Withdrawal whitelist

Switching it on turns account theft from a payout into an inconvenience. Binance lets you whitelist addresses and delay withdrawals to new ones; Kraken's Global Settings Lock blocks adding an address at all, and unlocking it without a master key takes at least 24 hours and can be set for as long as 30 days. The delay is the security feature, not the list.

How it works

A whitelist separates two actions that most accounts treat as one: choosing a destination, and sending funds there.

You register an address while the account is healthy and nobody is rushing you. The exchange confirms it by email, sometimes with a second factor, and the entry becomes usable. Once the whitelist is enforced, a withdrawal request to any address not on the list is refused outright, no matter how correct the password and the one-time code are.

That moves the attack to a single point: adding a new entry. Good implementations gate exactly that step. Kraken's Global Settings Lock prevents new withdrawal addresses from being added while it is on, and turning it off runs on a timer you set in advance, with email notification of every unlock attempt. Kraken support cannot shorten that timer, which is what makes it worth anything. Binance offers the same idea in a lighter form, letting you hold newly whitelisted addresses in a waiting state before they can receive funds.

The threat model is worth stating plainly. An attacker who has your password and a live second factor can do everything else: log in, read your balances, place trades, change your display name. What a delayed whitelist denies them is the only step that actually loses your money, and it gives you a notification email during a window when you can still cancel. A whitelist that accepts new addresses instantly is decoration.

Where you see it

Every large exchange offers some version of a withdrawal whitelist, usually buried two levels into the security settings and off by default.

Turn it on alongside an authenticator app rather than SMS codes. A SIM swap hands an attacker your text messages and therefore your second factor, but it does not add an address to your list. The two controls cover different failures, and the whitelist is the one that survives losing your phone number.

Be careful about what you put on the list. The right entry is a receive address from a wallet you control, and on a hardware wallet you should confirm the characters on the device screen before copying them anywhere. Registering an address that came off a compromised clipboard, or one lifted from a poisoned transaction history, whitelists the attacker permanently and politely. Verify once, carefully, then let the list do its job.

Withdrawal whitelist vs two-factor authentication

Two-factor authentication protects the login; a withdrawal whitelist protects the destination. One answers the question is this really you, and the other answers the question is this really where your coins should go. They fail differently, which is why running both matters: an attacker who phishes a live code in real time, or who takes over your phone number, has fully satisfied two-factor authentication and still cannot send coins to an address you never approved. Treat the second factor as the lock on the door and the whitelist as the reason the burglar leaves empty handed.