What is Withdrawal Whitelist?

A withdrawal whitelist restricts payouts to a set of addresses you have approved in advance. With it switched on, a withdrawal can only be sent to an address on the list, and adding a new one normally triggers a waiting period before it can be used. The delay is the whole point, and it is worth understanding rather than resenting. An attacker who reaches your account can change a payout address in seconds; what they cannot do is wait. A hold measured in hours gives the real owner time to see the notification, get back in and cancel the change before anything moves. Without a whitelist, account access and stolen funds are the same event. Crypto is where this matters most, because a confirmed on-chain transaction cannot be reversed by anyone. There is no acquirer to raise a dispute with and no chargeback route; once a withdrawal is confirmed, the question is only who has the coins. The same feature appears in some fiat cashiers as a locked bank account or a fixed payout method, and the reasoning behind it is identical. Two things to check before relying on one. Whether adding an address requires the second factor as well as the password, because a whitelist protected only by the thing an attacker already has is decoration. And whether the delay applies to additions only or also to the first address added — some implementations exempt setup, which is exactly the moment an attacker would choose.