The withdrawal whitelist is a security feature on Binance. Once enabled, you can only withdraw to pre-approved addresses. Even if a hacker gets your password and verification codes, they can't send your funds to their own address.
How Does the Whitelist Work?
Simply put:
- You add a few trusted addresses to the whitelist (e.g., your MetaMask, hardware wallet, etc.)
- Enable the whitelist feature
- From then on, withdrawals can only go to these addresses
- Any withdrawal to an address not on the whitelist is rejected
If you don't have a Binance account yet, register on Binance first — enabling the whitelist early is recommended.
How to Enable
- Open the Binance app → Profile → Security
- Find "Withdrawal Address Management" or "Whitelist"
- Tap to enable
- Complete security verification (email + phone + Google Authenticator)
- Add your trusted withdrawal addresses
- Whitelist is now active
Adding Whitelist Addresses
When adding an address, you need to provide:
- Currency
- Address
- Network (e.g., ERC20, TRC20, BEP20)
- Label (a name for your own reference)
Newly added addresses have a 24-hour cooling period. This means an address added today can't be used until tomorrow. This design gives you reaction time — if a hacker added an address, you have 24 hours to detect and respond.
Is It Worth Enabling?
Situations where you should enable it:
- You hold significant assets on Binance: The more assets, the more important security is
- You rarely withdraw to new addresses: If you always withdraw to the same few wallets, the whitelist won't affect your workflow
- You're concerned about account security: An extra layer of protection, extra peace of mind
Situations where it may be inconvenient:
- You frequently withdraw to different addresses: Every new address requires adding to the whitelist and waiting 24 hours
- You need emergency withdrawals: The 24-hour cooling period is problematic for urgent new-address withdrawals
- You frequently participate in DeFi: Managing the whitelist gets tedious when constantly depositing to different contract addresses
The Security Principle Behind Whitelists
Imagine the worst case: a hacker obtains your password, email access, phone verification, and even your Google Authenticator.
Without whitelist: The hacker can immediately withdraw all your assets to their own address.
With whitelist: To withdraw, the hacker must first add their address to the whitelist, then wait 24 hours. During those 24 hours, you have the opportunity to:
- Receive a "whitelist address change" notification
- Discover unusual login activity
- Freeze the account
- Change your password
This 24-hour buffer is the whitelist's core value.
Managing Whitelist Addresses
After adding, you can:
- View all whitelisted addresses
- Delete addresses no longer needed
- Edit labels
Periodically review your whitelist and remove unused addresses. Fewer addresses means lower risk of exploitation.
FAQ
Q: Does the whitelist affect C2C trading? No. The whitelist only restricts on-chain withdrawals (sending to external wallet addresses). It doesn't affect C2C, internal transfers, or other operations.
Q: Can you disable the whitelist anytime? Yes, but disabling also requires security verification. Once disabled, you can withdraw to any address.
Q: Does adding whitelist addresses cost anything? No. Adding, editing, and deleting whitelist addresses are all free.
Q: Is the whitelist chain-specific? Yes. The same address used on different chains (e.g., the same 0x address on ERC20 and BEP20) needs to be added separately for each.
My Recommendation
For the vast majority of users, enabling the whitelist is worthwhile. The 24-hour inconvenience is far outweighed by the risk of asset theft. You can pre-add all your commonly used withdrawal addresses, and daily usage will feel virtually unchanged.
The only thing to keep in mind: when you need to withdraw to a new address, plan 24 hours ahead. Build the habit of adding addresses in advance.