Withdrawal Whitelist at the Crypto Exchange: How to Lock the Withdrawal Path Against Foreign Addresses

If someone has your password and your second factor, only one question still decides whether your balance leaves the exchange: is the attacker's destination address already in your account, or do they have to enter it first? This is exactly where the withdrawal whitelist comes in. It is a list of approved destination addresses, and while it is active, withdrawals go solely to addresses on that list. Everything else is refused, even with the correct password. September 2026 has made this question very practical. On September 7, Bloomberg reported the outflow of around $320 million from a Liquid Network wallet, in which, according to the operator, roughly 4,000 of 4,200 bitcoin were moved. TRM Labs puts the damage from the wave of attacks on Coldcard devices at $116 million. Neither case was an account takeover at an exchange, but both have the same effect on reader behaviour: many are shifting balances between exchanges and their own wallets these days, and every one of those movements runs through precisely the withdrawal path at issue here. Withdrawal whitelist: what the function blocks and what it leaves open Definition in one sentence: a withdrawal whitelist is an address book in the exchange account that permits withdrawals only to recipient addresses approved beforehand. The protection works against two very different attacks. The first is account takeover: anyone who can log in can, without a whitelist, immediately enter an address of their own and withdraw. The second is the swapped address, for instance through malware that replaces the contents of the clipboard, or through a prepared address taken from the transaction history. How this second trick works and how to spot a slipped-in address is set out at length in our article on checking recipient addresses. The whitelist leaves open everything that happens within the approved addresses. Anyone who gets you to enter and approve their address yourself bypasses the protection entirely. That is the usual course of support fraud over the phone, and it is the reason a whitelist is a barrier against strangers and not against deception. Why two-factor sign-in does not secure the withdrawal Two-factor sign-in and a withdrawal whitelist solve different problems. The second factor decides who gets in. The whitelist decides where something goes out. If the second factor falls, for example because it runs by SMS and the phone number has been taken over, the withdrawal path is open immediately without a whitelist. Why SMS is the weakest variant here, we took apart in our overview of two-factor methods at crypto exchanges. The German Federal Office for Information Security recommends two-factor authentication as basic protection for accounts involving money. That recommendation remains correct. But it describes only the front door.