Withdrawal Whitelists: The Setting That Beats Most Hacks

The setting almost nobody enables

A withdrawal whitelist is a list of crypto addresses you approve in advance. Once enabled, the exchange refuses withdrawals to any address not on the list. An attacker who steals your password and even defeats your 2FA can log in, look at your balance, and send it nowhere except to wallets you already control.

Every major venue offers this: Binance, Kraken, Coinbase, OKX, Bybit and the rest. In our experience it is the most underused control in exchange security, usually because it is off by default and adds a small step when you want to withdraw somewhere new.

Why the time lock is the whole point

A whitelist without a delay is a speed bump: the attacker just adds their own address and withdraws to it. The protection comes from the time lock. Adding a new address or disabling the whitelist triggers a mandatory waiting period, typically 24 to 72 hours depending on the venue, before the change takes effect.

That delay converts a silent theft into a loud one. The exchange emails you that a new address was added, and you have a full day or more to log in, remove it, freeze the account and rotate credentials. Account takeovers succeed through speed; the time lock removes speed from the equation.

What it defends against, honestly

The whitelist is aimed at account takeover: phishing, SIM-swaps, credential stuffing, malware on your machine, even a compromised API key. Against that whole class of attacks, a time-locked allowlist is close to a complete defense, which is why we check for it in every exchange review.

It does not protect against everything. If the exchange itself is breached or insolvent, your whitelist is irrelevant, since the attacker is moving coins from omnibus wallets, not your account. And it cannot save you from address-poisoning mistakes when you whitelist a wrong address yourself. Verify every address twice at the moment you add it.

Anti-phishing codes: the companion setting

Most large venues also offer an anti-phishing code: a personal phrase you set once, which then appears in every legitimate email the exchange sends you. A phishing email pretending to be your exchange will not contain your phrase, giving you a reliable one-glance check that no spoofed sender address can fake.

It costs nothing and takes a minute to set. Phishing remains the top entry point for account takeovers, and the code attacks the problem at the first step of the chain, before your credentials are ever typed into the wrong page.

The setup we actually recommend

Enable the whitelist, add your own wallet addresses, and confirm the lock period applies to both new addresses and to disabling the feature, since a whitelist that can be switched off instantly protects nothing. Then set the anti-phishing code, and put a hardware key or passkey on the account so the takeover never happens in the first place.

When we score account security across venues, this stack is the checklist: FIDO2 support, TOTP, time-locked whitelists, anti-phishing codes. It feeds the Security pillar that carries 20% of our base ranking and about 30% on the safest-exchanges page. Exchange-side risk you can only research; account-side risk you can actually close, tonight, for free.

FAQ