CryptoWorkPro

Say someone steals your exchange password. The first thing they try is to send your crypto to their own wallet. Some exchange tools are built to slow down that exact step.

The cost is a wait. A new withdrawal address may not work for 48 hours. That can surprise you if you add an address and try to send right away. Knowing the rules ahead of time avoids the surprise.

This guide covers two tools described in official help pages: the Coinbase address allowlist and the Kraken Global Settings Lock.

What these tools do

A withdrawal address is where your crypto goes when you send it out. It is a long string of letters and numbers.

These tools put a speed bump or a lock around that list. A thief who gets into your account cannot add a new address and send funds at once.

This is a different wait from a hold on a bank deposit. For that topic, see You Can Trade It. That Does Not Mean You Can Send It.

Coinbase: the address allowlist

An allowlist is a short list of addresses your account may send to. Coinbase's help page on the address book allowlist describes how it works.

When allowlisting is on, you can only send to addresses in your address book.
You need 2-step verification to turn it on, turn it off, and use it.
To set it up, go to Settings, then Allow list, then Enable Allowlisting, then Add address.
For assets on EVM networks, use an EVM address.
A new address can be used for sends after 48 hours. The "date added" column shows when.
Turning allowlisting off also takes 48 hours. If you turn it off within 8 hours of switching it on, the 48-hour wait does not apply.

Coinbase has a second product, Coinbase Exchange, with its own address book and whitelisting page. Whitelisting there is on by default for new users, and new addresses also need a 48-hour wait. Coinbase says the Address Book is only on Coinbase Exchange, not on Coinbase.com or the app. Check which product you use.

Kraken: the new-address check

Kraken's help page on adding and confirming a new withdrawal address (updated Oct. 22, 2026) says:

A new address added from a trusted device is approved automatically.
Otherwise, you confirm it through an email link that works for one hour.
If you change your password and have neither sign-in 2FA nor a Master Key, withdrawals to new addresses are held for up to 24 hours. Existing addresses are not affected.
Copy and paste the address. Do not type it.

Kraken's help pages do not agree on every number. A separate page for Kraken Pro (updated Mar. 4, 2026) says the hold is 12 hours. That page also says the confirmation email has a "Lock Account" link. Use it only if you did not add the address. Check the page for the Kraken product you use.

Kraken: the Global Settings Lock

The Global Settings Lock, or GSL, freezes changes to your account. Kraken's page on the GSL (updated Apr. 23, 2026) says it blocks actions such as:

Adding a crypto withdrawal address
Adding a withdrawal bank account
Changing your email or your password while logged in
Adding or changing 2FA, a Master Key, a PGP key, or API keys
Raising your verification level

Kraken says the lock holds even against Kraken Support. Your balances and history stay visible.

To unlock without a Master Key, you wait. Kraken says the minimum is 24 hours and the maximum is 30 days, based on your settings. Kraken emails you as soon as someone requests an unlock. Its example: you set the lock to 7 days, a thief logs in and cannot add an address, then asks to unlock. You have 7 days to re-lock the account and contact Support.

A Master Key is a backup key you create ahead of time. If you set one up before the lock, it can remove the lock right away. That is handy for you. It is also a risk if someone steals the key.

Kraken's account security page (updated Sept. 30, 2026) adds two points:

Set up the Master Key before you turn on the GSL. You cannot add or change one while the lock is on.
The waiting period can be 1 to 30 days. The default is 3 days. Without a Master Key, you must wait the full period, and Support cannot shorten it.

A short setup checklist

Add the address you plan to use now, not on the day you need it.
Copy the address from your own wallet and paste it. Check the first and last characters.
On Coinbase, find the "date added" column and note when the address becomes usable.
On Kraken, set up a Master Key first if you want one, then choose your GSL waiting period.
Act quickly on security emails you did not expect, such as a new device or a new address. Kraken advises this on its security page.
Let no one "set up or manage" your account for you. Kraken warns about this in its security guide.

What these tools cannot do

These tools slow a thief who is logging in as you. They do not stop a scam where you approve the send yourself. If someone talks you into adding their address, the tool does what you told it to do.

No setting makes an account safe. Treat these as one layer along with a strong, unique password and 2-step verification.

Sources

Disclosure: This article summarizes public help pages checked on Oct. 23, 2026. Features, wait times, and menus can differ by product, region, and account, and companies update them. It does not rank exchanges for safety. The illustration is AI-generated. This article is not financial, legal, or investment advice. AI-assisted research and writing. Cited sources, not AI alone, support the claims.

Market context

Add Your Withdrawal Address Early: How Coinbase Allowlists and Kraken's Settings Lock Work