Proof of Reserves: What It Shows, What It Hides, and What to Ask Instead

After FTX, every major exchange rushed to publish proof-of-reserves reports. Some were meaningful; many were not. Here is how to read them, and which questions they still leave unanswered.

Why proof of reserves became urgent

In November 2022, FTX — at that point the second-largest crypto exchange by volume — filed for bankruptcy after it emerged that customer funds had been lent to Alameda Research, an affiliated trading firm, without customers’ knowledge. The exchange held far less in reserves than it owed to depositors. The collapse cost customers an estimated $8 billion and triggered the most significant regulatory response to a single crypto event since the Mt. Gox failure in 2014.

Within weeks, Binance, Kraken, OKX, Crypto.com and several other exchanges published what they called “proof of reserves” documents. The phrase had existed before, but FTX made it mainstream. The problem: not all proofs are created equal, and several of the reports published in the weeks after FTX were closer to marketing than auditing.

What a genuine proof of reserves contains

A credible proof of reserves has three components working together. usd/" class="twl-coinlink">First, a snapshot of on-chain wallet addresses holding the exchange’s assets, sufficient to verify that the stated balances exist on the blockchain at the claimed time. Second, a cryptographic proof — usually a Merkle tree — that each individual customer’s balance is included in the aggregated total, without revealing any user’s identity or balance to others. Third, a signed attestation from an independent accounting firm confirming that the methodology is consistent and that the data has not been manipulated.

The Merkle tree approach works as follows: each customer’s balance is hashed, those hashes are combined up a tree structure, and the resulting root 2/" class="twl-coinlink">hash is published on-chain. Any customer can verify that their own balance is included in the tree by checking their leaf against the root. This provides assurance that the exchange has not simply inflated the customer-balance total to match its wallet holdings.

Kraken has published this type of attestation since 2014 and provides a tool for customers to independently verify their inclusion. Binance followed in late 2022 with a Merkle-tree proof and has updated it quarterly. Coinbase, as a publicly listed company, provides audit-level disclosure through SEC filings rather than a separate PoR report.

What proof of reserves does not show

Even a well-constructed proof of reserves is a snapshot, not a continuous audit. It shows that at a specific moment the exchange held certain assets. It does not show whether those assets were borrowed, whether they have since moved, or whether the exchange has liabilities that exceed the assets shown.

This is the liability gap that destroyed FTX. A proof of reserves that shows $10 billion in Bitcoin on Binance’s wallets looks reassuring — but if the exchange has $12 billion in customer obligations and $2 billion in outstanding loans to an affiliated entity, the snapshot shows nothing about the insolvency risk. The proof shows assets; it does not prove solvency.

To address this, the industry has been developing a concept called “proof of solvency,” which combines the asset proof with a cryptographic commitment to the exchange’s liabilities. This is significantly harder to construct because liabilities are often held off-chain, may include non-crypto obligations, and require the exchange to disclose far more about its internal accounting than most are willing to show.

The third-party auditor problem

Several exchanges published “attestations” in late 2022 rather than audits. An attestation is a statement by an accounting firm that a set of figures is presented fairly based on management’s representation. An audit involves independent verification of the underlying records. The former is substantially less rigorous.

Mazars, one of the few accounting firms that produced PoR reports for crypto exchanges in late 2022, suspended its crypto-asset verification services in December 2022 after its methodology was widely criticised for not addressing liability. The episode illustrated that the accounting profession lacked established standards for crypto exchange auditing, and that firms attesting to exchange reserves without auditing liabilities were offering assurance that went further in the public perception than the actual scope of their work permitted.

On-chain vs custodied assets

Proof of reserves works cleanly for assets held in self-custody on public blockchains. A Ethereum balance is on-chain. But exchanges also custody clients’ dollars, hold positions on traditional exchanges, and may keep assets in segregated bank accounts or with sub-custodians where the blockchain cannot see them. An exchange that holds 100% of its crypto in customer-accessible wallets but has misappropriated customer dollar balances will pass a crypto-only proof of reserves perfectly.

This matters increasingly as stablecoins become a large fraction of exchange deposits. Tether (USDT), the largest stablecoin by market cap, requires trust in the issuer’s reserve claims. USDC relies on Coinbase and Circle, which are subject to US financial regulation. A PoR showing full USDT backing tells you the exchange has the USDT — it does not tell you whether Tether’s own reserves are what they claim. For coverage of the stablecoin reserve question, see the category/exchanges/”>exchanges TheWeal covers, we note the PoR methodology where it is publicly documented.

What regulators are beginning to require

In the United States, the SEC’s proposed rules for crypto asset securities intermediaries would require full custody segregation and periodic disclosure of asset holdings. The EU’s Markets in Crypto-Assets (MiCA) regulation, which came into effect progressively through 2024, requires crypto-asset service providers to hold clients’ funds separately from their own and to report on custody arrangements. Neither framework as currently written mandates a specific PoR methodology, but both move toward the kind of ongoing independent verification that the Merkle-tree approach partially achieves for on-chain assets.

Frequently asked questions

Sources

• Kraken Proof of Reserves — methodology and user verification tool
• Coinbase customer agreement and SEC filing disclosures
• BIS Working Paper 1063: Crypto exchanges and proof of reserves (Bank for International Settlements, 2023)

This analysis reflects publicly available information as of publication. It is not financial advice and not a recommendation to use any particular exchange. Cryptocurrency exchange risk includes insolvency, hack, regulatory action and loss of access to funds. Do your own research before depositing on any platform.