A policy lock

Binance’s press release framed the un-overridable lock as a hard guarantee. Su clarified the mechanism is an internal policy.

“It’s an internal policy for this particular feature. Our customer service agents are not able to override it,” Su told CoinDesk. “The goal is to address the irreversible transfer nature of crypto.. Unlike a fiat scenario where funds are withdrawn to a checking or bank account and there are ways to reverse the transaction, you can’t do that with onchain crypto.”

The distinction matters. A cryptographic lock would be effectively immutable for the user’s chosen period. A policy lock depends on Binance’s continued enforcement, and on the absence of legal compulsion to lift it. Su said the feature does not block law enforcement orders.

“This does not prevent law enforcement from taking action on accounts,” he said.

Why a delay is now worth offering

Withdrawal-delay features are not new. Coinbase has offered Vaults, with a 48-hour delay and email confirmation, for years. Kraken offers a similar Global Settings Lock.

The threat landscape has changed. According to data from CertiK and crypto researcher Jameson Lopp, verified physical coercion incidents against crypto holders rose 75% in 2025, reaching 72 confirmed cases. Assault-related incidents jumped 250%.

Coerced withdrawals defeat conventional account security. Every credential check is completed by the legitimate user.

A time lock changes that calculus: a user who activates Withdraw Protection before traveling to a high-risk region cannot be forced to move funds at the destination, even under physical threat. Contacting support, in this case, wouldn’t help either.

Trading bots and the next layer

Asked what user behavior worries him most, Su pointed to trading bots advertised on forums and ad networks that ask users to grant API keys with broad permissions.

“If the trading bot is a scam, it can be used to cause trading losses and unauthorized withdrawals,” Su said. Users should treat API keys with the same protection as their passwords or two-factor authentication, he added: “Once a key is used by a trading bot, it’s as if they are operating on behalf of that user.”

Binance is investing in context-aware authentication that varies friction based on detected risk, Su said. For routine actions like login or trading, the goal is to reduce visible challenges. For high-risk actions like withdrawals, more friction is the point.

He framed Withdraw Protection as one layer in a defense-in-depth approach, not a replacement for basic hygiene. The advice for the wrench-attack threat model, he said, was to manage one’s online footprint.

“Crypto users need to protect their online presence,” Su said. “Trying to protect the confidential information in terms of how much they have in crypto. Make yourself a harder target.”

More For You

Kraken Co-CEO Arjun Sethi at the Securities and Exchange Commission (Jesse Hamilton/CoinDesk)

The crypto exchange claims client funds were misused, commingled and concealed in a “Ponzi-like” scheme that unraveled amid a liquidity crisis.

What to know:

  • Kraken claims more than $25 million in customer funds were misappropriated.
  • The lawsuit accuses Etana Custody of commingling assets and masking losses with new deposits.
  • Etana CEO Dion Russell allegedly directed misconduct and concealed shortfalls.

About the Author

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Stories