Withdrawal whitelist: new addresses now unlock in 6 hours

From today, a withdrawal address you add to your SpotEx address book can receive withdrawals 6 hours after you save it. Until now, the wait was 24 hours.

If you saved an address in the last day, you don't have to sit out the old 24 hours either. Every address that was still waiting now follows the new rule, so most of them are ready to use right now.

This post explains what the withdrawal whitelist is, why the waiting period exists, why we shortened it, and where we plan to take it next.

What changed

Nothing else about withdrawals has changed. Your saved addresses, labels and limits stay exactly as they were.

What is a withdrawal address whitelist?

A withdrawal address whitelist is a list of addresses you have approved in advance. On SpotEx it lives in your address book, and you may also see it called the address allowlist. Withdrawals can only go to an address on that list.

Adding an address to the list takes three things:

1. Your email. We send a 6-digit code to the email address on your account.
2. Your authenticator app. You enter the current 6-digit code from your two-factor authentication (2FA) app.
3. Time. The new address waits 6 hours before it can receive a withdrawal.

Before the address is saved, SpotEx also checks it with the coin's own network. A typo, an address for a different coin, or an address on the wrong network is caught on the spot, before anything is saved.

Why there is a waiting period at all

The waiting period protects you in the worst case: someone else gets into your account.

Picture it. A scammer steals your password and, somehow, your 2FA codes too, perhaps through a fake login page or malware on your computer. Without a waiting period, they could add their own address and empty your account within minutes, before you even notice.

With the whitelist, that plan stops at the first step:

• You hear about it straight away. Every new withdrawal address triggers a "Withdrawal address added" notice, by email and in the app.
• You have time to act. The address can't receive anything for 6 hours. In that time you can remove it, change your password, or freeze your account from the Security page. A frozen account can't withdraw.
• Nobody can skip the wait. Not you, not an attacker, and not our support team. That is the point: a rule that can be talked around is not a protection.

Many large exchanges use the same idea, often called a whitelist lock or new-address lock, for the same reason.

Why 6 hours instead of 24

The 24-hour lock was a deliberate early choice, made while SpotEx was new and our other withdrawal protections were still young. It did its job. It also had a cost: if you wanted to withdraw to a wallet you hadn't used with us before, you had to wait a full day.

Since then, we have added several layers of protection that look at every withdrawal, not just at the address:

• Address checks with the network itself. Every destination is checked by the coin's own node or provider before any funds are reserved.
• Risk checks on every withdrawal. Unusual patterns, such as money moving in and straight back out, or links between accounts, send a withdrawal to a person for review instead of straight out.
• Human review for larger withdrawals. Above a certain value, a member of our team looks at a withdrawal before it is sent.
• Daily limits. Every account has a 24-hour withdrawal limit, shown on the Withdraw page.
• An exchange-wide circuit breaker. If withdrawals across the whole exchange suddenly spike, payouts stop automatically until our team has checked them.

With these in place, 6 hours still gives you a real window to notice an address you didn't add and to act on it, while making the wait far less painful when the address really is yours.

How to add a withdrawal address

1. Open your address book under Wallets.
2. Choose Add address, then pick the coin and the network.
3. Paste the address from the wallet you are sending to, and give it a label you will recognise, such as "My Ledger" or "Exchange DOGE".
4. Enter the code from your email and the code from your authenticator app.
5. Wait 6 hours. The address book shows the exact time the address unlocks, and you can withdraw to it from then on.

Tip: if you know you will want to withdraw to a new wallet soon, add the address now. By the time you need it, it will be ready.

Coming later: withdrawals without a waiting period

Our long-term goal is to remove the whitelist requirement altogether. You would be able to paste any address into the withdraw form and withdraw straight away, with no waiting period for new addresses.

We will only do that once we are fully confident that the protections described above are stable and proven, and strong enough to stop a stolen account on their own, without the waiting period as a safety net. Before that happens:

• the risk checks need to have run on enough real withdrawals, for long enough, that we trust them completely;
• account security around sign-in, 2FA and account recovery needs to be as strong as we want it to be;
• we need to be able to spot and stop a suspicious withdrawal quickly, at any hour.

There is no date yet, and we won't rush it. On SpotEx, security comes before convenience, and a few hours of waiting is a small price for keeping your funds safe in the meantime. When we are ready, we will announce it here first, well before anything changes. We expect to keep the address book even then, as a quick way to save and label the addresses you use most.

Keep your withdrawals safe

Whatever the waiting period, a few habits protect you the most:

• Keep your authenticator app safe. It is needed to add a withdrawal address, so keep it on a phone only you use.
• Check the address before you save it. Compare the first and last few characters with your wallet. Some malware swaps an address you copy for its own.
• Match the network. Send each coin on the network your receiving wallet expects. The address book and the withdraw form show the network for every address.
• Send a small test first when you withdraw to a new wallet for the first time.
• Never share your codes. SpotEx staff will never ask for your password, email codes or authenticator codes.
• Act fast on a notice you don't recognise. If you get a "Withdrawal address added" email you didn't expect, remove the address, change your password and freeze your account from the Security page. Then contact support.

Frequently asked questions

How long do I have to wait before I can withdraw to a new address?

6 hours from the moment you save it in your address book. The address book shows the exact time it unlocks.

I saved an address yesterday. Do I still wait 24 hours?

No. Every address that was still waiting now follows the new rule: it unlocks 6 hours after you saved it. If that time has already passed, the address is ready now.

Do I have to wait again for addresses I already use?

No. Once an address has unlocked, it stays ready. The waiting period only applies to newly saved addresses.

Can support unlock an address early?

No. The waiting period applies to everyone, and nobody can shorten it for a single address. That is what makes it a real protection.

Can I withdraw to an address that isn't in my address book?

Not yet. For now, every withdrawal goes to a saved address. Removing that requirement is the long-term goal described above, once our other protections are ready to take over.

What should I do if I get a notice about an address I didn't add?

Treat it as urgent. Remove the address from your address book, change your password, and freeze your account from the Security page. Then open a support ticket so we can help you secure it.

Questions about withdrawals or the address book? Open a support ticket. We read every one.