TRM Labs says HTX has been rapidly rotating wallets after the UK sanctioned Huobi Global S.A. in May, a move that can make sanctions screening a lot messier. HTX says the wallet changes are routine security operations, not some sneaky compliance dodge.
- TRM Labs says HTX has been retiring wallets across multiple chains.
- HTX says the activity is normal platform security practice.
- UK sanctions and an active FCA case are adding pressure.
In a report published on July 21, TRM Labs said HTX has repeatedly retired hot wallets and funding addresses across TRON, Ethereum, BNB Smart Chain, and Solana. TRM argues that much of HTX’s active onchain infrastructure can sit outside static sanctions screening lists at any given time, because those lists depend on known addresses that can become stale fast.
That is the core problem here. Hot wallets are internet-connected wallets used for active transfers, and funding addresses are used to move money into exchange operations. Exchanges often use many of them for liquidity management, security, and compartmentalization. So wallet rotation by itself is not proof of anything dirty. But if wallets are being swapped out within hours, fixed-address screening starts to look pretty weak.
Ari Redbord, TRM Labs’ global head of policy, put it bluntly:
“HTX is changing its wallets every few hours to stay a step ahead of screening built on static lists.”
HTX rejects that reading. A spokesperson said the wallet activity TRM identified reflects “routine, security-driven platform operations common across the industry.” That defense is not absurd. Exchanges do rotate wallets, and they do it for legitimate operational reasons. The problem is that blockchain infrastructure is cheap to spin up and easy to swap around, which gives bad actors and compliance teams the same toolset, just with very different intentions.
TRM’s point is not simply that HTX uses multiple wallets. It is that the pattern looks designed to outrun static compliance systems. That distinction matters. One is normal exchange plumbing. The other, if true, is a much uglier compliance story.
Cross-chain movement makes the picture even harder. TRM says HTX is rotating across several networks, not just one. For non-specialists, that means the infrastructure is spread across different blockchains with different tooling and visibility, which makes tracing and screening more complicated. In other words: it is a moving target with multiple escape hatches.
Why the UK is leaning on Huobi Global S.A. and HTX
The sanctions pressure began on May 26, when the UK designated Huobi Global S.A. under its Russia sanctions regime. UK authorities said they had reasonable grounds to suspect Huobi Global provided financial services connected to Russia-linked entities, including the A7 network.
The designation includes an asset freeze and restrictions involving payment processing, correspondent banking, trust services, and internet services. Those are not random buzzwords. They are the financial and operational channels sanctions policy tries to choke off when it suspects money is being routed around restrictions tied to Russia.
HTX has argued that Huobi Global S.A. is legally separate from the operating platform. The UK Office of Financial Sanctions Implementation later clarified that it considers the HTX exchange subject to UK financial sanctions because of its ownership by Huobi Global S.A. That is the part many companies hate most: corporate structure may look tidy on paper, but regulators often care about ownership and control, not just branding and legal theater.
So the debate is not just about one exchange name or one wallet cluster. It is about whether the UK views the platform, its owner, and its onchain infrastructure as part of the same sanctioned universe. That is a far more dangerous place for an exchange to be sitting.
The FCA case is a separate headache
HTX is also dealing with a separate fight with the UK Financial Conduct Authority. The FCA announced legal proceedings against HTX for unlawful crypto promotions in February over alleged unlawful crypto promotions to UK consumers. The regulator said HTX continued publishing promotions through its website and social media after earlier warnings.
The promotional lines cited by the FCA included: “Sign up, trade, and earn up to 1, 200 USDT”, “Grab a sure-win reward of up to 2, 024 USDT”, “Buy Bitcoin in a minute”, and “Learn spot trading in seconds”.
That kind of marketing is exactly why regulators keep their knives sharpened. Loud promises, easy-money vibes, and a suspiciously casual relationship with local rules, classic crypto marketing behavior when it goes off the rails. The FCA’s case remained active through June, when the High Court issued another order connected to the matter.
Important distinction: the FCA case is not the same as the sanctions issue. One is about alleged unlawful promotions. The other is about sanctions exposure and ownership-linked infrastructure. Different legal theories, same unpleasant pressure cooker.
Static screening is the weak link
TRM’s wider argument is that sanctions compliance in crypto still leans too heavily on static lists. Those lists are useful, but only up to a point. If an exchange can generate fresh wallets quickly and move funds before screening systems update, the old approach starts missing what matters.
That is why blockchain analytics firms keep pushing behavior-based monitoring. Instead of asking only whether an address is already flagged, they look at transaction patterns, wallet clusters, timing, and how funds move across chains. The idea is simple: if the address keeps changing, the behavior may still give the game away.
This is where crypto compliance gets more serious and less convenient. Static lists catch the obvious stuff. Behavior-based monitoring is designed for the messy stuff. It is harder, slower, and more expensive, which is why a lot of firms still act like the old method is enough, right up until it clearly is not.
TRM has made this broader point before. In its policy work, the firm has argued that illicit crypto flows can move through multiple wallets and blockchains very quickly, shrinking the window for interdiction. That is a fair warning. It is also worth remembering that TRM is a blockchain intelligence firm selling tools into this market, so its interpretation is informed, but not exactly neutral. Useful? Yes. Gospel? No.
What is actually proven here?
The cleanest facts are straightforward. TRM Labs published a report on July 21. The UK sanctioned Huobi Global S.A. on May 26. The FCA brought legal action against HTX over alleged unlawful crypto promotions. Beyond that, the wallet-rotation question is still a matter of interpretation.
TRM sees a pattern that it says helps HTX stay ahead of static sanctions screening. HTX says the wallet churn is normal, security-driven platform behavior. Both things can be true in part: exchanges really do rotate wallets, and that rotation can also make compliance far harder than it used to be.
That is the uncomfortable truth. In crypto, a fresh wallet is cheap. A fresh compliance system is not.
Key questions and takeaways
-
Does wallet rotation prove HTX is evading sanctions?
No. TRM’s report raises a red flag, but wallet rotation alone does not prove intent. Exchanges use multiple wallets for legitimate reasons too. -
Why does TRM think this matters?
TRM says HTX’s rapid wallet changes can keep much of its active infrastructure off static sanctions lists, which makes screening less effective. -
What did the UK do?
The UK sanctioned Huobi Global S.A. on May 26 under its Russia sanctions regime, and the UK Office of Financial Sanctions Implementation later clarified that HTX is subject to UK financial sanctions because of ownership ties. -
How is the FCA case different?
The FCA case concerns alleged unlawful crypto promotions to UK consumers. It is a separate legal issue from sanctions, but it adds more pressure on HTX in the UK. -
What is behavior-based monitoring?
It is a compliance method that looks at transaction patterns, wallet relationships, timing, and cross-chain activity instead of relying only on fixed address lists. -
Why are static sanctions lists struggling?
Because blockchain addresses can be changed quickly. If an exchange swaps wallets every few hours, fixed lists can lag behind reality.
The bigger lesson is not subtle. Crypto compliance is moving away from simple address blacklists and toward entity and behavior analysis, because the old tools are too easy to outrun. Whether HTX is just doing routine wallet hygiene or something more evasive, the broader industry problem is the same: onchain infrastructure moves fast, and sanctions enforcement has to keep up or get embarrassed in public.
Further Reading
For more context on crypto compliance, sanctions pressure, and the darker corners of onchain activity:
