Address Book Whitelist

Overview

An address book whitelist, also called a withdrawal allowlist, limits where funds can be sent. Instead of permitting any syntactically valid destination, the wallet or platform checks the requested address and network against an approved list.

The control reduces the impact of credential theft, session hijacking, malware, and operator mistakes. An attacker who gains access to an account may still be unable to withdraw funds to a new address. Effective implementations protect the process of adding or editing an address more strongly than ordinary login, using measures such as two-factor authentication, out-of-band confirmation, multi-person approval, or a time delay.

A whitelist is not a complete security solution. An approved address can itself be compromised, entered on the wrong network, or belong to a service that changes deposit requirements. The list also needs clear ownership, review, revocation, and audit procedures. Broadly approving an intermediary or omnibus address can weaken the intended restriction.

For organizations, allowlisting works best when combined with role separation, transaction limits, destination labels, change notifications, and periodic review. The objective is to make unauthorized destination changes visible and difficult, not merely to store a static list.

A strong implementation treats whitelist management as a separate security workflow. New entries may require two-factor authentication, confirmation through another channel, multiple approvers, or a cooling-off period. These controls prevent an attacker who steals a session from immediately adding a destination and withdrawing funds.

The policy must also cover changes outside the platform. A previously approved exchange deposit address can become outdated, and a required memo or destination tag can change. Organizations should periodically review the list, remove unused entries, and document who owns each destination. Whitelisting reduces destination risk, but it does not verify the recipient’s legal identity or guarantee that the approved wallet remains secure.