HTX Uses 'Wallet Rotation' Tactics to Evade UK Sanctions: TRM Labs Report

On July 22, 2026, blockchain intelligence firm TRM Labs announced findings that HTX, one of the world's largest virtual asset exchanges, is systematically rotating digital wallet addresses to evade the UK's sanctions surveillance network. This report was released just two months after the UK government designated HTX as a sanctioned entity for allegedly supporting Russia's sanctions evasion, highlighting the intensifying game of cat-and-mouse between offshore virtual asset infrastructure and global regulators.

Static blacklists alone make it difficult to track the flow of funds from exchanges that frequently change addresses. HTX's wallet rotation tactics are interpreted as an attempt to neutralize automated screening tools.

According to TRM Labs' analysis, HTX moves funds to new addresses whenever a sanctioned wallet address is identified. This 'Wallet Rotation' technique is effective in bypassing existing address-matching-based surveillance systems used by regulators. The report is particularly noteworthy for specifically highlighting HTX's response following the large-scale sanctions imposed by the UK Foreign, Commonwealth & Development Office (FCDO) in May 2026.

Background of the May 2026 UK Sanctions Package

Previously, on May 26, 2026, the UK government designated 18 virtual asset-related companies as sanctioned entities, targeting Russia's illicit financial networks. This was recorded as the largest-ever sanctions package imposed by a single government in the virtual asset sector. At the time, the sanctions list included major exchanges such as Huobi Global (now HTX), Exmo, and Bitpapa.

• Huobi Global (HTX): Identified as a key channel for moving funds to evade Russian sanctions.
• Exmo and Bitpapa: Supporting money laundering and bypass transactions for Russian users.
• Rapira Group: Alleged to be operating an illegal financial network.

The UK Foreign Office understands that HTX facilitated approximately $1.5 billion in transactions while bypassing Russian financial restrictions. The UK government views such networks as serving as a key pipeline helping Russia fund its war and escape economic isolation, and has previously announced strong legal actions.

From a technical perspective, HTX's wallet rotation is not a simple operational change but a highly designed evasion tactic. TRM Labs emphasizes the importance of 'blockchain intelligence' that goes beyond simple address matching, explaining that such evasion activities can only be blocked by analyzing the paths and patterns of fund movements in real-time.

The Irony of the Beacon Network Partnership

The greatest irony of this situation lies in HTX's past actions. In August 2025, HTX heavily promoted its joining of the 'Beacon Network,' led by TRM Labs, to jointly respond to virtual asset crimes. At the time, HTX promised to increase industry transparency and strengthen anti-money laundering (AML) capabilities, but in less than a year, it found itself in a position where evidence of sanctions evasion was exposed by its partner, TRM Labs.

The UK's Office of Financial Sanctions Implementation (OFSI) has significantly strengthened its enforcement powers regarding virtual asset-related sanctions since early 2026. According to guidelines updated throughout February and March 2026, the OFSI has established grounds to impose higher levels of monetary penalties and criminal liability for sanctions evasion activities using virtual assets. This means that overseas exchanges like HTX could face serious legal risks if they have points of contact with the UK financial system.

Market experts believe this report will serve as a significant warning sign for compliance teams at other virtual asset exchanges and financial institutions. This is because if funds flowing from wallets rotated by HTX are handled carelessly, those institutions could also become subjects of UK sanctions violation investigations. TRM Labs advised that other exchanges should adopt more sophisticated on-chain analysis tools to identify fund flows associated with HTX.

Ultimately, the HTX case proves that virtual asset sanctions are not enough by simply blocking specific addresses. Sanctions designation is only the beginning of a continuous monitoring process, and effectiveness can only be achieved when advancements in blockchain forensic technology are combined with real-time responses from regulatory authorities. Attention is now focused on whether UK authorities will take additional sanctions or legal actions against HTX's new evasion tactics in the future.