A withdrawal address whitelist is an account security setting that allows withdrawals only to addresses you have added and confirmed in advance. Adding a new address usually requires extra confirmation — an email, a two-factor code or a waiting period, for example 24 hours. Many exchanges and some crypto casinos offer it.
Why it protects you
If an attacker gets hold of your casino or exchange account password, their aim is to send the money quickly to their own address. With a whitelist they cannot do that without adding a new address, and adding a new address triggers a confirmation they may not pass and a waiting period during which you notice the alarm. The same protects against address poisoning and copying mistakes: a withdrawal goes only to an address on the list.
How to set it up
- Add to the list only addresses you check from your own wallet, not from a chat or transaction history.
- Give each address a clear name: "My non-custodial USDT TRC-20", "Exchange BTC".
- Check that the network is right — the same address on a different network is a different entry. See wallet address.
- Turn on two-factor authentication with an authenticator app so that changing the list requires it.
Limitations
- It does not protect against the casino itself. If the casino refuses a withdrawal, no list helps.
- It does not protect against the wallet itself leaking. If a wallet on the list is hacked, the money still goes there.
- It can slow things down. The waiting period for a new address is meant for security, but a quick withdrawal to a new place can be delayed by it.
If the casino does not have one
Many crypto casinos have no whitelist setting. Then the best substitute is to keep a small balance at the casino, use a strong unique password and 2FA, and withdraw winnings quickly to your own non-custodial wallet. On the exchange where the money ends up, the whitelist is definitely worth turning on. Checklist: crypto casino security checklist.