What is withdrawal whitelist?

A list of pre-approved addresses that are the only destinations your account can send to, sometimes presented as an address book.

It is the control that survives a full account compromise. Two-factor authentication tries to keep an attacker out. A whitelist assumes they got in anyway and asks a different question: where could they possibly send the funds. If the answer is only addresses you approved days ago, the answer is nowhere useful.

The distinction that matters is between an address book and a whitelist. Saving addresses for convenience is not the same as restricting withdrawals to saved addresses only, and on most venues the second is a separate setting you must switch on.

How it works

You add an address, confirm it through email and your second factor, and the exchange applies a waiting period before that address can receive anything, commonly 24 to 48 hours. Once the wait clears, withdrawals to it proceed normally.

With whitelist enforcement enabled, any address not on the list is simply refused. Adding a new one restarts the wait, which is the point: an attacker who takes over the account cannot add their own address and withdraw in the same session, and the delay gives the notification emails time to reach you.

Implementations differ in ways worth checking on your venue. Some require the second factor on each addition, others on each withdrawal too. Some apply the delay only when the whitelist setting is on. Some let you tie an address to a specific network, which prevents the common error of sending an asset over a chain the destination does not support. And some exempt withdrawals to accounts on the same platform.

A whitelist also defends against a threat two-factor authentication does not: clipboard malware that swaps a copied address for the attacker's at the moment you paste. If you always send to a saved entry rather than a freshly pasted string, there is nothing for that malware to substitute.

Example

Illustrative. Your password leaks and an attacker defeats your second factor by phishing a code in real time.

Without a whitelist they add their address and withdraw immediately, and the first you learn of it is the confirmation email. With a whitelist enforced, they can log in, view your balances, and trade, and the withdrawal is refused because their address is not listed. Adding it starts a 24-hour timer that sends you an email, giving you a day to change the password, revoke sessions, and contact support.

The attacker got in. They did not get the funds out.

Why it matters when you buy

This is a setup step that costs a few minutes before the first deposit and cannot be added retroactively during an incident. Combined with app-based codes, it removes the most common path by which exchange balances are lost. The exchange directory lists security features by venue, and the guide on two-factor authentication for crypto covers the wider setup.

Related terms

• two factor authentication: the control this backs up
• address book: saved addresses without enforcement
• cooling off period: the delay on new entries
• clipboard malware: the attack whitelists neutralize
• address poisoning: why pasted addresses are risky
• withdrawal limit: the other constraint on the exit

Questions

Does a whitelist slow down my own withdrawals?

Only when adding a new address. Sending to an entry that has already cleared its waiting period is as fast as any other withdrawal.

What if I need to withdraw somewhere new urgently?

You wait out the delay, which is the feature working as designed. Adding the addresses you expect to use in advance, before you need them, is the way to avoid the situation.

Is it worth enabling for small balances?

It costs a few minutes once and applies to every future balance on that account. Enabling it at signup is easier than remembering to do it after the account has grown.