A whitelist restricts withdrawals to addresses you added in advance. It will not save you from being talked into adding an address. To leave time to respond after an account takeover, also check that a waiting period for new addresses is enabled and review the restrictions on disabling the whitelist.
How it actually works
With it enabled, withdrawals on the covered channels are restricted to listed addresses. A new destination must be added first; whether it then has to wait depends on the platform and the settings you have enabled. Specific rules and durations vary by platform — go by the current page of the one you use.
A few things usually come with it: adding an address typically requires a second-factor confirmation, turning the feature off often has its own waiting period, and some platforms let you set it per asset or per network. Worth reading the platform's own description once when you enable it, rather than assuming.
What it stops: the immediate drain after a takeover
Picture the scenario it is designed for: at some point, somebody else has control of your account. Password leaked, session hijacked, device compromised. Without a whitelist they can initiate a withdrawal to their own address, and the whole thing can be over in minutes.
With a whitelist, they face two unattractive options: withdraw only to addresses already on your list — which are yours, and which they cannot access — or add a new address and, if a waiting period is enabled, wait for it to end. And that wait is where the notification goes out, where you notice, and where you can freeze the account.
The list restricts destinations; the waiting period delays the use of a new one. Do not assume that enabling the list also enables the delay.
What the cooling period adds
If a newly added address were usable immediately, the protection would largely evaporate — whoever controls the account would just click a few more times. A waiting period is an extra layer of protection. Binance lists it as a separate control in its withdrawal settings documentation (checked October 2026). Confirm that the control is actually enabled.
Two things follow that are worth doing at the same time. First, confirm your notifications actually reach you: email deliverable, push not silenced, and alerts for events like "new withdrawal address added" not filtered out. A long cooling period is worthless if you never hear about it.
Second, find out now how to freeze the account. Most platforms offer a self-service freeze or withdrawal-disable control. Locating it in advance is much faster than searching for it during an incident, and searching at that moment is exactly the situation described in how fake support finds you.
What it does not stop: you adding the address yourself
A whitelist verifies that you added an address. It does not verify who the address belongs to. This needs saying because most write-ups of the feature only list its benefits.
The failure modes look like this. Someone posing as support tells you to move funds to a "safe account", and you add that address yourself. You copy a receiving address from an impostor page. Or clipboard contents get substituted between copy and paste. In all three the whitelist allows it through, because the addition genuinely was your action.
So it needs companion habits: send a small test amount the first time you use any new address; check the first and last characters against the source after pasting; and only use addresses you copied yourself from the destination account, never ones handed to you. Whether an address is at least well-formed can be checked with the transfer address checker — it does format and checksum work only, in your browser, sending nothing anywhere.
Correct format is not the same as correct recipient
Any address checking tool can only tell you whether a string is a validly formed address. It cannot tell you who it belongs to. Clipboard substitution and impersonated recipients defeat every checker there is; only a small test transfer and independent confirmation address those.
Check API withdrawal permissions too
Check API withdrawal permissions and IP restrictions separately, including whether the platform applies its address whitelist to API withdrawals. Do not assume that an API bypasses the whitelist or that a web setting covers every channel.
API keys accumulate more easily than you would think — a trading bot tried once, a portfolio tracker, a tax tool, a script. They tend to be created and forgotten while their permissions remain.
Five minutes, worth spending
- List your existing API keys and delete the unused ones. Deleting beats disabling; nobody re-enables something that is gone.
- Remove withdrawal permission from the ones you keep. Reading prices, tracking balances and placing trades do not require withdrawal permission.
- Where withdrawal permission is genuinely needed, bind the key to an IP address. Most platforms support this.
- Check sub-accounts. Their withdrawal settings are usually independent of the main account.
Same underlying logic as the whitelist itself: reduce the number of paths by which funds can leave, rather than locking only one of them.
What it costs you day to day
There is a cost, and it lands at the least convenient moment. Needing to send to a new address means adding it and, if a waiting period is enabled, letting that period finish. If you are doing something time-sensitive, that wait is unpleasant.
Secondary costs: address books accumulate entries you no longer use, and adding an address usually needs a second factor, which is awkward when the device is not to hand.
Whether it is worth it depends on how you use the account. For long-term holding with infrequent withdrawals the cost is close to zero and the benefit is large. For frequent withdrawals to varied addresses it will feel restrictive. We would still enable it, on one principle: the inconvenience is paid on normal days, and the protection is delivered on the worst one.
Using it without the friction
Four things that remove most of the annoyance
- Add your regular addresses in advance. Add and verify them while nothing is urgent; if a waiting period applies, let it finish in advance.
- Label every entry properly. Purpose and destination, not just the network name — in six months you will not recognise them otherwise.
- Prune periodically. Fewer entries, fewer chances to pick the wrong one.
- Always test with a small amount first. This habit is worth more than the whitelist.
If you are setting up a new account, doing this alongside two-factor and identity verification is the least effort overall — the order is in the sign-up guide. Configuring it while there is nothing in the account is the cheapest moment there will ever be.