Why Static Blocklists Are Dead: The HTX Wallet-Rotation Problem

On May 26, 2026, the UK announced that Huobi Global S.A., the parent company of the HTX exchange, had been added to the country's sanctions list. This followed an allegation that the exchange had facilitated over $1.5 billion in transactions associated with Russian sanctions evasion, including links to the A7 network and Garantex.

Rather than dissolve, HTX maintained its brand and presence online, but began rapidly changing its wallet addresses repeatedly. According to blockchain intelligence firm TRM Labs, HTX spun through hot wallets on TRON, Ethereum, BNB Smart Chain, and Solana every few hours, sometimes multiple times within a single day. By mid-July, the monitoring firm noted this pattern had persisted for nearly two months.

This rapidly changing wallet strategy breaks the assumption that sanctions screening relies on static address lists. Compliance teams at exchanges, banks, and payment processors screen transactions against these lists and flag matches. However, HTX's frequent address rotations means a wallet flagged under sanctions is quickly replaced with a new one, allowing the exchange to stay ahead of screening systems. While HTX argues this is standard security practice, TRM Labs argues the frequency and intent are problematic.

The scale of HTX's operations makes this a significant compliance issue. In 2025, HTX handled approximately $3.3 trillion in trading volume, representing a 39% year-over-year increase, and had over 55 million registered users. Major exchanges increased their screening of HTX-linked transactions following the UK sanction, and there have been reports of reserves being moved to a third-party custodian.

The EU subsequently imposed additional sanctions on the exchange, with a transaction ban taking effect in August, barring EU operators from trading with the exchange.

One secondary issue is that sanctions list additions can retroactively label historical transactions as sanctions-related. Addresses that interacted with HTX prior to the May 2026 designation may now be tagged as suspicious, even though no wrongdoing was present at the time. This could lead to a larger industry-wide cleanup effort.

TRM Labs proposes shifting from address-based screening to behavior-based detection. By analyzing transaction patterns, funding paths, velocity, and cross-chain correlations rather than relying on static address lists, blockchain analytics could better detect known sanctioned entities even when their addresses keep changing. This graph analysis approach would allow screening to keep pace with rapidly rotating wallets like HTX's.

The HTX case provides a test for how blockchain analytics can adapt to exchanges using rotation as an operational strategy instead of an evasion tactic.