Withdrawal whitelist — also called "withdrawal address book" or "address allowlist" — is the exchange feature that restricts outbound transfers to a pre-approved set of destination addresses, with a mandatory waiting period before new addresses can be used. One of the cheapest, most effective settings you can turn on at a centralized exchange, and one that's easy to put off.
The mechanism
Enabled at the account level. Once turned on:
You define a list of approved withdrawal addresses (your hardware wallet, your other exchange accounts, family member wallets). Each entry typically requires email and 2FA confirmation when added.
Withdrawals to any address not on the list either fail outright or trigger a waiting period (its length depends on the exchange) plus an explicit confirmation flow.
Modifications to the list — adding a new address, removing an existing one — also trigger waiting periods and multi-factor confirmation. The list itself becomes a protected resource.
What this defends against
The threat model is straightforward: an attacker who has compromised your exchange account credentials but lacks physical access to your devices. Without whitelist, the attacker logs in, generates a withdrawal to their own address, exits the account. With whitelist, the attacker can attempt to withdraw — but only to your pre-approved addresses (useless for them) — and at exchanges that impose a waiting period on new addresses, an attempt to change the list triggers that delay, giving you time to see the notification and revoke access.
That is why it matters against the most common account takeovers. Phishing pages and fake-support calls hand an attacker your login, not your devices; with a whitelist and a waiting period in place, the stolen login has nowhere useful to send the funds.
How to set it up at the major US exchanges
Coinbase: the feature is called Address Book (address allowlisting). Look for it in your account's security settings, turn it on, then add your hardware wallet address. The current menu path, and whether a newly added address is held for a while before use, are in Coinbase's help center.
Kraken: look for the withdrawal address settings in your account's security options and save your hardware wallet address there. How new addresses are confirmed and whether they can be locked for a set period are explained in Kraken's support center; check the current steps there.
Other exchanges put the same control under names like "withdrawal whitelist" or "approved addresses." The exact menu path and waiting period are in each exchange's help center, and they change, so check there before you rely on them.
The friction trade-off
Whitelist adds a waiting period the first time you withdraw to a new address. For a US-resident holder withdrawing primarily to a known hardware wallet, this friction is invisible after the initial setup. For a holder who frequently changes destination addresses (DeFi yield farming across many wallets), the friction is real but mitigated by adding all the addresses up front.
The failure mode to guard against: you get impatient, disable the whitelist temporarily to make a fast withdrawal, and forget to re-enable it. Discipline rule: never disable whitelist; if you need to add a new address, take the waiting period.
Further reading: CEX, Exchange evaluation handbook.