Delayed Withdrawals: Why Exchanges Intentionally Slow Down Transfers

In the first half of 2026, crypto projects and users lost over $1.31 billion due to attacks, according to CertiK. In 2025, Chainalysis identified around 158,000 cases of personal wallet compromises. At least 80,000 owners fell victim, with total damages reaching $713 million.

These measures only help in the case of account takeover. They do not protect against the hacking of the platform itself. In February 2025, nearly $1.5 billion was stolen from Bybit during a transfer between the exchange's corporate wallets.

In July 2026, OKX introduced Offline Mode. Account owners can close withdrawals for up to 12 hours each day— for example, from 10 PM to 8 AM. The mode cannot be disabled until the selected period ends.

The restriction applies not only to regular blockchain transfers. During this time, P2P sales, withdrawals via API, and OKX Pay top-ups are also unavailable.

Almost simultaneously, the exchange added protection for large transactions. Users set a daily limit ranging from $10,000 to $10 million. Transfers from the main account and sub-accounts, P2P, API, and Pay are considered in this calculation. It is not possible to split one amount across multiple channels.

Once the limit is reached, identity verification will be required. Withdrawals initiated via API must be continued on the website or in the app. Biometric verification is also needed to increase the limit and disable the feature.

Such control will not protect against phone fraud if the owner confirms the transaction themselves. However, it complicates quick withdrawals after a password, email, or device access theft.

On OKX, transfers to a new address can be blocked for 24 hours. The daily restriction is also activated after changing the password, phone number, email, or one-time code app.

Bybit has the same timeframe. After disabling protection, withdrawals remain closed for another day. In the settings, users can remove the manual input field and only allow selection from the address book.

Binance offers three delay options: 24, 48, or 72 hours. After changing the password, the platform usually suspends withdrawals for another one to two days. Coinbase Exchange verifies a new address for 48 hours, while Gemini's wait can take up to seven days.

A long delay creates problems during sharp market movements. A new address from another exchange or wallet cannot be used for urgent collateral transfers. Therefore, regular addresses are usually added in advance.

Bybit allows users to completely prohibit withdrawals via the website and restrict them to the mobile app only. Another feature requires additional verification if the request comes from an unusual location. A saved address does not exempt from confirmation.

Coinbase offers a different level of control. Transfer Protection delays transfers for a period of 6 to 48 hours. The restriction can be applied to all transactions or only after exceeding a set amount.

Trusted individuals can confirm large transfers. The owner chooses the rule: majority vote or unanimous consent. Until verification is complete, the request can be canceled.

It is not possible to quickly loosen such protection. If the delay is reduced from 48 to 24 hours, the new conditions will only take effect after 48 hours. When trusted individuals are appointed, changes also require their consent.

Kraken does not delay every transaction. Global Settings Lock blocks changes that usually precede theft: adding an address or API key, changing email, password, and two-factor protection.

When the feature is enabled, the owner sets a unlocking period—from one day to 30 days. Kraken support cannot shorten this period. To disable it immediately, a separate master key created in advance is required.

It is still possible to transfer money to an already saved wallet. The function is designed for situations where an outsider has accessed the account and is trying to add their own address.

KuCoin and Gate simply close withdrawals for 24 hours after changing the password, phone number, email, or two-factor protection. Bitget allows one minute to cancel an already created request. The address entered on the Bitget website is also shown in the app—making it easier to notice a substitution in the browser or clipboard.

None of these functions work after a transaction is sent to the blockchain. From that moment, stopping the transfer through the exchange interface or contacting support is no longer possible.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.