How to enable a withdrawal whitelist
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
A withdrawal whitelist restricts withdrawals to addresses you registered in advance, so even someone who takes over your account cannot send funds to their own address. Registration normally requires two-factor authentication and a waiting period — and that waiting period is the heart of the protection. Turn it on wherever your exchange supports it.
Key points
- It blocks withdrawals to anything but registered addresses, sharply limiting takeover damage
- Adding an address normally requires 2FA and a waiting period before it becomes usable
- If an unfamiliar registration notice arrives during that wait, you still have time to act
- You must still check the address, the network and any tag when registering
Definition
A feature that limits crypto withdrawals to addresses registered in advance. Operators call it a whitelist, an address book, or registered withdrawal addresses.
What this setting changes is the shape of the damage. Suppose your password leaks and two-factor authentication is defeated as well. Without a whitelist, the attacker types their own address and the funds leave. With one, withdrawals can only go to addresses you registered, so they must first add a new one — and that registration needs extra authentication and a waiting period. That time is your chance to notice and stop it.
Setting it up generally means enabling the feature on the security settings screen and registering the addresses you want to use. Registration asks for a label of your own choosing, the address, the network, and a destination tag or memo where required. Confirming usually needs 2FA or an email approval, and most designs impose a delay before the new entry actually becomes usable.
Verify the address you register with exactly the care you would give a live transfer. A whitelist only permits withdrawals to what you registered; it does not check that what you registered is right. Register a wrong address and the funds go reliably to the wrong place. Copy it from the recipient's official screen, compare the first and last characters after pasting, and make the first transfer a small test.
Notifications are what make this work in practice. Enable email or app alerts for address registrations, changes and withdrawals. An unfamiliar registration alert gives you the waiting period to change your password, reset two-factor authentication and contact support. With notifications off, you throw away half the benefit of the feature.
Review the registered list periodically as well. Addresses from exchanges you no longer use, or wallets you have retired, are just opportunities to pick the wrong one. Delete what you no longer need. And if you have granted withdrawal permission to an API key, using this feature alongside it is effectively mandatory.
Watch out for
- · A whitelist does not prevent mistakes. You still need to verify the address itself and still need a test transfer
- · Because of the waiting period, it will not accommodate an urgent send to a brand-new destination. Plan transfers with time to spare
- · A registration alert you do not recognise means your account may be compromised. Change your password, review 2FA, and contact support through the official channel immediately
Frequently asked questions
Does every exchange have this?
No. Whether it exists, what it is called and how long the wait lasts all differ by operator. Treat its availability as one of the security points to check when comparing exchanges.