How to Set Up a Withdrawal Address Allowlist
An allowlist lets your exchange send crypto only to addresses you saved. Add verified addresses, keep the new-address lock on, and still test first.
Direct answer: A withdrawal allowlist (also called a whitelist) tells your exchange to send crypto only to addresses you saved in advance. If someone steals your password and 2FA, they still cannot withdraw to their own address without adding it first, and a new-address lock delays that new address. Turn it on, add only addresses you copied from the receiving wallet, and still test each new address with a small amount.
What an allowlist is, in plain words
When you withdraw from an exchange, you type or paste a destination address - the public account number of the receiving wallet or platform. Without an allowlist, anyone who gets into your account can paste their address. With an allowlist switched on, the withdrawal form only accepts addresses on your saved list.
Two related settings make it stronger:
- New-address lock - a waiting period before a newly added address can receive withdrawals. Binance calls this the "whitelist withdrawal limit"; OKX calls it the "New address withdrawal lock" (checked 2026-11-01).
- Anti-phishing code - a word you choose that appears in genuine exchange emails, so you can spot fake "address added" messages (see account security setup).
How it works on two exchanges
Per Binance's help centre (checked 2026-11-01): when the withdrawal whitelist is on, "you can only withdraw to addresses on your whitelist". You enable it under Settings > Withdrawal and confirm with a passkey or 2FA, and you can save up to 200 addresses. Changing the whitelist may trigger a temporary withdrawal suspension of 24, 48 or 72 hours. The whitelist withdrawal limit suspends withdrawals to newly added addresses for a period you select, and Binance recommends keeping it on. A separate "one-step withdrawal" option lets small amounts go to whitelisted addresses without 2FA; a beginner can leave this off.
Per OKX's help centre (checked 2026-11-01): Allowlist limits withdrawals to recipients in your address book, so you cannot type a new address during a withdrawal. The optional New address withdrawal lock blocks newly added recipients for 24 hours. Turning either on or off needs security verification.
Example: an attacker phishes your password and a 2FA code. They try to withdraw to their wallet and are blocked because it is not on the list. They add it, which sends an email to you and starts the lock. That delay is your window to freeze the account through the official app; see safe unfreeze steps.
Which protections stop what
| Protection | Stops | Does not stop |
|---|---|---|
| Allowlist on | Withdrawals to an address not on your list | An attacker who can add addresses and wait out the lock |
| New-address lock | Instant use of an address just added | Withdrawals to addresses already on the list |
| Anti-phishing code | Fake emails that copy the exchange's style | You clicking a link without checking the code |
| Small test withdrawal | Losing the full amount to a wrong network or missing memo | A wrong address you saved yourself |
| Authenticator or passkey 2FA | Logins with a stolen password alone | Approving a request on a phishing site in real time |
No single setting covers everything; they work as layers. Our security checklist shows the full stack.
Step by step: set up your allowlist
- Secure the login first: unique password, authenticator app or passkey, anti-phishing code.
- Open the receiving wallet or platform and copy its deposit address there. For exchanges, pick the asset and the network (for example ERC-20 or TRC-20) and note any memo/tag, an extra ID some networks need.
- In the exchange, go to the address book (Binance: Address Management; OKX: Withdraw > Address book), paste the address, choose the same asset and network, add the memo, give it a clear label, and tick "add to whitelist" or allowlist.
- Check the first six and last six characters against the source. Clipboard malware can swap addresses.
- Turn on the allowlist and the new-address lock, and complete the verification.
- When the lock ends, send a small amount above the deposit minimum, confirm it with the TxID in a block explorer, then send the rest. Our first deposit and withdrawal test walks through it.
Common mistakes and risks
- Copying from chats or search ads. Fake "support" often sends an address to "verify" your account. Never add an address someone sent you; see fake support and phishing.
- Wrong network on a correct-looking address. Many networks use addresses that look alike. The allowlist does not prove the network or memo is right; the test withdrawal does.
- Switching the lock off for convenience. The delay is the point; it buys time if your account is taken over.
- Never pruning the list. Old exchange deposit addresses can change. Delete addresses you no longer use.
- Forgetting network fees. Each test costs a withdrawal fee; compare networks in our withdrawal fee guide.
FAQ
Will an allowlist stop every hack?
No. It blocks unknown destinations, but an attacker who controls your email and 2FA could add an address and wait out the lock. It buys time; it does not replace strong login security.
Why are my withdrawals paused after I added an address?
Exchanges may pause withdrawals after whitelist changes; Binance lists 24, 48 or 72 hours (checked 2026-11-01). Add addresses before you need them.
Do I still need a test withdrawal to a whitelisted address?
Yes, at least the first time. The allowlist checks the address is on your list, not that the network and memo match the receiver.
Can I whitelist an address for all coins?
Binance offers a "universal address" option, but a per-asset, per-network entry is easier to check.
Bottom line
Turn on the allowlist and the new-address lock, add only addresses you copied from the receiving wallet with the right network and memo, label them, and test each one small. Then review the list every few months. Next, compare total transfer costs with the fee comparison tool.
Education only, not investment advice. Rules checked 2026-11-01.
