Whitelisting your withdrawal addresses
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 4 min
In short
Most exchanges let you restrict withdrawals to addresses you registered in advance. Because adding a new one takes a waiting period, an attacker who takes over the account cannot immediately move funds out. Turn it on where it is offered.
Key points
- Restricting destinations means a hijacked account cannot send to an unknown address
- The waiting period on new entries is the window in which you notice something is wrong
- Label each entry so its purpose is obvious at a glance
- Remove entries you no longer use
Definition
An exchange feature restricting withdrawals to addresses you have pre-registered and approved — often called a whitelist or address book.
An account takeover becomes a loss at the moment of withdrawal, not at the moment of entry. Narrow the exit and you may be able to stop the loss even after entry. That is what address whitelisting is for: with it enabled, funds can go only to addresses you registered, and an attacker wanting to add their own faces an extra approval step and a delay.
That delay is the real defence. At most exchanges a newly registered address is unusable for a set period, and a notification of the registration goes out immediately. A registration notice you did not trigger is your signal that the account is compromised — change the password, re-establish two-factor authentication and contact the exchange straight away.
The knack is keeping the list tidy. Register only destinations with a clear purpose — your vault wallet, your daily wallet — and label each with what it is for. Verify every new entry with a test transfer before using it for a real withdrawal, and delete addresses you no longer use or one-off destinations you gave to someone else. The longer the list, the easier it is to slip something into it unnoticed.
Names and behaviour vary by exchange, and some pair this with address locking, IP restrictions or a withdrawal kill switch. When you open an account, read through the security settings once from top to bottom and enable everything useful — a high priority for any account holding a meaningful balance.
Watch out for
- · A registration notice you did not trigger means the account is compromised — act immediately
- · A whitelist cannot protect you from a wrong address you registered yourself
- · Even for a whitelisted entry, send a test amount before the first real withdrawal
Frequently asked questions
Will whitelisting get in the way when I need to withdraw urgently?
If your usual destinations are already registered, the waiting period applies only to new ones. Register — and test — any destination you might need in a hurry while things are calm.