The cryptocurrency exchange HTX, formerly known as Huobi, has engaged in a sophisticated and continuous effort to circumvent UK sanctions by frequently migrating its on-chain operations to new digital wallets across at least four major blockchain networks. According to a detailed investigative report released by blockchain intelligence firm TRM Labs, this pattern of behavior began shortly after the United Kingdom’s Foreign, Commonwealth and Development Office (FCDO) imposed sanctions on the exchange in May 2024. The findings suggest that HTX is employing a "cat-and-mouse" strategy to stay ahead of compliance software and regulatory oversight, effectively neutralizing the impact of static sanctions lists by rotating its underlying infrastructure while maintaining its public-facing brand and platform.
The TRM Labs investigation reveals that HTX has systematically replaced its hot wallets and funding addresses on the TRON, Ethereum, BNB Smart Chain, and Solana blockchains. These wallets, which facilitate the high-frequency movement of customer deposits and withdrawals, are the lifeblood of any centralized exchange. By frequently retiring these addresses—sometimes within mere hours of their creation—and shifting activity to fresh, unidentified wallets, HTX has managed to continue its global operations despite the legal restrictions imposed by British authorities. This technique is particularly effective against traditional Anti-Money Laundering (AML) systems that rely on "static" databases of known sanctioned addresses, which often lag behind the real-time movements of sophisticated actors.
The Catalyst: UK Sanctions and Operation Destabilize
The shift in HTX’s operational behavior is a direct response to the aggressive regulatory actions taken by the British government. On May 26, 2024, the UK Foreign, Commonwealth and Development Office officially designated Huobi Global SA, the primary entity operating as HTX, as a sanctioned entity. This move was part of a broader initiative known as "Operation Destabilize," a coordinated effort led by the National Crime Agency (NCA) and other British law enforcement bodies to dismantle the financial networks used to support the Russian government’s ongoing geopolitical interests and military efforts.
The UK authorities stated they had "reasonable grounds" to believe that Huobi Global provided critical financial services and resources to entities within the "A7 network." This network includes A7 LLC and the sanctioned cryptocurrency exchange Garantex, both of which have been identified as pivotal nodes in Russia’s efforts to bypass international financial restrictions. The UK government specifically alleged that HTX had processed approximately $1.5 billion for Kremlin-aligned entities, making it a primary target for Regulation 17A of the Russia (Sanctions) (EU Exit) Regulations 2019.
The designation of HTX marked a significant milestone in global crypto regulation. It was the first time the United Kingdom had used its post-Brexit sanctioning powers to target a cryptocurrency exchange of HTX’s size and liquidity. Furthermore, it represented the first application of Regulation 17A—which targets the provision of financial services to sanctioned persons—against a major digital asset trading platform. The sanctions legally require any person or business under British jurisdiction to freeze assets associated with HTX and report any dealings with the exchange to the Office of Financial Sanctions Implementation (OFSI).
The Mechanics of On-Chain Obfuscation
The report from TRM Labs provides a technical breakdown of how HTX has adapted its infrastructure to mitigate the fallout from these sanctions. Centralized exchanges typically use "hot wallets" to manage daily liquidity. These are internet-connected addresses that receive user deposits and distribute withdrawals. Under normal circumstances, these addresses remain active for months or even years, allowing blockchain analytics firms to label them clearly as belonging to the exchange.
However, following the May sanctions, TRM Labs observed a radical departure from this norm. HTX began a process of "wallet rotation," wherein old funding addresses were deactivated and replaced with newly generated ones at an unprecedented frequency. In some instances, these new addresses were used for a high volume of transactions for only a few hours before being discarded in favor of a newer set of wallets.
This rotation occurs across multiple ecosystems, most notably:
- TRON: Due to its low transaction fees and high liquidity of the USDT stablecoin, TRON remains a primary hub for HTX’s activity.
- Ethereum: As the largest ecosystem for decentralized finance (DeFi), HTX continues to use Ethereum for significant institutional movements.
- BNB Smart Chain (BSC): Popular for retail trading and Binance-pegged assets, BSC serves as a high-volume corridor for the exchange.
- Solana: Known for its high speed, Solana has recently become a key component of HTX’s diversified infrastructure.
By spreading activity across these four chains and rotating wallets within them, HTX creates a moving target. Compliance officers at other exchanges or financial institutions who utilize automated screening tools may not see an immediate "red flag" when a user attempts to send funds to a newly created HTX wallet. By the time blockchain intelligence firms identify and tag the new wallet as belonging to the sanctioned HTX entity, the exchange has often already moved on to a different set of addresses.
The Russian Connection: A7 and Garantex
The core of the UK’s case against HTX lies in its alleged ties to the Russian financial shadow economy. The A7 network is described by investigators as a sophisticated web of shell companies and financial intermediaries designed to move capital into and out of Russia, bypassing the SWIFT banking system and Western sanctions. Central to this network is Garantex, a Moscow-based exchange that was sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) as early as April 2022.
TRM Labs drew direct parallels between HTX’s current behavior and the tactics previously employed by Garantex. Following its own designation, Garantex did not cease operations; instead, it shifted its liquidity through a separate platform known as Grinex. Furthermore, Garantex leveraged the "A7A5" token—a ruble-pegged digital asset—to facilitate cross-border settlements. The report suggests that HTX is following a similar "playbook" of operational resilience. Unlike Garantex, however, HTX has not rebranded; it has maintained the HTX name (rebranded from Huobi in 2023) while stealthily swapping out the "pipes" that connect its platform to the broader blockchain.
The $1.5 billion figure cited by the UK government highlights the scale of the alleged support. In the world of crypto-forensics, such a high volume suggests that HTX served as a major liquidity provider for OTC (over-the-counter) desks catering to Russian interests, rather than just hosting incidental transactions from individual Russian users.
Challenges for Global Compliance and Screening
The revelation that a major exchange is successfully evading sanctions through technical maneuvers poses a significant challenge to the global AML/CFT (Anti-Money Laundering and Countering the Financing of Terrorism) framework. TRM Labs warned that most HTX activity following the UK designation could potentially pass through screening systems that rely exclusively on static wallet lists.
"As a result, transactions involving newer HTX wallets may not trigger alerts from systems that rely only on previously identified addresses," the firm stated. This creates a "compliance gap" where regulated financial institutions—such as banks or other crypto exchanges—might unknowingly process transactions originating from or destined for a sanctioned entity.
To combat this, TRM Labs suggests that compliance firms must move beyond simple "list-checking" and adopt more advanced "behavioral analysis." This involves using machine learning and heuristic patterns to identify the "fingerprint" of an exchange’s activity. For example, the specific way an exchange batches transactions or the timing and volume of its internal transfers can reveal its identity even if the wallet address is brand new.
Chronology of Key Events
The timeline of HTX’s regulatory struggles and its subsequent technical pivots can be traced through several critical stages:
- April 2022: The U.S. sanctions Garantex, setting the stage for increased scrutiny of exchanges with Russian ties.
- September 2023: Huobi officially rebrands to HTX, a move some analysts suggested was an attempt to distance itself from its Chinese origins and previous regulatory baggage.
- May 26, 2024: The UK FCDO imposes sanctions on Huobi Global SA (HTX) under the Russia (Sanctions) Regulations.
- June 2024 – Present: TRM Labs observes a sharp increase in wallet rotation and the retirement of long-standing hot wallets across TRON, Ethereum, BSC, and Solana.
- March 2025 (Projected/Reported): TRM Labs notes that following a multinational enforcement action scheduled or referenced for March 2025, further shifts in the Russian crypto-liquidity landscape (such as the Grinex transition) are expected to accelerate.
Broader Impact and Regulatory Implications
The situation with HTX highlights a growing divergence in international crypto regulation. While the UK has taken a hardline stance against HTX, the exchange has not yet been sanctioned by the United States Treasury or the European Union. This jurisdictional discrepancy creates a complex environment for global firms. A company based in London must treat HTX as a sanctioned entity, while a firm in New York or Paris may not have the same legal obligation, despite the shared risk of interacting with Russian-aligned capital.
This case also puts a spotlight on the leadership of HTX. While the exchange is operated by Huobi Global SA, it is widely associated with its global advisor, Justin Sun, the founder of the TRON blockchain. Sun has frequently asserted that HTX operates independently and complies with all relevant laws, yet the exchange’s continued use of the TRON network as a primary hub for its rotated wallets suggests a deep technical integration between his various ventures.
For the broader cryptocurrency industry, the HTX-TRM Labs report serves as a warning. It demonstrates that as regulators become more adept at tracking digital assets, sanctioned entities will become equally adept at obfuscating their tracks. The "static" era of blockchain compliance is ending, giving way to an era of "dynamic" intelligence where the ability to identify a wallet’s owner in real-time is the only way to ensure regulatory adherence.
As of the time of the report’s release, HTX has not issued a formal statement regarding the TRM Labs findings or the specifics of its wallet rotation strategy. However, the exchange continues to be accessible to users outside the UK, highlighting the persistent difficulty of enforcing financial sanctions in a decentralized, borderless digital economy. The ongoing "Operation Destabilize" and the resulting technical pivots by HTX will likely remain a focal point for blockchain analysts and international regulators for the foreseeable future.
