Turning On Withdrawal Allowlists and What They Block

An allowlist means the exchange will only send to addresses you registered earlier. It is the single most effective account control available.

What it blocks

Someone who gains access to your account cannot withdraw to their own address. They would first have to add it, which triggers the delay below.

It does not block trading, so an attacker can still cause damage. It blocks the exit, which is where the loss happens.

Step 1: find the setting

Usually under security or withdrawal settings, sometimes called address whitelisting or trusted addresses. Some venues enable it by default and many do not.

Step 2: add the addresses you actually use

Your own wallet, and any venue you regularly send to. Label each one clearly.

Add them while you are calm. Adding an address under time pressure is how people bypass their own controls.

Step 3: turn on the waiting period

Most implementations impose a delay, commonly twenty four to forty eight hours, before a newly added address can be used.

This is the part that does the work. The delay gives you time to notice an unauthorised addition while the funds are still there.

Step 4: enable the notification

A message on every address addition, to an address or number the attacker does not control.

The delay only helps if you learn about the change during it.

Step 5: test it

Add an address, wait for the delay, send the minimum, confirm it arrives. Then try sending to a non-listed address and confirm it is refused.

The second half of that test is the one people skip, and it is the one that proves the control works.

What it does not cover

An attacker who also controls your email and can disable the setting. Account recovery flows that bypass it. And anything that happens inside the account short of a withdrawal.

The trade

Slower withdrawals to new destinations. For most people that is a cost measured in minutes per year.

A venue that confirms the address before sending and enforces a delay on new entries is doing exactly the right thing when it slows you down. A platform with a withdrawal checklist of its own usually has this and the notification wired together, and Collect & Exchange publishes what its controls actually are rather than leaving you to find them in settings.