Why Static Blocklists Are Dead: The HTX Wallet-Rotation Problem

On May 26, 2026, the UK’s Foreign, Commonwealth and Development Office added Huobi Global S.A. (the legal entity behind the HTX exchange) to its Russia sanctions list. Same for 17 other platforms and individuals including EXMO, Bitpapa, ABCEX, and Aifory. British regulators alleged the exchange had facilitated over $1.5 billion in financial flows connected to Russian sanctions evasion networks, including the A7 network and Garantex. What happened next is the more interesting story, and it’s one every builder in the compliance and blockchain-analytics space should be paying attention to. Instead of shutting down, rebranding, or going dark, which is the usual playbook for sanctioned crypto entities, HTX kept operating under the same brand, same domain, same public identity. It just started changing its wallets…a lot. The Mechanics: Rotating Faster Than Screening Can Catch Up According to a report from blockchain intelligence firm TRM Labs, HTX has been cycling through hot wallets and funding addresses across four blockchain networks: TRON, Ethereum, BNB Smart Chain, and Solana. HTX retiring and replacing them every few hours, sometimes multiple times in a single day. Rotation through 4 blockchains By mid-July 2026, TRM Labs was still tracking this pattern nearly two months after the initial designation. This matters because the entire architecture of conventional sanctions screening is built on one assumption: that a sanctioned entity’s wallet addresses are static enough to compile into a list. Compliance teams at exchanges, banks, and payment processors run incoming and outgoing transactions against these lists (OFAC-style blocklists, essentially) and flag or block matches. HTX’s rotation strategy breaks that assumption at the root. A wallet address gets flagged, added to a blocklist, and propagated across screening vendors. This is a process that, in practice, takes hours. By the time it happens, HTX has already moved to a new address. TRM Labs’ Global Head of Policy, Ari Redbord, described the dynamic simply: the rotation lets the exchange stay ahead of screening systems built around fixed address lists. HTX disputes the framing entirely, characterizing the wallet changes as standard security hygiene that’s common across the industry. Rotating hot wallets is a legitimate security practice; the question TRM Labs is raising is one of frequency and intent, not whether rotation itself is suspicious. Why This Isn’t A Small Problem The scale here is what makes this more than a niche compliance footnote. HTX reported ~$3.3 trillion in trading volume in 2025, a 39% year-over-year increase, with a user base exceeding 55 million registered accounts. Forbes ranked it 6th globally by spot market share in 2024, with daily volumes in the $4–5 billion range, but every counterparty that touches its liquidity now has a screening problem. In the aftermath of the UK designation, several major exchanges are understood to have stepped up screening against HTX-linked wallet flows, in some cases flagging or freezing matched transactions (regardless of whether the underlying activity was itself sanctions-related). Main numbers for HTX There have also been unverified reports that HTX shifted a significant portion of its reserve funds to a third-party custodian shortly after the sanctions hit, though this has not been independently confirmed. On July 23, 2026, the EU adopted its 21st sanctions package, placing Huobi Global S.A. under a transaction ban effective August 23, barring EU operators from transacting with the exchange, though notably stopping short of an asset freeze. Multiple jurisdictions are now converging on the same target through different legal mechanisms, and the exchange keeps adapting its on-chain footprint under all of them. The Retroactive Relabeling Problem Nobody’s Talking About There’s a second-order effect that gets less attention but arguably matters more for ordinary users: when an entity gets added to a sanctions list, some AML/blockchain-analytics providers retroactively re-label historical transaction data. Addresses that interacted with HTX months or years before the May 2026 designation can suddenly get tagged as sanctions-adjacent, even though no rule was broken at the time. Similar dynamics have been reported following other sanctions actions in the crypto space, where historical wallet activity tied to a newly designated platform drew renewed scrutiny well after the fact. The HTX case, given its user base of 55 million-plus, could turn this from an edge case into a much larger cleanup problem for the industry. What Actually Needs to Change TRM Labs' proposed fix is a shift from address-based screening to behavior-based detection — attributing new, unlabeled wallets to a known entity by analyzing transaction signatures, fund-flow patterns, and structural fingerprints, rather than waiting for a static list to catch up. In practice, this looks like: Clustering heuristics that group addresses by shared inputs, timing patterns, and counterparty overlap, rather than relying on a wallet having already been individually flagged. Funding-path analysis: tracing where a “fresh” wallet’s initial liquidity came from, since a brand-new address funded directly from a known HTX hot wallet inherits risk regardless of its own transaction history. Velocity and lifecycle modeling: an address that’s active for six hours and then abandoned is itself a signal, distinct from normal user wallet behavior. Cross-chain correlation: since HTX is rotating across TRON, Ethereum, BSC, and Solana simultaneously, screening that only operates chain-by-chain misses the pattern entirely. None of this is conceptually new, it’s the same graph-analysis toolkit that’s been used to track mixers and darknet-market flows. What’s new is the scale and confidence with which a licensed, publicly-branded exchange is using rotation as an operational strategy rather than a one-off evasion tactic. The Bigger Picture The HTX case is a useful stress test for a question the compliance industry has been able to avoid for a while: what happens when a sanctioned entity doesn’t try to hide, but instead just outpaces the tooling built to catch it? Static blocklists worked reasonably well against actors who wanted to stay hidden. They work much worse against an actor operating in the open, at scale, that treats address rotation as infrastructure rather than concealment. Whether regulators respond by mandating behavior-based screening standards, whether other exchanges follow HTX’s playbook the next time they’re designated, and whether the retroactive-relabeling problem gets addressed before it hits millions of unrelated users — those are the open questions. The static blocklist, at least, already has its answer.