Wtihdrawal address white list
Like many other exchanges already implement (Binance for example). A list of address toward which we can withdraw BTC. Adding a new address to that list would require 2FA AND email confirmation, and maybe some delay of a few days before enabling withdrawals to that new address.
This would add a new layer of security to users funds.
Withdrawal of any btc from an account should require confirmation from the email address associated with that account
An attacker must then compromise both vaultoro and the independent email.
Having more addresses is less secure. Period. Having only one withdrawal address at a time, requiring 2FA to change it, is the most secure.