.png?width=360)
Analysis of HTX flows and what they reveal about sanctions exposure in crypto.
On May 26, 2025, the UK has imposed sanctions on entities and individuals that Russia uses to bypass sanctions. The list includes exchanges, such as already OFAC-sanctioned BitPapa, Garantex, and Grinex, HTX (previously Huobi) — one of the biggest exchanges, EXMO, and other entities. Individuals added to the list include Sergey Mendeleev, co-founder of Garantex.
Global Ledger has analyzed the volumes of HTX, currently ranked among CoinMarketCap's top 10 exchanges by trading volume.
Key Takeaways
- The UK sanctioned a list of entities for helping Russia to evade sanctions, including HTX, one of the top exchanges.
- In 2021-2026, HTX has processed over $21 billion of risky BTC, ETH, and USDT (TRON).
- Of those, at least $7.64 billion is linked to Russian high-risk entities, such as Garantex, Grinex, A7A5, and darknets.
- Other risky counterparties include Huione Group, Nobitex, Hezbollah, and Lazarus.
- Garantex is #1 among top 20 HTX’s counterparties, with $6.16 billion. Huione group is the second ($4.41 billion), and liquidated Three Arrows Capital is #3, ($1.53 billion).
HTX processed $21.06B of high-risk crypto
HTX has processed $21.06 billion worth of high-risk funds in BTC, ETH, and USDT on TRON in 2021 — May 2026.
At least $7.64B linked to Russian sanctioned entities and darknet
UK has designated HTX, suspecting that it supported Russian government by “providing financial services, making available funds, economic resources, goods or technology” to strategic-sector entities — A7 and Garantex. At least $7.64 billion is connected to Russian high-risk entities:
-
Garantex: $6.16 billion ($2.63 billion from Garantex and 3.53 billion to it).
-
Grinex: $840 million ($510 million in incoming transactions, $330 million in outgoing transactions).
-
A7A5: $360 million.
-
Hydra darknet (seized in 2022): $160 million ($90 million in incoming transactions, $70 million in outgoing transactions).
-
Kraken darknet: $70 million ($60 million in incoming transactions, $10 million in outgoing transactions).
-
Mega darknet: $50 million.
Read More
Russian Darknet 2025
Read our investigation on how licensed centralized exchanges (CEXs) with a combined 130 international licenses were exposed to Russian darknet activity.
Read More
Huione Group is #2 of HTX’s risky counterparties
Moreover, we traced connections to other high-risk entities, such as:
-
Huione Group: $4.41 billion ($1.41 billion in incoming transactions and $3 billion in outgoing transactions).
-
Nobitex: $0.27 billion ($0.13 billion in incoming transactions and $0.14 billion in outgoing transactions).
-
Hezbollah: $0.24 billion ($0.08 billion in incoming transactions and $0.16 billion in outgoing transactions).
-
Lazarus: $0.06 billion.
Top 20 high-risk counterparties of HTX. Jan 2021 — May 2026. Source: Global Ledger
Designated A7 and Garantex facilitate Russia’s sanctions evasion
A7, Garantex, and its successor Grinex operate as a centrally coordinated sanctions evasion network backed by sanctioned Russian state bank Promsvyazbank and oligarch Ilan Shor. They are a large part of Russia’s sanctions evasion economy and laundering funds “associated with illicit actors, including darknet markets and ransomware groups”.
- Garantex processed over $14.52 billion worth of ETH, USDT, and USDC in 2024 alone. Licensed entities processed $8.26 billion of Garantex-linked funds in 2024, of which $6.51 billion was handled by entities holding EU licenses.
- Grinex processed $16.54 billion worth of USDT and A7A5 from its launch in March 2025 till the suspension on April 16, 2026, after the hack.
Both exchanges continue operating after sanctions. For example, Garantex continued processing customer payouts in BTC and ETH. We traced new wallets linked to Garantex that contained 200 ETH (~$9.6 million at the time of investigation) and over 260 BTC (~$24+ million) used to support customer payouts and reserves.
As for Grinex, sanctions isolated it from the regulated market, dropping the volume that went through CEXs by nearly 35 p.p. But the exchange adapted: it processed $9.25 billion while under sanctions.
Read More
Russia Sanctions Evasion 2026: How Russia’s Flows Reached Top CEXs
How Russia routed sanctioned funds through top CEXs — and the role of the A7A5 stablecoin in that infrastructure — read our investigation.
Read More
Conclusion
Newly-sanctioned HTX is a reminder that even top-tier exchanges by volume can carry years of accumulated exposure to sanctioned entities. Processing sanctioned flows even unintentionally doesn't remove regulatory liability.
For compliance teams, the practical consequence is straightforward: both direct and indirect exposure carry regulatory risk. While direct exposure can be easier to spot, indirect exposure builds up quietly across multiple hops and is often harder to catch before it surfaces in an audit.
With Global Ledger's sanctions screening toolset, your compliance team can detect direct and indirect exposure to sanctioned entities, investigate faster with real-time risk insights, and produce the documentation regulators and partners expect to stay ahead of enforcement actions and costly compliance violations.
