Most people do not buy ETH or USDC directly into a self custody wallet. They buy it on an exchange, then send it out to an address they control, often on Base. That outbound transfer is a common point where account takeovers turn into stolen funds, and it is exactly what withdrawal address allowlists are designed to protect.
What an allowlist actually does
A withdrawal allowlist (also called an address whitelist) is a setting on a centralized exchange or custodial platform that restricts withdrawals to a list of addresses you approved ahead of time. If an address is not on the list, the platform will not let funds go there, no matter who is logged in or what they click.
This matters because of how account takeovers usually play out. An attacker who gets into your exchange account, through a leaked password, a SIM swap, or a phished login code, can see your balance and may be able to trade with it. What they want next is to move that balance to an address they control. An allowlist blocks exactly that last step, since their address was never approved.
Why there is a waiting period
Simply having a list would not help much if an attacker could just add their own address and withdraw a minute later. That is why most exchanges attach a delay to any newly added address before it becomes usable for withdrawals. During that window, you get a notification, usually by email, and a chance to notice and cancel a change you did not make.
The exact delay varies by platform. Crypto.com applies a 24 hour hold on withdrawals to a newly whitelisted address. Coinbase describes a 48 hour security hold on its address book allowlist. Kraken applies a 24 hour hold specifically when two factor authentication is not enabled on the account. CoinLoan lets users choose a waiting period of 24, 48, 72 hours, or seven days when adding a new address. These numbers can change, so check the current settings on whichever platform you use rather than assuming a specific figure.
Turning the feature off is often delayed too, for the same reason. On some platforms, disabling the allowlist does not take effect immediately, it takes effect after a similar waiting window, so an attacker cannot just switch the protection off and withdraw right away.
Network matters as much as the address
When you add an address to a whitelist, you are also choosing a network, for example Base, Ethereum mainnet, or another chain. An address itself does not encode which network it is meant for, so pick the network carefully when you add it. If you send funds intended for Base to an address whitelisted for the wrong network, the transaction can fail or, depending on the platform, the funds can become difficult to recover. This is a separate risk from the allowlist feature itself, but it shows up at the same step, so it is worth double checking both the address and the network together before confirming a withdrawal.
How this fits with a Base self custody wallet
Once funds land in a wallet like Simple Base Swap, the allowlist's job is done. From that point on, you are the only one who can move those funds, using your own keys, and there is no exchange side list involved anymore. The allowlist's value is specifically in the handoff: it reduces the chance that an exchange account compromise turns into a loss of funds before those funds ever reach your own wallet.
A practical habit that pairs well with this feature is adding your Base wallet address to your exchange's allowlist in advance, during a calm moment, rather than for the first time when you are in a hurry to move funds. That way the waiting period has already passed by the time you actually want to withdraw, and you are not tempted to disable the protection just to save a day.
What an allowlist does not protect against
It is worth being clear about the limits. An allowlist protects the destination of a withdrawal, not the account itself. It does nothing against:
- A phishing site that tricks you into signing a transaction directly from your own wallet, since that withdrawal never goes through the exchange's allowlist at all.
- Social engineering that convinces you to add an attacker's address yourself and wait out the hold period voluntarily.
- Malware that waits silently until you make a withdrawal to an address you already approved, then redirects or copies the transaction at the wallet level.
Treat it as one layer among several: strong two factor authentication, a unique password or passkey, and care with what you sign in your own wallet still matter just as much.
The takeaway
Withdrawal allowlists are a quiet but effective control precisely because of the waiting period attached to them. The delay is not friction for its own sake, it is the mechanism that gives you a chance to notice an unauthorized change before any funds move. If you regularly move crypto from an exchange to a Base address, setting up and maintaining that allowlist ahead of time is a small amount of setup for a real reduction in how much an account compromise can cost you.