Withdrawal allowlist and delayed-withdrawal controls
Lock withdrawals to approved addresses and add an optional 24-hour delay for new ones, both under Account → Security.
You can now restrict withdrawals to a list of addresses you approve in advance. Anything not on the list is refused, even if someone has your password.
Optionally, add a 24-hour delay before a newly added address can be used. The delay gives you a window to notice and cancel a change you did not make.
Both controls live under Account → Security, next to two-factor authentication and your device list.