Security Settings

How to Enable the Withdrawal Whitelist? Keep Your Assets Safe Even If Your Password Is Leaked

FoxPress Editorial · 2026-04-22 · 13 min read

A Withdrawal Whitelist ensures that funds can only be sent to pre-approved addresses that you trust. For beginners, this is a must-enable feature. Navigate to the Binance Official Website → Wallet → Withdraw → Address Management. The same feature is available on the Binance Official App. For region switching, refer to the Binance App Download guide. Here are the steps.

In a Nutshell

Withdrawal Whitelist = You save a list of "Trusted Addresses." The system will only allow withdrawals to these specific addresses, rejecting or delaying any attempts to send funds elsewhere.

Why You Need It

Most beginners only use 2FA and an Anti-Phishing Code:

Password + 2FA + Anti-Phishing Code create three strong layers of defense.
However, in the unlikely event that all three are bypassed (theoretically possible), a hacker can withdraw your entire balance.

Adding a Whitelist changes the game:

Even if a hacker gains full access to your account, they can only withdraw to your whitelisted addresses.
Your whitelist consists of your own private wallets.
The hacker cannot withdraw to their own wallet.

How to Set It Up

Step 1: Access Address Management

Go to Wallet → Withdraw → Address Management (sometimes labeled as "Whitelist").

Step 2: Add a New Address

Click the "+" or "Add Address" button:

Label: Give it a custom name (e.g., "My imToken Wallet").
Select Coin: Choose the cryptocurrency (e.g., USDT).
Select Network: Choose the correct network (e.g., TRC20).
Address: Paste the destination address.
Verification: Confirm via Email + 2FA.

Step 3: Enable Whitelist Restriction Mode

Look for the setting "Whitelist Restriction" or "Withdrawal Whitelist Only":

Toggle it ON.
Complete the email verification.
Finished.

From now on:

Withdrawals to whitelisted addresses: Processed immediately (subject to normal review).
Withdrawals to non-whitelisted addresses: Either rejected or subject to a 24-hour lock.

The 24-Hour Lock Rule

If you don't use the "Restriction Mode," adding a new address typically works like this:

Withdrawals are not outright rejected.
But there is a 24-hour delay before you can withdraw to a newly added address.
This gives you a critical window to cancel the transaction.

The 24-hour delay is your safety net:

If a hacker initiates a withdrawal, you have 24 hours to notice the alert, cancel it, and change your security settings.

Which Addresses Should Beginners Add?

Recommended whitelist entries for beginners:

Your own hardware or mobile wallet (e.g., imToken, MetaMask).
A secondary backup wallet.
Your account on another trusted exchange (e.g., OKX).
Frequently used addresses for trusted friends or family.

Try to keep your list between 5–10 addresses. Fewer, high-quality entries are safer.

Removing an Address

To remove an address you no longer use:

Go to Address Management.
Find the address and select "Delete."
Verify via Email / 2FA.

Once deleted, you can no longer withdraw to that address without re-adding it and waiting through the security period.

Managing Multiple Networks

Cryptocurrencies like USDT exist on multiple chains:

TRC20 USDT Address.
BEP20 USDT Address.
ERC20 USDT Address.

You must add a separate whitelist entry for each network and each coin.

Modifying an Address

Addresses cannot be edited directly. To update one:

Delete the old address.
Add the new address as a fresh entry.
This requires full 2FA and email verification for each change.

The "Security Trio": Whitelist + 2FA + Anti-Phishing

A beginner can set up all three in about 12 minutes:

2FA: 5 minutes.
Anti-Phishing Code: 2 minutes.
Whitelist: 5 minutes.

This results in a Security Level → Extremely High.

Recommended Setup Order for Beginners

Order	Action
1	Set a Strong Password
2	Enable 2FA
3	Back up 2FA Keys
4	Set an Anti-Phishing Code
5	Add Whitelist Addresses
6	Enable Whitelist Restriction Mode

Can Hackers "Bypass" the Whitelist?

Hackers might try to:

Change your whitelist (Requires 2FA + Email — very difficult).
Change your email and then the whitelist (Even harder).
Sell assets via P2P (Which has its own restrictions).

Binance applies multi-factor authentication and a 24-hour observation period to these settings, making bypassing them extremely difficult in practice.

P2P is Separate from the Whitelist

Please note:

The whitelist applies to on-chain withdrawals.
P2P (selling crypto for fiat) is handled differently.

You cannot rely solely on the whitelist for P2P security; both areas require vigilance.

Whitelist Maintenance

Every few months:

Review your whitelisted addresses.
Delete those you no longer use.
Add any new ones you need.
Keep the list concise.

Too many addresses can lead to a false sense of security or accidental mistakes.

Extreme Scenarios to Consider

Scenario 1: Your Private Wallet is Compromised

A hacker steals access to your mobile wallet.
Since that wallet is on your Binance whitelist, the hacker can trick you into withdrawing funds to it.
Once the funds arrive, the hacker takes them.
Wallet security is just as important as exchange security.

Scenario 2: You Lose Access to Your Whitelisted Wallet

If you have only one whitelisted address and you lose the keys to that wallet:
You won't be able to withdraw funds immediately.
You must add a new address and wait for the 24-hour delay / re-verification.
Always keep at least two trusted addresses available to avoid locking yourself out.

FAQ

Q: Is there a limit to how many addresses I can whitelist?
A: Usually, there is no hard limit, but it's best to keep the list manageable.

Q: Can multiple accounts share a whitelist?
A: No. Each account has its own independent address management.

Q: Can I whitelist someone else's address?
A: Yes, but it is recommended to only whitelist your own wallets to minimize risk.

Q: Why did my withdrawal to a whitelisted address fail?
A: Common reasons include network congestion, using the wrong chain, or additional risk control reviews.