On May 26, 2026, the United Kingdom imposed sanctions on one of the world's largest cryptocurrency exchanges, HTX, accusing it of facilitating the circumvention of anti-Russian restrictions. Over the following seven weeks, specialists tracked the changes on the blockchain in practically real time. The data obtained showed that, to comply effectively with sanctions today, it is no longer enough to track only individual cryptocurrency addresses — it is far more important to analyze the behavior of network participants.
Why HTX fell under UK sanctions: a $1.5 billion accusation
On May 26, 2026, the UK Foreign, Commonwealth & Development Office (FCDO) added Huobi Global S.A., which operates the HTX crypto exchange, to the sanctions list under the Russia (Sanctions) (EU Exit) Regulations 2019. This became the first case of sanctions being imposed on a cryptocurrency exchange ranking among the world's largest venues, as well as the first application of Regulation 17A to a cryptocurrency company.
According to the UK authorities, there were sufficient grounds to believe that HTX provided financial services to entities linked to the A7 network, including the companies A7 LLC and Garantex, thereby supporting the Russian government. According to the FCDO's statement, around $1.5 billion connected to organizations supporting the Kremlin was moved through the exchange's infrastructure. These accusations were also linked to Operation Destabilise, an international operation conducted by the UK's National Crime Agency (NCA) against money-laundering infrastructure.
How HTX rebuilt its blockchain infrastructure after the sanctions
The blockchain preserves an immutable history of every transaction, which means any changes in infrastructure can be tracked almost immediately after they appear.
Despite keeping its former brand and continuing to serve clients, the exchange moved to a constant rotation of its cryptocurrency wallets. The hot wallets and addresses used to process user operations began to be regularly replaced with new ones.
For compliance specialists, this creates a constantly moving target. If a screening system uses a fixed list of known HTX addresses, such a list becomes outdated very quickly: the exchange stops using one address and almost immediately moves its operations to a new one that is not yet in the sanctions databases.
As a result, a significant part of HTX's active infrastructure at any given moment falls outside the existing lists of known addresses.
Why address lists become outdated within hours
Screening operations solely against previously known cryptocurrency addresses no longer makes it possible to effectively detect schemes like these. By the time yet another address can be identified and added to a database, the exchange is already using entirely different infrastructure. That is why the analysis of network participants' behavior, rather than of individual addresses, is becoming increasingly important today.
Such an approach makes it possible to identify the characteristic signs of a specific organization's operations. If it creates a new wallet, the system is able to link it to already known infrastructure almost immediately after it appears, even if this address has never previously featured in open sources.
Without such methods, most of HTX's operations after the sanctions were imposed would have gone unnoticed, since they pass through entirely new addresses that are not yet on any list.
Garantex followed the same path: blocking, Grinex, and the A7A5 stablecoin
According to researchers, HTX's actions match a pattern of behavior that has already been observed repeatedly among organizations that have come under international sanctions.
Large entities with sufficient resources rarely cease operations after restrictions are imposed. Instead, they change the way they work.
How HTX's path differs from Garantex's: the same brand, new wallets
Instead of changing its name, the exchange completely rebuilt its blockchain infrastructure while keeping its recognizable brand. Analysis showed that the strategy of constant wallet rotation largely resembles Garantex's actions after sanctions were imposed on it back in 2022.
This example shows that modern sanctions restrictions increasingly force organizations not to cease operations, but to turn their own infrastructure into a constantly changing system that is considerably more difficult to track by traditional methods.
