What is address book?

A saved list of withdrawal destinations on an exchange account, usually with a delay or an extra confirmation before a new entry can be used.

Its value is that it turns an address into a name you can recognize, which defends against clipboard-swapping malware and against pasting the wrong string. Combined with a withdrawal whitelist, it means an attacker with your password and session still cannot send funds anywhere new immediately.

The mistake people make is treating the address book as a convenience feature and skipping the verification step when they add an entry. The book only protects you if the address inside it was correct on the day you saved it. After that it is trusted forever.

How it works

Adding an entry is a security event, not a settings change. Exchanges normally require a second factor, send a confirmation email, and impose a waiting period before the new destination can receive anything.

Entries are usually scoped to one asset and one network. The same wallet has a different address on Bitcoin than on Ethereum, and a token on Ethereum is not the same destination as the same token on a layer 2 network, so a single wallet may occupy several rows.

Some venues let you tag an entry as belonging to you or to a third party, and to name the receiving institution. That field exists because of the travel rule, which requires transfer originator and beneficiary information above certain thresholds.

Where the exchange also offers a whitelist setting, turning it on restricts withdrawals to book entries only. Turning it off is itself delayed, which is the point: the delay outlasts the window an attacker has inside your session.

Example

Illustrative: you add your hardware wallet's Bitcoin address as "Cold storage" on a Tuesday, confirm by email, and the exchange applies a 24-hour hold. On Wednesday you withdraw by picking the name from a dropdown with no copying and pasting. On Thursday an attacker who has your password and one-time code tries to withdraw to their own address, finds whitelisting on, adds a new entry, and triggers an email and another 24-hour wait, which is the window in which you notice and lock the account. Hold lengths vary by exchange.

Why it matters when you buy

Buying is the easy part; the risky step is the first withdrawal to your own wallet. An address book removes the two most common ways that step goes wrong, which are pasting a poisoned string from your transaction history and sending an asset over the wrong network. Set it up before your first withdrawal rather than during it, and see the guide on moving crypto off an exchange for the full sequence.

Related terms

• withdrawal whitelist — restricting withdrawals to saved entries
• deposit address — the string you are saving
• clipboard malware — the attack the book defends against
• address poisoning — why copying from history is unsafe
• two factor authentication — the gate on adding an entry
• memo destination tag — the second field some chains require

Questions

Should I turn on whitelisting even if it is optional?

Yes for any account holding a balance you would mind losing. The cost is a delay the first time you use a new destination, and the benefit is that a stolen session cannot move funds anywhere you have not already approved.

Do I need a separate entry for each network?

Usually. Exchanges index entries by asset and network because sending an asset to an address on the wrong chain is a common and often unrecoverable error.

What if I get an email about an address I did not add?

Treat it as a live compromise. Change the password, revoke active sessions and API keys, and contact the exchange before the waiting period expires.