How HTX’s wallet rotation exposes gaps in address-based screening and why identifying new infrastructure quickly matters for compliance
A sanctions designation identifies an entity. Effective screening also requires identifying the wallets that entity controls now and those it creates next. That task is becoming more demanding as some sanctioned and high-risk exchanges rotate their funding, withdrawal, and other operational infrastructure fast enough to weaken conventional address-based screening. HTX is one of the clearest examples.
Independent blockchain analytics research documented unusually rapid HTX wallet rotation after the exchange's May 2026 UK designation: cycling of hot wallets, deposit infrastructure, and the funding addresses behind them across TRON, Ethereum, BNB Smart Chain, and Solana, with some wallets active for only hours. Separate research found that identifiable central HTX wallets on TRON grew from 32 to more than 750 in roughly two months. HTX itself later confirmed part of the architecture: on August 21, 2026 it announced a multi-address withdrawal system that rotates withdrawal addresses, retires old ones, and caps exposure at each below $1 million.
The intent behind individual rotations is harder to prove. HTX describes the system as a security measure, and public evidence does not establish sanctions evasion as its sole purpose. The effect on screening is clear: a newly activated HTX wallet can appear clean simply because it has not yet been attributed.
New wallet addresses can belong to entities already understood to present sanctions and financial-crime exposure. Their activity can retain familiar operating patterns, including connections to an exchange's existing infrastructure. A clean address-level screening result may therefore reflect an attribution delay, leaving actual exposure undetected. If a provider has not yet attributed the current wallet, a customer may see no alert even though HTX is involved.
Screening systems can act quickly on known risk once an address has been attributed. Keeping those systems effective requires identifying new infrastructure as entities change how they operate. Attribution speed now matters as much as coverage: providers need to establish the connection while the wallet is still active, before the infrastructure changes again.
Merkle Science’s real-time detection model is designed to identify newly activated infrastructure before it becomes part of a public list or a manually maintained cluster. It evaluates whether new activity behaves like infrastructure already verified as belonging to a sanctioned or high-risk entity.
Funding relationships, activation timing, transaction patterns, counterparties, and wallet handoffs provide signals for connecting new addresses to known infrastructure. These behavioral signals are difficult to replace, giving analysts continuity as addresses change, sometimes within minutes. The model evaluates those signals continuously across Ethereum, Polygon, BNB Smart Chain, Solana, TRON, Bitcoin, and Arbitrum. The objective is straightforward: identify the next wallet while it is still active.
In May 2026 the UK designated HTX (Huobi Global S.A.) for alleged Russian sanctions evasion, the largest crypto-exchange sanctions action to date. The designation alleges the platform moved roughly $1.5 billion for Kremlin-aligned entities and names counterparties including the A7 network and Garantex.
Separately, blockchain analytics research has estimated far larger exposure: approximately $21.06 billion in high-risk BTC, ETH, and TRON-USDT activity between 2021 and May 2026, at least $7.64 billion of it linked to Russian high-risk entities, with counterparties spanning Garantex, Grinex, A7A5, Huione, Nobitex, Hezbollah-linked infrastructure, and Lazarus-linked activity. Those larger figures are third-party estimates and should be understood separately from the regulatory findings. Together, the designation and the research document the scale of HTX's reported exposure.
Our attribution analysts reviewed a sample of wallets identified by our real-time model after the UK designated HTX. Every wallet in that sample was confirmed as genuine HTX infrastructure. The model identified these newly active wallets through live behavioral detection, independently of existing public address lists. That result applies to the reviewed sample and does not guarantee the accuracy of every future detection. It demonstrates the capability that matters most: detecting fresh infrastructure ahead of conventional screening data.
Screening providers need to be evaluated on both the breadth of their attributed address coverage and the speed at which they identify newly activated wallets. When an exchange can rotate infrastructure in hours, a provider updating in days is working from stale information, leaving businesses exposed even when their controls appear to be functioning as designed. We built our real-time attribution model to help close that gap, and in the case of HTX it is surfacing newly active infrastructure that conventional screening data has not yet reached.
Speak with our team to learn how Merkle Science’s real-time wallet attribution can strengthen your sanctions screening.
