Withdrawal whitelist
A withdrawal whitelist is an exchange setting that only allows withdrawals to addresses you saved in advance. Even if someone breaks into your account, they cannot send the funds to themselves.
How it works
You add your verified addresses to the list: your hardware wallet, another account of yours. Once it is on, the exchange rejects any withdrawal to an address not on the list. Adding a new address requires 2FA and email confirmation.
Many exchanges also freeze withdrawals for a while after you add an address or change security settings, often for 24 hours or more. It is inconvenient, but that pause gives you time to notice a break-in and lock the account before money leaves.
A whitelist matters most if you have API keys for bots: even if a key leaks, it cannot withdraw to an outside address. It also protects against your own mistakes and clipboard-swapping malware, since only saved addresses work.
You turn on the whitelist and save two addresses: your BTC wallet and your USDT wallet on Tron. A month later your password and an SMS code leak, the thief logs in and tries to withdraw 2,000 USDT to their address. The exchange refuses, and adding a new address triggers a delay that gives you time to lock the account.
The mistake is leaving the whitelist off because "the extra steps are annoying", or adding addresses copied from chats or transaction history. Turn it on right away, add only your own wallets after checking them in full, and label each entry with what wallet it is and which network it uses.
Questions and answers
What is a withdrawal whitelist in simple terms?
It is a list of approved addresses: the exchange sends funds only to those, and refuses any other address.
Why do I need a whitelist if I have 2FA?
2FA can be bypassed with a SIM swap, phishing or a leaked key. A whitelist is another barrier: even with account access, a thief cannot withdraw to their own address.
Why are withdrawals blocked for a day after adding an address?
It is a safety delay: if an attacker added the address, you have time to notice and freeze the account. The length depends on the exchange.
Related terms
Read next
Six settings that close the most common ways exchange accounts get taken over. It takes about half an hour.
Read →How to store your seed phrase and keys: a simple schemeYour seed phrase gives full access to a wallet. Where to keep it and what never to do.
Read →2FA (two-factor authentication)2FA is a second lock on your account: besides the password you need a code from an app, a hardware key or an SMS. If…
Updated: 2026-10-19