HTX Rejects Poisoning Claims as Kraken Fund Freezes Face Scrutiny
A dispute between HTX and Kraken is raising an uncomfortable question for centralized exchanges: can tiny unsolicited crypto transfers be used to trigger sanctions controls against otherwise uninvolved users?
Summary:
- The dispute exposes a new problem for exchanges: unsolicited transfers can create compliance exposure without the recipient initiating them.
- On-chain attribution remains contested because an exchange label does not establish who authorized a transaction.
- Kraken’s sanctions obligations make the origin and control of HTX-linked funds more consequential than the amount transferred.
- The August 23 EU restrictions could make automated wallet screening even more sensitive to HTX exposure.
Shared by Wu Blockchain, HTX denied on August orchestrating a series of small USDT transfers from addresses associated with its infrastructure, after reports linked the activity to Kraken account restrictions.
HTX-Linked Address-Poisoning Reports Persist as Kraken Freezes User Funds of Up to $4.2 Million
HTX-Linked Address-Poisoning Reports Persist as Kraken Freezes User Funds of Up to $4.2 MillionHTX, one of the longest-running major crypto exchanges since its founding in 2013, said… pic.twitter.com/ICjnJRPjEE
— Wu Blockchain (@WuBlockchain) August 20, 2026
The controversy is particularly sensitive because the UK formally sanctioned Huobi Global S.A., listing HTX and HTX Exchange as name variations, while HTX says individual users rather than the platform may have been responsible for the transactions.
The dispute is really about control, not what a blockchain label says
The strongest claim circulating around the incident is that HTX itself conducted an address-poisoning campaign against users of rival exchanges.
The public evidence does not establish that.
HTX representative Molly said in X, that the exchange reviewed its internal accounts and found no official activity connected to the disputed transfers. Justin Sun separately rejected claims that the exchange deliberately initiated the transactions. Public on-chain reporting has identified transfers from wallets carrying HTX-related labels, but a blockchain label alone cannot determine who instructed a particular withdrawal.
That distinction is fundamental for centralized exchanges.
A hot wallet can contain assets belonging economically to thousands of customers. If a user requests a withdrawal, the on-chain sender may appear to be an exchange-controlled wallet even though the underlying action originated with an individual customer.
The reverse problem applies to compliance systems. Seeing funds arrive from an address associated with a sanctioned entity may be enough to trigger enhanced screening even when the recipient had no relationship with the sender.
That is why the current dispute cannot be resolved simply by pointing to an explorer label.
166 transfers complicate the original poisoning narrative
The on-chain activity itself has now been examined more closely.
Community researcher 0xMoon reportedly identified approximately 166 small USDT outflows from HTX hot wallet #48. When a subset of 7.5 USDT transfers was traced, 15 recipient addresses were identified as Kraken deposit addresses, rather than a broader group of Coinbase and Kraken accounts initially described in social-media claims. Several addresses subsequently continued normal deposit and withdrawal activity.
That evidence weakens the simplest version of the theory that HTX deliberately sprayed tiny transfers across competing exchanges to force widespread account freezes.
It does not establish why the transfers occurred.
HTX’s explanation is that some users affected by frozen balances may have acted independently. Molly said the exchange had found cases of Kraken restrictions involving substantial balances and suggested that frustrated users could have sent small transfers themselves while attempting to draw attention to the issue.
The largest figure cited by HTX is $4.2 million for an individual affected case.
That number requires qualification. Kraken has not publicly confirmed that amount, and HTX has not published documentation proving the reported $4.2 million case. It should therefore be treated as an HTX claim rather than a verified measure of Kraken’s total frozen funds.
Why a $7.50 transfer could create a multimillion-dollar problem
Traditional address poisoning is designed to steal money.
An attacker generates an address visually similar to one the victim frequently uses, sends a tiny transaction so the address appears in transaction history, and waits for the victim to copy the wrong destination later. Ledger describes the attack as exploiting users who verify only shortened portions of long wallet addresses.
The HTX controversy involves a different potential mechanism.
Here, the economic weapon is not necessarily the fake address. It is compliance exposure.
A simplified chain would look like this:
- A wallet belonging to an exchange customer receives a tiny unsolicited transfer.
- Blockchain monitoring software detects exposure to an address associated with a sanctioned or high-risk entity.
- The receiving exchange’s risk controls flag the account or transaction.
- Compliance staff investigate whether dealing with the funds would breach sanctions obligations.
- Access can remain restricted while ownership, source of funds and transaction intent are examined.
The recipient does not need to lose the tiny transfer for the attack to have an effect. The cost comes from potentially losing access to a much larger account during review.
That makes “compliance poisoning” a more accurate description of the concern than classic address poisoning, although there is not yet public proof that the disputed HTX-linked transfers were deliberately designed for that purpose.
Kraken cannot simply ignore HTX exposure
The regulatory backdrop explains why an exchange might respond aggressively even to small transfers.
The UK designated Huobi Global S.A. on May 26 under its Russia sanctions regime. The official notice specifically lists “HTX (formerly Huobi),” “HTX Exchange” and Huobi Global Limited as name variations and imposes an asset freeze as well as restrictions on payment processing and correspondent banking.
READ MORE: Arthur Hayes Returns to Lead Flop Labs Ahead of FLOP Launch
For regulated financial firms, sanctions screening is therefore not optional.
Kraken’s own support documentation states that it can restrict accounts or funding functions for reasons including suspected malicious activity and transfers involving prohibited, illegal or scam-related addresses.
The difficult issue is proportionality.
A system built to detect flows from prohibited entities must distinguish between a customer actively transferring assets from a sanctioned platform and somebody passively receiving a few dollars from an unrelated sender. On a permissionless blockchain, nobody can prevent another wallet from sending assets to their public address.
If both cases create identical compliance outcomes, unsolicited microtransfers become a possible denial-of-service vector against exchange users.
The UK sanctions notice also weakens one part of HTX’s defense
HTX has previously argued that the sanctioned Huobi Global entity is legally separate from the operator of its wider exchange business.
The official UK notice nevertheless creates a complication for that argument. It explicitly includes HTX, HTX Exchange and the htx.com website under the Huobi Global S.A. designation. It also instructs relevant firms to freeze funds where they know or reasonably suspect that they are dealing with a designated person.
That does not prove HTX authorized the disputed microtransfers.
It does explain why another exchange’s compliance department might treat HTX-linked transactions conservatively even while the legal relationship between different corporate entities is disputed.
The problem for users sits precisely between those two facts.
August 23 could make the problem larger in Europe
The timing matters because European restrictions are moving closer.
Reporting on the case says the EU added HTX, identified as Huobi Global S.A., to its restricted crypto-service-provider framework in
July, with the relevant transaction prohibition taking effect on August 23. Binance has already announced restrictions involving HTX and other listed platforms as the deadline approaches.
More institutions screening the same blockchain addresses can increase consistency, but it can also magnify a false-positive problem.
Once analytics providers assign a high-risk label to a wallet cluster, that classification can propagate across exchanges, custodians and other regulated businesses. A user who receives funds innocently may then have to prove something inherently difficult: that an on-chain transfer arriving at a public address was neither requested nor controlled by them.
That is fundamentally different from proving the legitimate source of a deposit the user deliberately initiated.
What exchanges may need to change after the HTX-Kraken dispute
The most consequential outcome may therefore have little to do with determining whether HTX itself sent the transactions.
Exchanges need a method for separating active sanctions exposure from passive contamination.
One possibility would be risk thresholds that consider transaction size, historical relationship with the sending address and whether the recipient subsequently interacts with the funds. Another would be quarantining the disputed deposit itself while leaving unrelated customer assets accessible unless broader evidence justifies an account-level restriction.
Those safeguards carry their own risks. Criminals could deliberately structure transfers below thresholds, while overly permissive treatment might undermine sanctions compliance.
The missing evidence now matters most. Publishing the transaction hashes behind the disputed transfers, documenting which addresses were controlled by HTX versus its customers, and clarifying how many Kraken accounts were actually restricted would allow independent investigators to test the competing explanations.
Until that happens, two claims should remain separate: HTX says its internal systems did not authorize a coordinated poisoning campaign, while Kraken’s sanctions obligations can still justify investigating funds connected to designated infrastructure. The unresolved question is whether today’s compliance systems are precise enough to tell the difference when an innocent wallet receives a transaction it never asked for.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
