If someone has your password and your second factor, only one question still decides whether your balance leaves the exchange: is the attacker’s destination address already in your account, or do they have to enter it first? This is exactly where the withdrawal whitelist comes in. It is a list of approved destination addresses, and…
