Polymarket Engineering Vice President Josh Stevens announces a new withdrawal address allowlisting feature
Polymarket Engineering Vice President Josh Stevens announced that the platform has added a withdrawal address allowlisting feature. Users can restrict withdrawals to approved addresses. When adding a new address, email verification is required, and a 48-hour lockup period is set. If someone other than the user is operating the account, the user can cancel the new request through the verification email.
Josh said that the feature is intended to reduce the risk to funds after an account session is stolen or after a user mistakenly signs a malicious transaction, and to prevent attackers from transferring funds or positions to unauthorized addresses. He suggested that users with the latest version of the wallet enable the feature, and users can set it up through “Settings → Account.”
In addition, the platform is developing Passkey support to further enhance account security. For users who have not yet used a deposit wallet, the team is developing a wallet migration tool; users who do not want to wait can also use the feature immediately by creating a new account. The platform also plans to launch more built-in security protections that users do not need to enable manually in the deposit wallet.
Original source:
Title: New security feature: Withdrawal address allowlisting Publisher: Josh Stevens (@devjoshstevens, Polymarket Engineering Vice President) Publication date: 2026-11-09 URL: https://x.com/devjoshstevens/status/2119909042541732275 Source nature: original post by the person concerned Verification status: the full original post was actually read in this review, verification date 2026-11-10 Supporting content: supports all core facts including the allowlisting feature, email verification, 48-hour lockup, email cancellation mechanism, setup path, Passkey development, wallet migration tool, and built-in protection plans
ABAB AI Insight
Josh Stevens previously served as senior vice president of engineering at Aave for about five years, and joined Polymarket in 2026 to oversee DeFi engineering. He has recently responded publicly multiple times on security issues, including the late-October compromise of a third-party script, when attackers used open sessions to sell positions and transfer funds, affecting more than 700 users. The platform then suspended trading, reset sessions, and refunded about $3.9 million in related losses. This allowlisting feature is part of the additional security layer he previously promised.
In terms of how it works, after users pre-approve withdrawal addresses, adding a new address requires email verification and is locked for 48 hours, during which it can be revoked through email. This provides a time window against fund outflows after session hijacking or malicious signing, without changing the user’s self-custody control over the wallet. For users without a deposit wallet, they need to wait for the migration tool or create a new account before they can use it, showing that the security capability is currently tied to a specific wallet architecture.
Similar to withdrawal allowlisting on traditional exchanges, Polymarket has adapted it to the prediction market scenario, focusing on protecting position transfers rather than only fund withdrawals. Compared with recent Polygon-related events (where some POL was frozen and later returned through a hard fork), this measure emphasizes proactive user-side protection rather than post-event network-level intervention. The difference is that Polymarket emphasizes not undermining self-custody while also planning built-in protections that do not need to be enabled manually.
This feature reduces the risk of immediate fund transfers after a session is stolen, but it depends on users actively enabling it, and email becomes a key veto channel. For high-value users, it provides additional operational delay, but it cannot fully eliminate phishing or malicious-signing risks. Observables include the feature adoption rate, the timing of Passkey launch, and whether similar session-attack incidents decrease.
ABAB News · Cognitive Law
Withdrawal address allowlisting provides a revocable interception window for session hijacking through email verification and a 48-hour lockup.
The feature is tied to the deposit wallet architecture, and users who have not migrated must create a new account or wait for the tool before they can use it.
After recent security incidents, the platform has moved its protections forward to combine user-initiated settings with built-in measures.