Whitelisting (withdrawal allowlist)
A security setting that restricts withdrawals from an account to addresses you approved in advance, usually with a time delay on adding new
Whitelisting, on crypto platforms usually meaning a withdrawal allowlist, restricts where funds can leave your account to a short list of addresses you approved in advance. An attacker who gets into the account can then still see the balance, but cannot send it anywhere new.
The detail that makes it work is the delay. Good implementations lock changes to the list behind a waiting period, commonly 24 to 48 hours, plus fresh confirmation through email and 2FA-style checks. So even a thief holding your password and your session cannot add their own address and drain the account in one sitting; the delay gives you time to see the notification and lock things down.
A concrete setup: enable the allowlist, add the address of your own self-custody wallet, and leave it there. Day-to-day withdrawals feel identical. The difference only appears on the bad day, which is the point of most security settings.
The cost is mild friction: adding a new exchange or a new wallet means planning a day ahead. For any account that holds more than pocket money, the trade is usually easy to justify, and it belongs on the same shortlist as strong 2FA and a unique password.