Is WhiteBIT safe to connect?
Exchange ยท Multi-asset centralized exchange (spot, futures, margin). Checked 2026-10-25; every line links its source.
Worst case: WhiteBIT holds your coins, and a leaked key carrying the full Withdraw permission without an IP whitelist can empty the account; idle bot keys also stop working after 14 days.
Safe setup in 3 steps
- Create bot keys without the Withdraw permission and add your server's IPs to the whitelist
- Plan for the 14-day inactivity rule: a standby key that makes no requests is deactivated
- EEA users: check whether your account is moving to WhiteBIT EU (whitebit.eu) and what that entity supports before relying on it
What it can do with your money
| Who holds the keys | The exchange holds your funds Custodial exchange account; WhiteBIT says 96% of assets are in cold storage (site meta description). source |
|---|---|
| Can funds be sent out to any address? | Yes. Withdrawals available; API-issued keys are revoked if the account is blocked or frozen. source |
| What a leaked API key can do | Withdrawal rights come only with the full 'Info + Trading + Deposit + Withdraw' set. Each key supports up to 50 whitelisted IPs and WhiteBIT says to always enable IP whitelisting for production keys. Keys unused for 14 consecutive days are deactivated automatically (an IP whitelist does not exempt them). Default permissions are not stated. source |
| Monero and Zcash | XMR: XMR/USDT and XMR/USDC spot listed; deposit/withdrawal status not confirmed source ZEC: ZEC/USDT, ZEC/USDC and ZEC/BTC listed source Regions: Whether WhiteBIT EU (whitebit.eu) will offer XMR/ZEC was not confirmed source |
Official links
- Website:
whitebit.com - X:
@WhiteBit - App:
https://apps.apple.com/ua/app/whitebit/id1463405025
Where we confirmed these
Deadlines
- 2027-07-10: EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use this service through its EU-licensed entity (WB-Shield Innovations GmbH 'WhiteBIT EU', Austria; MiCA licence announced 2026-06-19 for whitebit.eu: https://www.theblock.co/post/405421/whitebit-eu-secures-mica-license-in-austria-expanding-regulated-crypto-services-across-europe). source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-01-23 | Russia declared WhiteBIT and parent W Group 'undesirable', banned it and barred Russian banks and payment providers from processing WhiteBIT transactions; continued use by Russian residents carries criminal penalties | Russian users cut off | source |