TRM says HTX changed wallets after UK sanctions

TRM Labs says HTX rapidly changed key blockchain wallets after the UK sanctioned the entity behind the exchange, raising the bar for firms trying to block sanctioned crypto activity. For retail crypto users, the issue is a reminder that sanctions risk in digital assets is tied to wallet infrastructure, not only to a company’s name or app.

The blockchain intelligence firm said in a Tuesday report that HTX has kept operating under the same brand since the UK action while rebuilding the on-chain systems that handle funds. “On-chain” refers to activity recorded directly on a blockchain, where wallet addresses can be tracked by analytics firms, exchanges and compliance teams.

The UK’s Office of Financial Sanctions Implementation designated Huobi Global S.A., the entity behind HTX, on May 26. According to the UK government, the sanctions package targeted crypto exchanges and the “A7 network,” which British authorities said was used by Russia to get around existing restrictions and move money connected to its war in Ukraine.

The UK government described HTX as a major global crypto exchange and said it suspected the platform had routed more than $1.5 billion to the Kremlin. The designation marked the first time the UK applied such a measure to a crypto exchange of that size, according to the report.

How the wallet changes work

TRM Labs said HTX has been rotating deposit and hot wallets across TRON, Ethereum, BNB Smart Chain and Solana. A hot wallet is a crypto wallet connected to the internet, often used by exchanges to process customer withdrawals and other day-to-day transfers.

According to TRM Labs, HTX has been retiring hot wallets and funding addresses within hours, then moving activity to new ones. The firm said that creates a “continuous moving target for compliance professionals.”

The practical problem is address-based screening. Many compliance systems compare a wallet address against a list of blocked or high-risk addresses. TRM Labs said a list built around known HTX addresses can become outdated within hours and may fail to catch much of the exchange’s post-sanctions activity because new addresses have not yet appeared on those lists.

TRM Labs argued that screening needs to follow behavior, not just static address lists. In plain English, that means looking for patterns that connect new wallets to the same exchange activity as soon as those wallets begin operating.

HTX disputed any negative interpretation of the wallet activity. The exchange told Decrypt that the changes reflect “routine, security-driven platform operations” and rejected any characterization suggesting otherwise.

The dispute highlights a core tension in crypto oversight. Blockchains make transactions visible, but the people and companies behind wallet addresses can still shift infrastructure quickly. That leaves analytics firms, exchanges and regulators trying to connect fresh addresses to known entities in near real time.

This story draws on original reporting from Decrypt.