When a government sanctions a bank, the effect is usually immediate and total. The bank’s accounts are frozen, its correspondent relationships severed, and its ability to move money through the global financial system effectively shut off. Sanctions work because traditional finance runs through fixed, identifiable chokepoints.
Crypto doesn’t work that way, and a new report shows exactly how a sanctioned exchange is exploiting that difference.
According to blockchain intelligence firm TRM Labs, the crypto exchange HTX, formerly known as Huobi, has been rotating its wallets every few hours across four different blockchains to stay ahead of sanctions screening. In a report released July 21, TRM said HTX regularly retires hot wallets and funding addresses across TRON, Ethereum, BNB Smart Chain, and Solana. Individual addresses stay active for only a few hours before the exchange moves its activity to fresh ones. The practice, TRM said, turns HTX’s on-chain footprint into “a continuous moving target.”
The context is serious. In May 2026, the UK sanctioned Huobi Global over its alleged role in facilitating Russian sanctions evasion. Seven weeks later, TRM says the exchange isn’t just still operating, it’s actively rebuilding its infrastructure to defeat the screening systems designed to enforce those very sanctions. HTX disputes this characterization entirely, calling the wallet activity routine security. The disagreement gets at a genuinely difficult question about whether crypto sanctions can be enforced at all.
Why the UK Sanctioned HTX
To understand the stakes, you need to understand what HTX was accused of, and it’s more consequential than a typical compliance dispute.
On May 26, 2026, the UK’s Foreign, Commonwealth and Development Office designated Huobi Global and 17 other entities and individuals as part of a package targeting Russia’s sanctions-evasion infrastructure. HTX, one of the world’s five largest crypto exchanges with roughly $3.3 trillion in trading volume in 2025, was the marquee designation. British authorities allege HTX moved approximately $1.5 billion for Kremlin-aligned entities, including flows involving the previously sanctioned exchanges Garantex and its successor Grinex.
At the center of the case is something called the A7 network, a centrally coordinated payments system with well-established connections to the Kremlin. UK officials described A7 as designed to bypass Western sanctions, finance military procurement, and process oil revenue funding Russia’s war economy. The network reportedly claimed to have moved more than $90 billion in a single year, roughly equivalent to half of Russia’s annual military expenditure. A7 is also behind the A7A5 stablecoin, a ruble-pegged token built as an alternative payment channel.
The designation carried unusual force. It marked the first time the UK deployed Regulation 17A, one of the most powerful tools in its sanctions framework, against a crypto exchange. That regulation, historically used against major banks, prohibits correspondent banking relationships and payment processing services with the designated entity. For UK-regulated firms, the implications were immediate: any direct dealing with HTX became off-limits.
The Evasion Technique
What TRM describes HTX doing since the designation is a textbook example of why crypto sanctions are so hard to enforce.
Most sanctions screening relies on static lists. Compliance teams maintain databases of known bad wallet addresses, and their systems automatically block any transaction involving those addresses. It’s efficient and it works well against fixed targets. But it has an obvious weakness: it can only block addresses it already knows about.
HTX’s alleged strategy exploits that weakness directly. By retiring wallets every few hours and spinning up new ones, the exchange ensures that much of its active infrastructure sits outside the static screening lists at any given moment. By the time a compliance team identifies a new HTX address and adds it to their blocklist, the exchange has already moved on to fresh wallets. The screening is always a step behind. “HTX is changing its wallets every few hours to stay a step ahead of screening built on static lists,” said Ari Redbord, TRM Labs’ global head of policy.
Spreading the activity across four different blockchains compounds the difficulty. A compliance system has to monitor TRON, Ethereum, BNB Smart Chain, and Solana simultaneously, tracking a target that constantly shifts both its addresses and the networks it uses. It’s a deliberate, sophisticated approach to staying operational under sanctions.
HTX Pushes Back
HTX firmly rejects TRM’s interpretation, and its defense deserves to be stated fairly.
An HTX spokesperson told reporters that the activity in TRM’s report “reflect[s] routine, security-driven platform operations common across the industry.” The exchange rejected any suggestion that the wallet changes serve to evade sanctions. HTX has previously stated that regulatory compliance remains a “top priority,” saying it proactively monitors and adheres to regulatory frameworks in all jurisdictions where it operates, including the UK.
There’s a legitimate point buried in this defense. Exchanges do rotate wallets for genuine security reasons, and generating fresh deposit addresses is standard practice across the industry. The question is one of degree and intent: whether rotating addresses every few hours across four chains reflects normal hygiene or a deliberate effort to defeat screening. TRM’s report argues the pattern and timing, beginning right after the May designation, point to the latter. HTX argues it’s business as usual. Both can point to real facts; the interpretation is where they diverge.
It’s also worth noting a boundary the responsible analysis draws. The UK sanctions notice designates Huobi Global S.A. and identifies HTX as a name variation. Justin Sun, who is publicly associated with HTX as an adviser, along with TRON and Tether, were not named in the designation. A sanctions designation is a specific legal act, and blurring those lines does real damage.
The Bigger Lesson
The genuinely important takeaway from this episode isn’t about HTX specifically. It’s about what the case reveals regarding the future of sanctions enforcement in crypto.
TRM’s core argument is that static, address-based screening is becoming obsolete against sophisticated actors. If a sanctioned entity can simply rotate wallets faster than compliance teams can update their lists, then the entire model of blocking known-bad addresses breaks down. The firm recommends a shift to what it calls behavior-based attribution: instead of relying on fixed lists, this approach studies how wallets interact on-chain and links new addresses to known entities based on their transaction patterns. “When an entity spins up a new wallet, behavior-based attribution recognizes it and ties it back to the designated entity as it comes online, updating nearly as fast as HTX rotates,” TRM said.
This mirrors a broader evolution in crypto compliance. The industry has seen this pattern before at the entity level, when Garantex rebranded to Grinex to escape sanctions. HTX shows the wallet-level version of the same game. As enforcement tools improve, evasion tactics adapt, and the cycle continues. TRM explicitly warns that any single snapshot of the infrastructure should be treated as temporary.
For the crypto industry, the episode is a sobering reminder that sanctions compliance is genuinely harder on-chain than in traditional finance, and that the tools are still catching up. For regulators, it underscores that designating an entity is only the first step; making the designation stick requires continuous, adaptive monitoring. And for the broader question of whether crypto can be brought fully within the rules-based financial system, HTX is a live test case. The answer will depend on whether behavior-based tracking and public-private enforcement efforts can move as fast as a sanctioned exchange swapping wallets every few hours. Right now, that race is very much ongoing.
FAQ
What is HTX accused of doing?
According to a July 21 report from blockchain intelligence firm TRM Labs, HTX (formerly Huobi) has been rotating its hot wallets and funding addresses every few hours across four blockchains, TRON, Ethereum, BNB Smart Chain, and Solana, to evade sanctions screening. Because individual addresses stay active for only a few hours, much of the exchange’s infrastructure remains outside static screening lists at any given time, making it hard for traditional address-based compliance tools to keep up. HTX denies this, calling the activity routine, security-driven operations common across the industry.
Why was HTX sanctioned?
On May 26, 2026, the UK’s Foreign, Commonwealth and Development Office sanctioned Huobi Global over its alleged role in facilitating Russian sanctions evasion, alleging HTX moved roughly $1.5 billion for Kremlin-aligned entities, including flows involving previously sanctioned exchanges Garantex and Grinex. It was part of a package targeting the A7 network, a Kremlin-linked payments system that reportedly moved over $90 billion in a year. The action marked the first time the UK used its powerful Regulation 17A, historically reserved for banks, against a crypto exchange.
What does this mean for sanctions enforcement?
The case suggests static, address-based sanctions screening is becoming ineffective against sophisticated actors who can rotate wallets faster than compliance teams can update their blocklists. TRM Labs recommends shifting to behavior-based attribution, which links new wallets to known sanctioned entities based on their on-chain transaction patterns rather than fixed lists, allowing detection nearly as fast as the wallets rotate. The episode highlights that crypto sanctions enforcement is genuinely harder than in traditional finance and that monitoring tools are still evolving to keep pace with evasion tactics.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making any investment decisions.
