0x9d8bf0ffb39ea9fae4ea347369bf3c288f05877f
IOI works exclusively with binance.com. The withdrawal whitelist must be set up there - not on binance.us, and not in the Binance mobile app (which doesnt support whitelist management). Use binance.com in any browser - desktop or phone.
Why bother?
Without the whitelist, an API key with withdrawal permission can move funds to any address. With the whitelist enabled, withdrawals can only go to addresses youve pre-approved. Even an attacker with your full API key and secret cannot bypass this.
Without whitelist
Stolen API keys = attacker drains your account to their wallet.
With whitelist
Stolen API keys = attacker can do nothing useful. Funds can only flow to IOI.
Adding new whitelist addresses also requires email confirmation plus a 24-72 hour cooldown, so attackers cant just bypass it by adding their own address either.
Step-by-Step Walkthrough
Same flow on desktop and phone - both use binance.com in a browser.
-
Open binance.com
Log in. If youre on mobile, dont use the Binance app - open binance.com in Chrome, Safari, or any browser.
-
Navigate to Security
Click your profile icon (top-right), select Account, then click Security in the left-hand menu.
-
Find "Withdrawal Whitelist"
Its at the top of the Security Checkup section. If currently OFF, toggle it ON and confirm with 2FA.
-
Click "Manage"
Either next to Withdrawal Whitelist in the Security Checkup, or scroll down to the Withdrawal Whitelist panel.
-
Click "Add Address"
This opens the address-add form.
-
Coin: select USDC
USDT also works - same address, same network.
-
Network: select BSC (BEP-20)
Critical step. If you pick a different network (ERC-20, TRC-20, etc.), the address wont be valid for IOIs withdrawals.
-
Paste the address
0x9d8bf0ffb39ea9fae4ea347369bf3c288f05877fUse the Copy button at the top of this page.
-
Label it
Name it something memorable like IOI Payments so you recognize it later.
-
Tick "Add Address to Whitelist"
Make sure this checkbox is ticked, then save.
-
Confirm via 2FA and email
Binance will send a confirmation link to your email - click it to finalize. There may be a 24-72 hour holding period before the address becomes fully active for withdrawals. This security cooldown is exactly what makes the whitelist effective.
The address is whitelisted. IOI can now collect commission/subscription payments, and nothing else can leave your account. Your funds are locked down.
Common Questions
Withdrawal whitelist management is a web-only feature on Binance. The mobile app shows most security settings (2FA, anti-phishing code, app authorization, etc.) but not the whitelist. For now, you have to use binance.com in a browser. You can do that on your phone too - just open the website instead of the app.
No. IOI only works with binance.com. binance.us is a separate platform with separate accounts, and our bot wont be able to connect or trade there. If you only have a binance.us account, IOI isnt usable for you right now.
The bot still works - withdrawal permission alone is enough for IOI to collect commissions/subscription. But without the whitelist, your API key can withdraw to any address. If those keys leak, the funds are at risk. The whitelist closes that gap entirely.
Yes. Binance allows multiple whitelisted addresses. You can add IOIs address and any of your own external wallets. Withdrawals are restricted to whichever addresses are on the list.
You can remove it anytime from the same Withdrawal Whitelist screen. Note that if youre on the commission model or auto-renewal subscription, removing the address means IOI can no longer collect what's owed - which will eventually pause your bots.
BSC has much lower withdrawal fees than Ethereum. For commissions that are typically a few cents to a few dollars per trade, ETH gas fees would eat the entire payment. BSC keeps transfers cheap.
The address is only valid on BSC. If you added it under a different network (ERC-20, TRC-20, etc.), it wont work. Just remove that entry from your whitelist and add it again under BSC (BEP-20).
Need Help?
If you get stuck or something looks different than described: