Americans reported $9.3 billion in crypto-related losses to the FBI in 2024, across nearly 150,000 complaints, according to TRM Labs’ summary of the 2024 IC3 report. Much of that money left accounts through an ordinary withdrawal to an address the owner had never seen. Crypto address whitelisting, also called an allowlist or address book lock, is the exchange setting that blocks exactly that move: once it is on, coins can only be withdrawn to addresses you approved in advance, and some exchanges make newly added addresses wait days before they work. This guide is written for US users and uses the help pages of US-facing exchanges, checked in October 2026.
Time Delays on New Addresses Matter More Than the List
- A whitelist limits withdrawals to addresses you saved and approved earlier, so a thief who gets into the account cannot simply send coins to a fresh wallet.
- The time delay matters more than the list. Gemini’s Withdrawal Protection holds new addresses for 7 days, and switching the feature off triggers a further 7-day hold.
- Kraken confirms new addresses by an emailed link that stays valid for one hour, which protects you only as long as your email is safe.
- Binance.US lets you turn on whitelist-only withdrawals from its website; the setting is not available in the mobile app.
- A whitelist cannot fix a wrong address you approved yourself, so check every new entry with a small test transaction.
What Is Crypto Address Whitelisting?
Every crypto withdrawal goes to a public address, a long string that identifies a wallet on a particular blockchain. On a normal account, anyone who controls your login can paste in any address and press send. Whitelisting changes the default. You build a list of trusted destinations, typically your own hardware wallet, a second exchange account or a business partner, and the exchange refuses to send funds anywhere else.
Binance.US puts the logic plainly in its help article: the feature prevents withdrawals to any address you have not already designated as your own. Each saved address is tied to one asset, and on most platforms to one network, so a Bitcoin address saved for BTC will not accept USDC.
The term also turns up in token sales, where a project “whitelists” wallets allowed to buy early. That is a different thing. This article covers only withdrawal controls on custodial exchanges.
Why a Waiting Period Does the Real Work
A list on its own has a weakness. If an attacker is inside your account, they can try to add their own address to it. What stops them is friction at the moment of adding: a confirmation step sent to another channel, an approval from a second person, or a hold that keeps the new address unusable long enough for you to notice.
Gemini built its version around time. Its Withdrawal Protection page says the setting imposes a 7-day waiting period on newly added addresses. Turning the protection off after enabling it brings another 7-day hold before the change takes effect, which closes the obvious loophole of disabling the lock first. Addresses already saved before you switched it on keep working immediately.
How Major US Exchanges Handle It
| Exchange | Feature name | How a new address is approved | Delay or hold |
|---|---|---|---|
| Gemini | Address Book plus Withdrawal Protection | Added under Settings; on multi-user accounts a second administrator or manager must approve | 7 days for new addresses when protection is on; 7 days to switch protection off |
| Kraken | Withdrawal addresses | Approved automatically on a trusted device, otherwise by an emailed link valid for one hour | 12-hour hold on new addresses after a password change if sign-in 2FA or a Master Key is not set |
| Binance.US | Address Management, Whitelist On | Saved address is starred to approve it; whitelist toggle on the website only | None stated in the help article |
| Coinbase Prime (institutional) | Address book | Each entry needs consensus approval in the Prime interface | None stated; withdrawals themselves need consensus approval by default |
Sources: Gemini Address Book, Kraken support, Binance.US help center and Coinbase Prime documentation, as of October 2026. Gemini notes its article does not apply to customers in the EU, EEA or UK, who have a separate approved-addresses process.
Kraken’s Extra Switches
Kraken’s email for a new address carries a link to lock the account, meant for the moment you see a request you did not make. The exchange also offers a Global Settings Lock that, when enabled, stops anyone adding withdrawal addresses at all. Pairing that lock with a short list of saved destinations gets close to a hard whitelist.
Business and Team Accounts
Companies holding crypto on an exchange get a second layer: separation of duties. On Gemini multi-user accounts, only administrators or managers can add addresses, and a second one must approve before the 7-day hold starts. Coinbase Prime switches its address book on by default and, per its documentation, requires consensus approval for withdrawals unless a client changes that for automated flows. For a finance team, that means one compromised employee login is not enough to move money.
How to Set Up a Withdrawal Whitelist
Menus differ, but the sequence below works on any exchange that offers the feature.
- Secure the account first: switch on app-based two-factor authentication for sign-in and withdrawals, and make sure the email tied to the exchange has its own strong 2FA. On Kraken, that also removes the 12-hour hold that follows a password change.
- Collect your real destinations: copy each receiving address from your own wallet app or hardware device. Never retype it, and never copy it from an old transaction history.
- Add and label each address: pick the correct asset and network, and use labels you will recognize, such as “Ledger BTC” or “Treasury USDC on Ethereum”.
- Switch on the lock: on Binance.US, flip Address Management to Whitelist On and star each approved entry. On Gemini, enable Withdrawal Protection under Settings, Address Book.
- Send a test amount: withdraw a small sum to each new address and confirm it arrives before moving anything large.
Worked Example: How Much Time a Hold Buys You
Suppose a phishing page captures your exchange password and your email password at 9 p.m. on a Friday. The attacker adds a new address at 9:05 p.m. The numbers below show when that address could first receive your coins under each setup, using the timings in each exchange’s help pages.
| Setup | Earliest withdrawal to the new address | Window for you to react |
|---|---|---|
| No whitelist, no confirmation | 9:05 p.m. Friday | None |
| Email link confirmation only (email also compromised) | Within the hour the link is valid | Under 1 hour |
| Gemini-style 7-day hold on new addresses | 9:05 p.m. the following Friday | 168 hours |
| Attacker tries to switch the 7-day protection off | Protection lifts 7 days later, then the address hold still applies | At least 168 hours |
Someone who checks their account or inbox once every three days would get at least two chances (168 ÷ 72 = 2.3) to spot the change and lock the account inside a 7-day window. With email confirmation alone, a stolen inbox leaves no window at all. That gap is the practical case for choosing a time-based hold where it is offered.
What Whitelisting Will Not Protect You From
- A wrong address you approved: if clipboard malware or a look-alike “poisoned” address in your history swaps the string when you save it, the whitelist faithfully protects the attacker’s address. Check the first and last several characters and some in the middle against your wallet.
- Scams where you send the money: investment fraud, the largest crypto category in the 2024 IC3 data at $5.8 billion according to TRM Labs’ summary, usually persuades victims to approve the destination themselves.
- Self-custody wallets: a MetaMask or hardware wallet has no exchange-side allowlist. Protection there comes from guarding the seed phrase and checking each transaction on the device screen.
- Exchange failure: a whitelist controls where coins can go, not whether the exchange stays solvent. Reserve risk is a separate question, much like the one we cover in our explainer on what happens when a stablecoin depegs.
Is the Inconvenience Worth It?
For most people who keep coins on an exchange, yes. The cost is planning: a new destination needs to be saved days before you need it, and a business paying a new vendor in stablecoins has to build that lag into its payment calendar. Active traders who move funds between many venues will find a 7-day hold awkward, and some exchanges let you keep frequently used addresses saved before turning the protection on, since Gemini says those remain usable immediately.
Indian readers dealing with exchange withdrawals face a separate compliance layer; our guide to Form 141 and the 1% crypto TDS covers that side. For more explainers, see the Crypto section and our Finance coverage.
This article is for information and education only and is not investment, tax or financial advice. Figures were checked on 29 October 2026; confirm current details with the official source or a registered adviser before acting.
Can a Hacker Undo a Whitelist or Beat Address Poisoning?
What Does Whitelisting a Crypto Address Mean?
It means saving an address as an approved withdrawal destination. With whitelist-only mode on, the exchange will refuse withdrawals to any address that is not on that list.
How Long Does It Take to Whitelist an Address?
It depends on the exchange. On Gemini with Withdrawal Protection on, a new address waits 7 days. On Kraken, an address added from a trusted device is approved at once, otherwise through an email link valid for one hour.
Can a Hacker Remove My Whitelist?
Someone with full account access may try. Gemini adds a 7-day hold before disabling Withdrawal Protection takes effect, and Kraken’s Global Settings Lock blocks new addresses being added, which gives you time to react.
Can I Whitelist Addresses in the Binance.US App?
No. Binance.US says whitelist features are available in a web browser, under Security and then Address Management, and not in the mobile app.
Does Whitelisting Stop Address Poisoning?
Only if you never save the fake address. Once a poisoned address is approved, the whitelist treats it as trusted, so verify each new entry against your own wallet and send a small test first.
