Withdrawal Address Whitelist: What It Is and How to Turn It On
A withdrawal address whitelist is an exchange setting that only allows withdrawals to addresses you approved in advance. If someone gets into your account, they cannot send funds to their own address without also adding it to the list, which usually requires 2FA and may trigger a waiting period.
Most exchange security settings protect the login. A withdrawal address whitelist protects the exit. Once it is on, your account can only send crypto to addresses you approved earlier, so a stolen password alone is not enough to drain the balance.
This guide explains what the feature does, gives general setup steps, and covers the waiting periods that make it effective. For exchange-specific withdrawal walkthroughs, see guides like our Bybit withdrawal guide.
What a whitelist does
Without a whitelist, anyone who gets past your login and 2FA can paste any address and withdraw. With a whitelist, the withdrawal screen only lets you choose from your approved list. To send anywhere else, the attacker must first add a new address, which typically needs another 2FA check and, on many exchanges, a waiting period before the new address can be used.
That waiting period is the real protection. It gives you time to notice the security email, log in, and freeze the account. Exchange hacks of the platform itself, such as the incident covered in our report on Bitget resuming withdrawals after a hack, are a different risk that a whitelist does not address; our explainer on what happens when an exchange gets hacked covers that side.
How to set it up
Menus differ, so follow your exchange’s own help page. The general flow looks like this:
- Open account settings and find the security or withdrawal section.
- Open address management and add an address. Choose the coin and network, or a universal address for a whole network if offered.
- Label it clearly, for example “Ledger BTC” or “Main exchange USDT TRC20”.
- Tick the option to add the address to the whitelist and confirm with 2FA or a passkey.
- Turn on the whitelist (sometimes called whitelist-only withdrawals) and confirm again.
- If offered, enable a waiting period for newly added addresses.
As an official example, Binance’s withdrawal settings page (checked 2026-10-29) walks through enabling the whitelist, adding addresses with a coin and network or as a universal address, and setting the limit for new addresses. Binance.US’s whitelist guide shows a similar flow and notes the feature is web only there.
Lock periods after adding a new address
Lock periods are where exchanges differ most, and where you should only rely on the official page.
| Exchange page checked | What it says about new or changed addresses |
|---|---|
| Binance (withdrawal settings) | Optional limit on new whitelist addresses of 24, 48 or 72 hours; modifying the whitelist may suspend withdrawals for a similar period |
| Binance (disabling) | Turning the whitelist off can trigger a temporary withdrawal suspension if the limit was enabled |
| Binance.US (whitelist guide) | Whitelist is optional, managed on the website, not the mobile app |
We only list what those pages state. For any other exchange, read its help center on the day you set it up, since rules change.
The practical lesson: add the addresses you will need before you need them. Discovering a 48-hour lock on the day you want to move funds is frustrating, but it is exactly what stops an attacker.
Whitelist vs 2FA vs anti-phishing code
These features cover different steps of an attack, so they work best together.
| Feature | What it protects | What it does not stop |
|---|---|---|
| 2FA | Login and sensitive actions | Phishing pages that capture the code in real time |
| Anti-phishing code | Lets you tell real emails from fake ones | A login on a fake website |
| Withdrawal whitelist | Where funds can be sent | Trades or transfers inside the account |
| New-address lock | Time to react after an address is added | An attacker who waits out the lock unnoticed |
Turn all of them on. Also check large-withdrawal policies if you move bigger sums; our comparison of BingX vs Bitget for large withdrawals covers how limits differ.
Common mistakes
- Whitelisting the wrong network. An address saved for one network should not be used for another, even for the same token. Our guide on sending crypto on the wrong network explains why.
- Forgetting the memo. Save the memo or tag with exchange deposit addresses.
- Never reviewing the list. Remove old addresses you no longer control.
- Ignoring security emails. An email saying a new address was added is your cue to act if you did not do it.
themexc.com is an independent site, not affiliated with any exchange. This article is general information, not financial or legal advice. Rules and fees change; check each platform’s official help page before acting.
Frequently asked questions
Does a whitelist stop all theft from my exchange account?
No. It blocks withdrawals to unapproved addresses, but an attacker who controls your email and 2FA could still try to add an address. That is why the waiting period after adding addresses, and strong 2FA, matter as much as the list itself.
How long is the lock after adding a new address?
It depends on the exchange and sometimes on your own setting. Binance's help page (checked 2026-10-29) describes an optional limit of 24, 48 or 72 hours on newly added whitelist addresses. Other exchanges publish their own rules.
Can I still withdraw to a new address in an emergency?
Usually only after adding it and passing any lock period, or after turning the whitelist off, which on some exchanges also triggers a temporary withdrawal suspension. Plan ahead by whitelisting the addresses you are likely to need.
How many addresses can I whitelist?
Limits vary. Binance says you can whitelist up to 200 withdrawal addresses. Check your own exchange's help center for its limit.
Is a whitelist available on mobile?
Not always. Binance.US says its whitelist features are available on the website and not in the mobile app. Check your exchange's help page before assuming the setting is in the app.
Should I whitelist an address that needs a memo?
Yes, but save the memo or tag with the address if the exchange allows it. A whitelisted address with a missing memo can still lead to a deposit the other side cannot credit automatically.