24-Hour Whitelist Lock

The 24-Hour Whitelist Lock is an optional security feature that applies a 24-hour cooling-off period to any newly added crypto withdrawal address. During this window, the address is visible in your address list but cannot be used for withdrawals.

This provides a critical window to detect and cancel any unauthorised address additions before funds can be moved — protecting your account against Account Takeover attacks and social engineering.

The feature is off by default. It can be enabled or disabled at any time by Authorized Representatives.

1. Go to Settings > Security.

2. Toggle 24-Hour Whitelist Lock to ON.

3. A confirmation message will appear, and an email notification will be sent to all Authorized Representatives.

From this point forward, all newly added crypto withdrawal addresses will be subject to a 24-hour lock before they can be used.

When you add a new crypto wallet address with the lock enabled:

• The address appears in your address list with a Pending status and a countdown timer showing when it will become available.

• The address will not appear in the withdrawal dropdown until the 24-hour period has elapsed.

• An email notification is sent to all Authorized Representatives with the address details and the time the lock expires.

• A follow-up email is sent when the lock expires and the address becomes available for withdrawal.

• If you attempt a withdrawal via the API to a locked address, an explicit error will be returned.

You can delete a locked (Pending) address at any time — no waiting period is required. This allows you to immediately remove any address that was added without your authorisation or in error.

To delete a locked address:

1. Go to Settings > Wallet Addresses.

2. Locate the address showing a Pending status.

3. Choose Edit > Remove This Account > Yes, Continue.

To prevent an attacker from instantly bypassing the protection, disabling the lock does not take effect immediately.

1. Go to Settings > Security.

2. Toggle 24-Hour Whitelist Lock to OFF.

3. Complete 2FA verification when prompted.

4. The toggle moves to a Pending Disable state. An email notification is sent to all to all Authorized Representatives.

5. The lock remains fully active for the next 24 hours. Any existing wallet addresses still locked will continue their countdowns. Any addresses added during this period are still subject to the lock.

6. After 24 hours, the lock is fully disabled and new addresses are available immediately upon addition.

Does the lock apply to existing whitelisted addresses?

No. The 24-hour lock only applies to addresses added after the feature is enabled. Any addresses already whitelisted on your account prior to this remain unaffected and available for withdrawals.

Does the lock apply to bank accounts?

No. The lock applies to crypto wallet addresses only.

Does re-whitelisting an existing address trigger the 24-hour lock?

No. If you use the re-whitelist action on an existing address, the 24-hour lock will not be triggered. Only addresses being added to your account for the first time after the lock has been enabled are subject to the lock.

Can I still see a locked address in my address list?

Yes. Locked addresses are visible in your address list with a Pending status and a countdown timer, but they will not appear in the withdrawal dropdown until the lock expires.

What happens if I try to withdraw to a locked address via the API?

The request will be rejected with an explicit error. See the API documentation for details, including the locked and lockExpiryDateTime fields returned on withdrawal instructions.

Who can enable or disable the lock?

Only Authorized Representatives can toggle the lock under Settings > Security.

Will I be notified of changes to the lock status?

Yes. Email notifications are sent to all Authorized Representatives when the lock is enabled, when a new address is whitelisted, when the address becomes available for withdrawals, when a disable request is initiated, and when the lock is fully disabled.