A whitelisted withdrawal address can not save you, despite that it will take 24 hours before withdrawal can be allowed after resetting a withdrawal address, that will not even buy you any time to secure your account, except your account was hacked by a dumb hacker. Are you not aware that once a hacker gains access to your funded exchange and successfully change the password, the first thing they do is to set a 2FA and once they have done that, before you can regain back access to that exchange, they must have already bought enough time with that 2FA that they set up on your account and they will move your money before you gain back access.

It's better they don't even gain access to your account at all, do every best to add 2FA before hackers do it for you and just like the first comment said, avoid exchanges that doesn't have the feature to set 2FA on your account. The security of the exchange I am using is to strong that you will have to pass 2 phase 2FA before you can reset password, make withdrawal or do P2P trade.

It is true that not using the same password everywhere helps a lot. But since the OP is talking about a Google account being hacked, then even if you use a different password on your Exchange account, hackers can still send a recovery link to your email address via the Forgot Password and through that they can hack your Exchange account. So in this case, two factor authentication is definitely necessary. Also, I think that you should never keep all your funds in one exchange. For financial matters, I think that you should spread them out across all the places, so that by any chance, even if an account gets hacked, all your funds are not lost.

That is why exchanges offers multiple security layers to avoid unauthorized access even when your email is hacked and some exchanges don't even allow withdrawal after a password change for the same reason too.

Make sure you have 2FA via an authenticator apps and also keep the backup codes offline not in the same cloud storage or the email inbox itself. Also, exchanges might request more details to reset the password when 2FA is enabled. So it is not an easy taks for the hacked to steal the crypto after gaining access to your mail but still being cautious is a good thing.

The security of our emails should be our responsibility; the exchange cannot do anything about hacked emails, but I am wondering how scammers gain access to emails easily. Do they attempt changing passwords of the mail so that when they gain access to the mail, they go further to check the email inbox and know the exchanges the users are using? If yes, then we need external security to be added to secure our emails, if possible, 2FA for the emails because some of us save some sensitive information in the email.
If we can add extra security to our emails, our exchange accounts are almost safe even without 2FA, but we should add the 2FA for external security.

Above all, it is not encouraged to save your Bitcoin in an exchange; your 2FA will not save your Bitcoin if the exchange is being hacked. Learn to keep self-custody of your Bitcoin and stop relying on exchanges to help you out.

You are right but that can also be one of the reasons why your email can be hacked, when you use the same login details for your gmail/yahoo or any other email provider the same as your exchanges account.

You'll only get hacked with your email if you do that or login to a suspicious website. And that's why IMO, it's still a strong way of protecting ourselves from this risk.

So it's a double security matter if you combine it with 2FA and it's the first step before we even use 2FA.

I used to have a separate e-mail account for each exchange I was registered on to.  It was pretty difficult to manage all of them but I knew which e-mail being compromise affected which account.  I have seen others practice a more simplistic version of this, as in one e-mail for exchanges, another for personal things.

Anyway.  It is kind of obvious an e-mail compromise can hurt you a lot.  Particularly if you use one single account for every thing.  They can contact institutions, make requests, reset passwords et cetera while copying even your writing style with high accuracy, particularly now with 'AI' trending.

This what is advisable to practice by any one. This clearly using burner emails and it’s highly recommended. Usually the best is to avoid platforms that requires emails but it’s not possible in some cases as such best yes you do is to use burner emails. The thing is you don’t actually set very difficult login details on them so that you don’t actually get confused if it actually get comprised too. Exchange emails should never be your personal or main email because they are the most easily compromised ones.

That is why, whenever you create an exchange account, you should ensure a few things:
- Set up email access on more than one device! This ensures you to receive a notification, if a login attempt is from outside your usual location.
- Always enable 2FA! I am sure that most exchanges support this by now. This involves using more than just a standard email code. You can use certain methods. Such as: like Google Authenticator, a specific PIN, phone number notifications, or other options. It will probably provide a higher level of security. Better than relying solely on email notifications.

2FA activation for your exchange account and your email is a very good security advice but it's not enough. It's second layer security protection so it must be installed and activated on a second device, that is different than a device you log in your exchange account and email account.

Many people install and store everything on one device, log in every accounts on one device, with such practice, 2FA won't be able to secure their exchange account and fund.

Google Authenticator is not a good 2FA application.
It's close source.
Years ago, it launched a feature to allow user backup their 2FA code in cloud storage.

There are other choices, better too, like open source 2FA.
https://getaegis.app/