How to Configure Withdrawal Security Settings
Maximize the security of your withdrawals with address whitelisting, confirmation requirements, and cooling periods.
Withdrawal settings are where an account stops being merely protected and becomes hard to drain. Whitelisting restricts where funds can go, confirmation requirements decide what proof is needed to send them, and alerts tell you the moment a large withdrawal is attempted. The three together mean a stolen session is not the same thing as stolen funds.
Before you start
- 2FA or a passkey already set up — the confirmation step needs something to confirm with.
- The destination addresses you actually use, ready to add to the whitelist.
Review Current Settings
Navigate to Profile > Security > Withdrawal Security. This page shows your current withdrawal protection level: whitelisting status, confirmation requirements (email + 2FA), and any active cooling periods for new addresses.
Enable Address Whitelisting
Toggle on address whitelisting to restrict withdrawals to pre-approved addresses only. New addresses require a 24-hour waiting period before they become active. This prevents instant theft if your account is temporarily compromised.
Configure Confirmation Requirements
Ensure both email confirmation and 2FA are required for all withdrawals. Some users also enable additional confirmation steps for withdrawals exceeding a specified amount. These layers of verification make unauthorized withdrawals extremely difficult.
Set Large Withdrawal Alerts
Configure threshold alerts for withdrawals above a certain amount. When a withdrawal exceeding your threshold is submitted, you receive an immediate push notification and email alert, giving you time to cancel if it was not authorized.
Review and Update Regularly
Periodically review your whitelisted addresses and remove any you no longer need. Keep your 2FA device secure and backup codes stored safely offline. Strong withdrawal security is your last line of defense against unauthorized fund transfers.
If something goes wrong
- A withdrawal is blocked to an address you own.
- Whitelist-only mode is doing its job. Add the address, wait out the cooling-off period, then retry — the delay is the point and cannot be skipped.
- You are locked out of your own settings after a device change.
- Restore access with a backup code or a second registered device, then re-register the new one. Security settings deliberately require a full factor, not just an open session.
- You want whitelist-only off temporarily.
- Disabling it is itself a security-sensitive change and takes effect on its own delay. Treat it as a decision made days ahead rather than minutes.
Frequently asked questions
- Why is there a delay after adding a whitelist address?
- So that an attacker who gets in cannot add their own address and empty the account in the same session. The delay gives you time to notice and revoke.
- Should I turn on whitelist-only withdrawals?
- If you withdraw to the same few addresses, yes — it is the single strongest setting here. If you withdraw to new addresses often, the delay will be a nuisance.
- What should a large-withdrawal alert be set to?
- Low enough that a real theft trips it, high enough that ordinary activity does not. Many people set it near their typical withdrawal rather than their maximum.
- Do these settings apply to internal transfers?
- They govern withdrawals leaving the platform. Moving value between your own wallets is unaffected.