The sanctioned exchange HTX has been retiring and replacing its hot wallets every few hours across four blockchains since the United Kingdom designated it in May 2026, according to blockchain intelligence firm TRM Labs — and the practical consequence is that address-list screening, still the default control at most regulated firms, no longer does the job it is bought to do.

This is the part of the story that matters beyond one exchange. A compliance stack built on periodically-refreshed static address lists assumes the adversary’s on-chain footprint is roughly stable between updates. Rotation on a multi-hour cycle breaks that assumption outright, and it does so without any cryptographic sophistication — it simply moves faster than the list.

What TRM Labs found

TRM reports that HTX has been rotating hot wallets and funding addresses on regular cycles across TRON, Ethereum, BNB Smart Chain and Solana, retiring addresses every few hours. The effect is to turn the exchange’s on-chain presence into a continuously moving target.

“HTX is changing its wallets every few hours to stay a step ahead of screening built on static lists,” said Ari Redbord, Global Head of Policy at TRM Labs.

The firm’s proposed answer is to stop screening addresses and start screening behaviour. “When an entity spins up a new wallet, behavior-based attribution recognizes it and ties it back to the designated entity as it comes online, updating nearly as fast as HTX rotates,” TRM said.

The designation behind it

The UK Foreign, Commonwealth and Development Office sanctioned Huobi Global S.A., which now trades as HTX, in May 2026 over its alleged role in facilitating Russian sanctions evasion. The FCDO’s case cites approximately $1.5 billion moved for Kremlin-aligned entities.

It was not the exchange’s first UK problem. The Financial Conduct Authority began legal proceedings against the platform in February 2026 over allegedly unlawful financial promotions — a separate matter, but one that establishes a pattern of UK regulatory attention preceding the designation.

HTX rejects the characterisation

The exchange disputes the framing. An HTX spokesperson said the activity described in TRM’s report reflects “routine, security-driven platform operations common across the industry,” adding: “We categorically reject any characterization implying otherwise and have no further comment.”

The defence is not absurd on its face. Wallet rotation is a genuine operational-security practice, and exchanges do cycle hot wallets to limit the blast radius of a key compromise. The distinction a supervisor will draw is between rotation at a cadence consistent with key hygiene and rotation at a cadence that happens to track the refresh interval of commercial screening feeds. Every few hours, across four chains, following a designation, sits awkwardly in that second category — but intent is exactly what a behavioural-attribution model infers rather than proves.

Why this lands on compliance teams, not just on HTX

For any regulated firm with UK nexus, the operative risk is not HTX’s conduct. It is inbound exposure from an address that was clean at the last list refresh and designated-adjacent by the time a deposit settles.

That is a control-design problem with a cost attached. Behaviour-based attribution requires a data vendor doing continuous clustering rather than periodic list publication, and it produces probabilistic rather than binary output — which compliance functions and their auditors are less comfortable defending. The alternative is accepting a screening gap measured in hours against a counterparty that has demonstrated it will use them.

The wider context is that this is the second structural gap to surface in crypto compliance this month. The Financial Action Task Force’s July 2026 review put global Travel Rule implementation at 83%, leaving a material minority of jurisdictions where originator and beneficiary data does not travel at all. A firm can be fully compliant with both regimes and still be exposed, because the failure mode in each case is timing and coverage rather than rule-breaking.

Expect UK supervisors to ask firms how quickly their screening refreshes, not merely whether they screen. That question has a specific, testable answer, and “daily” will not be a good one.

Sources: The Block on the TRM Labs findings, TRM Labs on the designation, crypto.news, and Crypto Times on HTX’s response to the May designation.

Related coverage on The Industry Spread: FATF’s July 2026 Travel Rule review at 83%, Venezuela USDT volume at 75% of oil exports, and the GENIUS Act deadline leaving foreign issuers in limbo.

Karthik Subramanian

Karthik Subramanian is a founder, writer, and technology consultant with nine years in the crypto ecosystem. He covers token economics, L1/L2 infrastructure, DeFi protocols, wallets/custody, and the bridge between crypto and forex—broker technology, liquidity, and macro drivers. Karthik’s writing focuses on clear, practical frameworks that help professionals evaluate new products and on-chain innovation alongside FX market realities.