moment the market can trace the entity’s activity across the networks it uses.