November 04, 2026

Withdrawal whitelist: 5 steps that make a stolen password useless for draining your account

After the Binance hack and the phishing wave that followed, the main risk for an ordinary user is not the exchange but their own account. Steal the password and the SMS code, and the crypto leaves for someone else's address within a minute. A whitelist closes that door: withdrawals go only to addresses you added yourself in advance.

STEP BY STEP (Binance, web version; screenshots attached)

• Profile → Settings.
• Withdrawal section → Enable next to Withdrawal Whitelist.
• Confirm Enable and pass 2FA or a passkey.
• Address Management → Add address: label, coin, address, network. Tick Add Address to Whitelist. Never type the address by hand — copy it from your own wallet and compare the first and last 6 characters.
• Turn on Whitelist Withdrawal Limit: withdrawals to a newly added address are blocked for 24, 48 or 72 hours. If someone takes over the account and adds their own address, you get time to notice and lock the account.

IMPORTANT

• The whitelist limits withdrawals to external addresses. According to Binance support, it does not cover internal transfers by Binance ID or email — so 2FA and passkeys are still a must.
• With the limit on, disabling the whitelist also pauses withdrawals for the chosen period.
• Other major exchanges have a similar feature — look for "withdrawal address whitelist" in security settings.

Before you whitelist an address, check it for free: https://t.me/amlconsensus_bot?start=en