Whitelist
A whitelist in crypto is a security setting that restricts withdrawals to a pre-approved set of wallet addresses. Even if an attacker gains full access to your exchange account — including bypassing 2FA — they cannot withdraw funds to a new address without a waiting period (typically 24–48 hours), during which you can detect and stop the attack. Most major exchanges offer withdrawal whitelisting; it is strongly recommended for any account holding significant funds.
How Withdrawal Whitelisting Works
When you enable withdrawal whitelisting on an exchange, you register one or more destination wallet addresses as trusted. The registration process requires email confirmation and in most cases a 24–48 hour cooldown period before the address becomes active. Once the whitelist is live, the exchange will only process withdrawal requests to addresses on that list.
Any attempt to withdraw to a new, unregistered address is blocked until that address goes through the same registration and cooldown process. This is the core of the protection: the cooldown creates a mandatory delay that gives you time to notice and respond to unauthorized activity. An attacker who gains full account access — even with your 2FA code — faces this same mandatory delay before they can extract funds to a new destination.
Enabling Whitelisting on Major Exchanges
The feature exists across all major platforms, though naming conventions vary slightly:
- Binance. Security → Withdrawal Whitelist → Enable. Each address requires email confirmation and a 24-hour hold before becoming active. Binance also sends email alerts for any whitelist modification.
- Bybit. Account & Security → Withdrawal Address Management → Enable Whitelist. Similar 24-hour cooldown. Bybit additionally suspends withdrawals to new addresses for 24 hours after any security setting change.
- OKX. Assets → Withdrawal → Address Book → Enable Withdrawal Address Whitelist. 24-hour waiting period per address with email notification.
- KuCoin. Security → Withdrawal Whitelist. 24-hour hold. KuCoin also supports an IP whitelist for API access — a separate but related feature.
The setup is a one-time process that takes under five minutes. The inconvenience for infrequent withdrawers is negligible — you simply plan ahead by adding a new address a day before you need it.
IP Whitelisting for API Keys — A Different Concept
Separate from the withdrawal whitelist is IP whitelisting for API keys. When you create an API key for trading bots or third-party tools, you can restrict that key to only function from specific IP addresses. This prevents stolen API keys from being used by attackers operating from different infrastructure. IP whitelisting for API keys complements withdrawal whitelisting and is especially important for accounts used with automated trading.
The two features address different attack surfaces: withdrawal whitelisting blocks unauthorized fund extraction regardless of how an attacker got into your account; IP whitelisting for API keys blocks unauthorized trading and data access from unexpected locations. Both should be enabled on accounts with significant balances.
What Happens When an Attacker Tries to Add a New Whitelist Address
This is where the system's design matters most. If an attacker with full account access tries to add their own address to your whitelist, the exchange sends an email confirmation request to your registered email address. This creates a second-factor notification channel independent of the exchange account itself. If you see an unexpected "whitelist modification request" email — even if you didn't trigger it — treat it as an active security incident immediately.
The correct response: do not click any links in the suspicious email. Log into your exchange account directly (type the URL in your browser), revoke all active sessions, change your password, and check your security log for unauthorized access. Then contact exchange support through official channels to report the incident. The 24–48 hour cooldown means you have time to act before any funds can move — but only if you respond quickly upon seeing the notification.
Whitelist Limitations and How to Complement It
Whitelisting is a strong defensive layer but not a complete solution on its own. It does not protect against attackers who compromise your email account simultaneously with your exchange account — if they control both, they can confirm whitelist additions and wait out the cooldown undetected. This is why email account security is as critical as exchange account security.
Use a dedicated email address for your exchange account — one that is not publicly linked to your identity or used for any other purpose. Enable strong 2FA on that email account using an authenticator app, not SMS. Consider a hardware security key (YubiKey) for email login if your email provider supports it. Combined with withdrawal whitelisting, this creates a layered defence that is difficult to defeat without physical access to your devices.
Frequently Asked Questions
How does a withdrawal whitelist work on Binance or Bybit?
You add a wallet address to your whitelist and confirm via email. After a cooldown period (usually 24–48 hours), withdrawals are restricted to only that address. Any attempt to withdraw to a new address triggers a new confirmation process and another cooldown — giving you time to detect a breach.
Does a whitelist protect against SIM swap attacks?
Partially. If an attacker SIM swaps your phone number and uses it to bypass 2FA, they still cannot immediately withdraw to a new address because of the whitelist cooldown. This gives you a window to notice the attack and lock your account.
Can an attacker bypass a withdrawal whitelist?
The whitelist itself cannot be bypassed quickly. However, an attacker with full account access can add their own address to the whitelist and wait out the 24–48 hour cooldown. This is why unusual 'whitelist modification' emails should be treated as urgent security alerts.
Should I use a whitelist if I only trade and don't withdraw often?
Yes — especially if you rarely withdraw. The inconvenience of whitelisting is minimal for infrequent withdrawals, and the protection is significant. Think of it as a vault lock: slightly slower to open, but much harder for an attacker to use.
Is there a whitelist for DeFi wallets?
DeFi wallets don't have exchange-style whitelists, but some hardware wallets (like Ledger Enterprise) and smart contract wallets (like Gnosis Safe) support address allowlists that restrict where funds can be sent. For personal MetaMask or Trust Wallet users, the equivalent protection is a hardware wallet requiring physical confirmation for each transaction.