Withdrawal Whitelist

A withdrawal whitelist is a powerful account security feature offered by most major cryptocurrency exchanges. It works by creating a list of trusted wallet addresses — addresses you have personally verified and approved — and restricting all withdrawals to only those addresses. If someone gains unauthorized access to your account, they cannot send your funds to their own wallet because it is not on your whitelist. Think of it like a payee list at your bank — you can only transfer money to contacts you have previously registered and verified. Any attempt to send funds to an unrecognized address is automatically blocked, regardless of whether the person attempting the withdrawal has your password and 2FA code. When you add a new address to your whitelist, exchanges typically impose a mandatory waiting period — commonly 24 to 48 hours — before that address becomes active for withdrawals. This cooling-off period exists to give you time to notice and cancel any unauthorized address additions. During this window, the exchange usually sends an email notification to alert you that a new withdrawal address is being registered. Withdrawal whitelisting is especially valuable because it provides protection beyond login security. Even if an attacker bypasses your password and 2FA — through a sophisticated phishing attack or session hijacking — they still cannot move your funds to an address they control unless it was already whitelisted. Enabling withdrawal whitelisting does reduce flexibility — adding a new withdrawal address requires advance planning due to the waiting period. For users who send funds only to a small number of addresses they control (such as their personal hardware wallet), this is a minor inconvenience that delivers substantial security value. It is strongly recommended for anyone holding meaningful amounts on a centralized exchange.