Withdrawal whitelist
Also called: address whitelist · allowlist · withdrawal allowlist
Definition
A withdrawal whitelist is an exchange security setting that only allows withdrawals to addresses you have saved and approved in advance, blocking transfers to any new address.
How withdrawal whitelist works
Once the whitelist is on, every withdrawal must go to an address in your address book. Adding a new address usually requires 2FA and email confirmation, and many exchanges add a waiting period before a new address can be used. Details differ by exchange.
The value is in the delay and the extra checks. If someone gets into your account, they cannot simply send funds to their own address; they first have to add it, which triggers alerts and gives you time to react and freeze the account.
A whitelist also reduces copy-paste mistakes. When you pick a labelled saved address, you are less likely to paste a wrong or poisoned address from your history.
Example
Suppose you whitelist two addresses: your hardware wallet and your account on another exchange. An attacker steals your login and session and tries to withdraw 1.2 BTC to a new address. The exchange requires the address to be added first, sends you an email and SMS, and holds new addresses for 24 hours as an illustrative policy. You see the alert, lock the account, and the 1.2 BTC never leaves.
Common mistakes
- Turning the whitelist on but adding addresses copied from transaction history without checking them.
- Adding an address and labelling it vaguely, so you later pick the wrong one.
- Disabling the whitelist for convenience and forgetting to turn it back on.
Learn and practise
FAQ
Is a withdrawal whitelist worth enabling?
For most users who withdraw to the same few addresses, yes. It adds friction only when you add a new address.
Can I withdraw to a new address with the whitelist on?
Yes, but you first need to add and verify it, and some exchanges make you wait before it can be used.