How to Set Up Withdrawal Address Whitelisting
Restrict withdrawals to pre-approved addresses only. An essential security feature to protect against unauthorized transfers.
Whitelisting turns withdrawals into a closed list: funds can only leave to addresses you registered in advance, and a new address cannot be used for 24 hours after you add it. That delay is the whole mechanism. It means somebody who reaches your account still cannot move funds anywhere new before you notice and revoke.
Before you start
- 2FA or a passkey, since adding an address requires a security factor.
- The addresses you genuinely withdraw to, copied from the receiving wallets.
Navigate to Whitelist Settings
Go to Profile > Security > Withdrawal Whitelist. This feature allows you to create a list of trusted external addresses. When enabled, withdrawals can only be sent to addresses on your whitelist.
Add a Trusted Address
Tap 'Add Address'. Enter a label (e.g., 'My Ledger'), the wallet address, and select the network. Complete the 2FA verification to confirm. The address will be added to your whitelist after a 24-hour security cooling period.
Understand the 24-Hour Delay
Newly whitelisted addresses become active after 24 hours. This delay is a security measure: if an attacker gains temporary access to your account, they cannot immediately withdraw to their own address. You will receive email and push notifications when new addresses are added.
Enable Whitelist-Only Withdrawals
Toggle on 'Whitelist Only' mode in the whitelist settings. Once enabled, any withdrawal attempt to a non-whitelisted address will be rejected. This provides strong protection even if your 2FA is compromised.
Manage Your Whitelist
Review your whitelisted addresses periodically. Remove addresses you no longer use. You can disable and re-enable whitelist mode at any time, though re-enabling may require a security verification. Keeping a clean, minimal whitelist maximizes your account security.
If something goes wrong
- A newly added address will not accept a withdrawal yet.
- The 24-hour delay has not elapsed. It cannot be waived — that is what makes whitelisting worth having.
- You need to withdraw urgently to an address that is not listed.
- With whitelist-only mode on, you wait. Plan around it by adding the addresses you might need before you need them.
- An address you do not recognise is on the list.
- Remove it, revoke every other session, and rotate your security factors. An unfamiliar whitelist entry is the strongest signal that somebody else has been in the account.
Frequently asked questions
- Should everyone turn on whitelist-only withdrawals?
- If you send to the same handful of addresses, it is the best security setting available. If you send to new addresses constantly, the 24-hour wait will be a real cost.
- Does whitelisting cover every asset?
- Addresses are registered per asset and network, so add the pairs you use rather than expecting one entry to cover a coin everywhere.
- Can I remove an address immediately?
- Removal takes effect at once — the delay exists on adding, not on taking away.