After the FTX collapse and multiple exchange failures in 2022, millions of crypto users learned a hard lesson: trusting a platform’s claim to hold your assets is not enough. This is where proof of reserves (PoR) enters the conversation. Rather than simply believing an exchange when it says “we have your money,” PoR lets you verify that claim using cryptographic proof and on-chain data.
Proof of reserves is evidence that an exchange controls specific cryptocurrency assets and can connect them to customer balances. Think of it as the exchange showing its vault—not by opening the doors (which would reveal all customer holdings), but by using cryptography to prove the vault exists and holds what it claims. However, it’s crucial to understand what PoR can and cannot do. A PoR report can confirm that an exchange holds assets matching or exceeding customer deposits at a specific moment in time. It does not, by itself, guarantee the exchange is solvent, has no hidden debts, or will remain solvent tomorrow. PoR is one piece of the transparency puzzle, not the whole picture.
In this guide, we’ll walk through how to find a PoR report, interpret what it actually proves, verify the reserves yourself using blockchain data, check whether your balance is included, and recognize the limits of what even the best PoR report can guarantee.
What proof of reserves is and why it matters
Proof of reserves emerged as a response to a simple, terrifying reality: customers have no way to know if an exchange is solvent until it isn’t. When Mt. Gox, QuadrigaCX, and later FTX failed, customers discovered their balances were gone. The platforms had claimed to hold the coins, but no independent verification mechanism existed.
Proof of reserves flips that dynamic by allowing an exchange to publish cryptographic proof that it controls specific wallets containing specific assets. Ideally, this proof is verified by an independent third party (an auditor) and can be tested by individual users. Instead of “trust us,” the exchange says “verify us.”
The core distinction is between three things: assets (the coins the exchange holds), liabilities (what it owes to customers), and marketing claims (statements without proof). A solid PoR report ties assets to liabilities and backs both with cryptography. A weak one merely asserts that assets exist, leaving the liability side vague or absent.
Proof of reserves vs. a full audit
| Aspect | Proof of Reserves | Full Financial Audit |
|---|---|---|
| Scope | Proves exchange controls specific assets at one snapshot date | Reviews entire financial health, income, expenses, and risk exposure |
| Liabilities coverage | May only include customer deposits; omits business debts or obligations | Covers all liabilities, including loans, legal claims, and operational debt |
| Timeliness | Snapshot is a single moment; can be stale within days | Annual or periodic; typically covers a fiscal period |
| Verification mechanism | Cryptographic proof on blockchain; users can self-verify | Auditor’s signed opinion; users must trust auditor reputation |
| Regulatory weight | No standard; not mandated by regulators (yet) | Legally mandated for public companies and some regulated entities |
| Proof of liabilities | Often missing or unaudited; exchange self-reports customer balances | Independently verified; cross-checked against third-party records |
A full audit would tell you whether the exchange is actually profitable, owes money to creditors, or has hidden legal liabilities. PoR tells you the exchange has some assets that match some customer balances at a particular date. Both are useful, but they answer different questions.
Why users should care about reserve transparency
For a centralized exchange, you are a creditor. Your balance is an IOU from the platform. When an exchange fails, creditors queue up to claim what’s left. If the exchange is insolvent—liabilities exceed assets—most users lose money.
PoR does not prevent insolvency, but it can surface early warnings. If an exchange publishes a PoR report showing reserves below 100% (liabilities exceed assets), that is a red flag worth taking seriously. If an exchange refuses to publish a PoR report at all, that should raise questions.
PoR also builds withdrawal confidence. If you can verify that the exchange controls billions in assets, and you know your balance is included in that proof, you have stronger reason to believe a withdrawal request will succeed. Conversely, if a PoR report shows the exchange is undercollateralized or an auditor finds irregularities, that is your signal to reconsider holding large balances on that platform.
The benefit is not certainty—it is informed risk management. PoR shifts the burden of proof from users (who must trust blindly) to platforms (which must verify transparently).
How proof of reserves works under the hood
A PoR system has several moving parts. The exchange controls private keys and therefore can move or access funds on-chain. It publishes the public addresses holding these funds. An auditor (ideally independent) verifies that those addresses hold the claimed amounts at a specific date. The exchange also publishes customer liabilities in a format that lets users verify their own balance is included without exposing other users’ balances. This is where the Merkle tree comes in.
| PoR Component | What It Does | What Users Can Verify |
|---|---|---|
| On-chain wallet addresses | Exchange proves it controls specific public keys | Check the address on a blockchain explorer; confirm the balance matches the report |
| Snapshot date and time | Establishes when the proof is valid | Confirm the snapshot is recent; old snapshots are less meaningful |
| Asset total | Sum of all balances across all wallets | Add up published addresses and confirm the total is correct |
| Customer liabilities | Hashed and organized in a Merkle tree | Verify your balance is included in the tree without revealing other balances |
| Reserve ratio | Assets ÷ Liabilities (should be ≥ 1.0) | Calculate it yourself or trust the auditor’s computation |
| Merkle root hash | Cryptographic fingerprint of all customer balances | Use the exchange’s verification tool to confirm your leaf hashes to the published root |
| Independent audit | Third-party review of the above data | Check the auditor’s reputation, scope statement, and any disclaimers |
The main components: assets, liabilities, and Merkle trees
An exchange holds customer deposits in wallets it controls. These wallets have a total balance (the assets). The exchange also maintains a ledger saying “Alice owns 2 BTC, Bob owns 1.5 BTC,” and so on. The sum of all customer balances is the liabilities.
If assets ≥ liabilities, the exchange is, in theory, solvent on that snapshot date. If assets < liabilities, the exchange is insolvent.
To prove liabilities without exposing individual user balances, exchanges use a Merkle tree. Imagine each customer balance is a leaf. The exchange hashes each leaf, then combines pairs of hashes to create a new level, and repeats until there is one hash at the top: the Merkle root. You can then verify that your balance (your leaf) is part of that tree by checking that a sequence of hashes leads to the published root, without requiring access to anyone else’s balance.
The reserve ratio is straightforward: if an exchange reports 100 BTC in assets and customer liabilities of 80 BTC, the reserve ratio is 1.25 (or 125%). A ratio above 1.0 suggests the exchange is over-collateralized and could absorb losses. A ratio below 1.0 means the exchange already does not have enough to return all customer funds.
What a good proof of reserves report should include
A comprehensive PoR report is not a marketing document. It is a technical audit that any user should be able to scrutinize. Here are the essentials:
- Auditor name and qualifications – Independent, reputable firm with crypto expertise; not the exchange’s own internal team
- Snapshot date and UTC time – Specific moment when the on-chain data was captured; ideally recent (within days, not months)
- Asset list and wallet addresses – Breakdown by blockchain and asset type (BTC, ETH, etc.); each address must be verifiable on a public explorer
- Confirmed balance per address – The on-chain balance at the snapshot block height; auditor confirms this independently
- Total customer liabilities – Sum of all customer deposits; should be clearly separated from other obligations
- Merkle root and inclusion tool – Published root hash and a way for users to verify their balance is part of it
- Reserve ratio – Assets ÷ liabilities; flagged if below 1.0
- Scope and disclaimers – Explicit statement of what is and is not covered (e.g., “includes spot balances, excludes derivatives”)
Report elements to check first
- Auditor independence and track record – Verify the auditor has no financial ties to the exchange; check past reports for quality
- Snapshot freshness – Reports older than 30 days lose relevance; daily or weekly reports are stronger
- Asset coverage – Does the report include all platforms where customers hold funds (mainnet, layer 2, custodians)?
- Liability clarity – Are liabilities explicitly defined? Do they include margin, lending, or only spot balances?
- Verifiable addresses – Can you copy each address into a blockchain explorer and confirm the balance yourself?
- User verification tool – Is there a link to a tool where you can upload your balance proof and check inclusion?
Red flags that weaken the report
Self-attestation is the weakest form of PoR. If the exchange audits itself, there is no independent check. Look for a third-party auditor’s name and signature.
Vague scope is a common pitfall. A report that claims “all assets” but then defines that as only spot BTC and ETH on mainnet is misleading if the exchange also holds customer money on layer 2s, in custodian wallets, or in other forms. Read the scope statement carefully.
Stale snapshots are unreliable. A report from six months ago might have been accurate then, but reserve levels can deteriorate rapidly. If the most recent report is older than 30 days, the exchange is not providing timely transparency.
Missing liabilities are a red flag. Some exchanges report assets but do not commit to a specific customer liability figure. Without liabilities, you cannot calculate a reserve ratio or know if the exchange is truly solvent.
A technically correct report can still be misleading if it only covers a fraction of customer funds. Always read the scope statement first.
How to verify an exchange actually holds the crypto
The real test of PoR is whether you can independently verify the claims. Here is the workflow:
| Verification Step | What You Check | Why It Matters |
|---|---|---|
| Find the official PoR page | Navigate to the exchange’s published PoR report or transparency page | Ensures you are reading the actual report, not a third-party summary |
| Confirm the snapshot date | Check the UTC timestamp of when the on-chain snapshot was taken | Stale snapshots are less meaningful; confirm the date is recent |
| Locate the wallet addresses | Copy each published address from the report | You will use these to verify balances independently |
| Check balances on blockchain explorer | Paste each address into Etherscan, BlockScan, or mempool.space and confirm the balance at the snapshot block height | Proves the exchange actually controls those coins at that moment |
| Calculate total assets | Sum the confirmed balances across all wallets and asset types | Verify the exchange’s arithmetic; assets should match or exceed the reported figure |
| Compare assets to reported liabilities | Divide total assets by reported customer liabilities | Calculate reserve ratio; it should be ≥ 1.0 for solvency |
| Test balance inclusion | Use the exchange’s PoR verification tool to confirm your balance is included in the Merkle tree | Proves you are counted in the liability side of the equation |
A simple verification workflow for users
Start by visiting the exchange’s official transparency or PoR page. Major platforms like Kraken and Coinbase publish theirs prominently. Note the snapshot date—if it is more than a month old, the exchange is not providing current proof.
Next, copy one of the published wallet addresses. Open a blockchain explorer (Etherscan for Ethereum, blockchair.com for Bitcoin, etc.) and search for that address. Check the balance shown on the explorer and compare it to the balance stated in the PoR report. They should match (or the report should explain why they differ slightly, such as pending transactions).
Repeat this for at least three addresses covering different blockchains or asset types. If all balances check out, the exchange is likely controlling the funds it claims.
Now calculate the reserve ratio yourself. If the report says the exchange holds 100 BTC and customer liabilities are 80 BTC, that is a 1.25 ratio—healthy. If assets are 50 BTC and liabilities are 80 BTC, that is a 0.625 ratio—the exchange is insolvent.
Finally, look for the exchange’s balance verification tool. This is where you test whether your own balance is part of the Merkle tree. If the tool does not exist or the exchange does not publish one, that is a weakness in the PoR system.
How to verify your own balance in the Merkle tree
A Merkle tree proof is the exchange’s way of saying, “Your balance is part of our total liabilities, but we are not revealing other users’ balances.” You can verify this yourself.
- Log into the exchange’s PoR verification tool – Many exchanges have a dedicated page where you can test your balance
- Navigate to your balance proof section – The tool will generate a unique proof for your holdings
- Copy your leaf hash or balance commitment – This is the encrypted representation of your balance
- Paste the proof path – The tool will provide a sequence of hashes; paste these into the verification field
- Check the computed root – Click “Verify” and confirm that the proof leads to the published Merkle root
- Confirm the match – If the computed root matches the published root, your balance is included
Step-by-step balance verification
Open the exchange’s PoR or transparency page and look for a section labeled “Verify your balance,” “Balance inclusion tool,” or similar. Click it.
You will be prompted to verify yourself (usually with a signature using your account’s private key or a withdrawal address you control). This prevents anyone else from checking your balance.
Once verified, the tool displays your balance and generates a proof—a list of hashes and their positions in the tree. The tool will also show you the published Merkle root.
Now you perform the cryptographic verification. The tool walks you through combining your leaf hash with the proof hashes in a specific sequence. At each step, you hash the combined result. By the end, you should arrive at the published root hash. If you do, your balance is in the tree. If you do not, either your balance is not included or the proof is invalid.
Many platforms automate this calculation, but the best tools let you see each step. Transparency in the verification process itself builds trust.
What to do if your balance is not included
If the verification tool says your balance is not part of the Merkle tree, there are several possible explanations.
First, confirm that you are using the correct balance amount and currency. Sometimes users check a BTC balance but the tool is looking for ETH.
Second, check the snapshot date. The PoR report is a snapshot of holdings at a specific moment. If you received a deposit after the snapshot, it will not be included in that report.
Third, verify that the asset you hold is in scope. Some PoR reports cover only spot balances. If your balance is in a margin account or lending program, it might not be included.
If none of these explain the gap, contact the exchange’s support team. A missing balance is a serious issue and should be investigated. Legitimate exchanges should provide a clear answer about whether your balance was included and why or why not.
Limits and blind spots of proof of reserves
PoR is powerful, but it is not a guarantee of safety. Understanding its limits is as important as understanding what it proves.
| What PoR Shows | What PoR Does Not Show | User Implication |
|---|---|---|
| Exchange controls specific assets at a snapshot moment | Whether those assets are borrowed or pledged as collateral to other parties | Assets might be leveraged; if collateral is called, the exchange loses them |
| Total assets meet or exceed total liabilities | Whether the exchange has hidden debts or legal obligations outside the balance sheet | Exchange could be insolvent on an economic basis even if PoR says 1.2x ratio |
| Balance is included in the liability tree | Whether that balance is actually accessible or if the exchange has restrictions on withdrawals | You might be in the tree but unable to withdraw due to KYC holds or operational issues |
| Assets existed at snapshot date | Whether they still exist now or were moved/spent after the report | Reserves can deteriorate between reports; PoR is a point-in-time picture |
| Assets are held in self-custody | Whether the exchange or a trusted custodian actually controls the keys | If a third-party custodian holds the assets, PoR only proves the custodian’s balance sheet, not necessarily availability to customers |
Why PoR is not a guarantee of safety
A PoR report showing a 2.0x reserve ratio is reassuring, but it only reflects the moment the snapshot was taken. In the hours or days after publication, the exchange could make poor investments, face a sudden lawsuit, or experience a liquidity crisis that erodes reserves.
PoR also does not tell you about the quality of the liabilities. If an exchange has $100 million in assets and $50 million in customer deposits, that looks healthy. But if the exchange also owes $80 million to venture capital investors or lenders, the true solvency picture is much worse. A PoR report focused only on customer deposits would mask this risk.
Additionally, PoR assumes honest reporting. An exchange could publish a PoR report with fake wallet addresses, falsified auditor signatures, or inflated liability figures. You must verify the auditor independently and spot-check the addresses yourself.
Finally, even a perfect PoR report does not protect you from regulatory risk. If a government seizes an exchange’s assets or freezes operations, your balance might be in the proof but inaccessible for months or years.
How to compare exchanges using PoR data
If you are choosing between multiple exchanges, PoR gives you a common framework for comparison. Rather than relying on marketing claims, you can evaluate transparency directly.
- Recency of reports – Choose platforms that publish reports at least monthly; weekly or daily is better
- Auditor reputation – Prefer reports from established, independent auditors (e.g., Armanino, Crowe) over self-audits
- Asset coverage breadth – Platforms covering more asset types and blockchains provide more complete transparency
- Reserve ratio health – All else equal, a platform with a 1.5x ratio is safer than one with a 1.05x ratio
- User verification tool quality – Platforms with working, transparent balance inclusion tools deserve credit
- Liability clarity – Prefer platforms that explicitly define and separately audit customer liabilities
- Scope transparency – Platforms that clearly disclose what is and is not included are more trustworthy
Comparison criteria that matter most
| Criterion | Better Signal | Weaker Signal |
|---|---|---|
| Report frequency | Published weekly or more often | Annual or quarterly; months between reports |
| Auditor independence | Reputable third-party firm; auditor has no financial stake in the exchange | Exchange conducts its own audit; auditor is a subsidiary or affiliate |
| Liability definition | Clear, itemized breakdown of spot, margin, derivatives, and lending balances | Single lump-sum figure; vague categories |
| User verification tool | Tool is live, functional, and transparent about the cryptographic process | No tool; users must trust the report without self-verification |
| Reserve ratio | 1.5x or higher; stable or improving over time | Below 1.2x; declining between reports |
| Address verification | All addresses are independently confirmed by auditor and user-testable on explorer | Some addresses are not verifiable or require special tools |
Practical takeaways for choosing a safer exchange
PoR is one input, not the whole decision. A platform with a stellar PoR report but terrible customer service, high fees, and regulatory issues is still a risky choice.
Use PoR as a tier-breaker among platforms you already trust for other reasons. If you are comparing two established exchanges with similar fee structures and both offer good security, the one with frequent, high-quality PoR reports is the safer bet.
Also consider the regulatory environment. A regulated exchange (one licensed or overseen by a financial authority) has compliance obligations that go beyond PoR. A PoR report can supplement regulation but never replaces it.
Finally, remember that PoR is a test, not a stamp of approval. Even a perfect PoR report means you should still use withdrawal limits, enable two-factor authentication, and avoid holding large balances on any centralized platform for extended periods. PoR makes exchanges more verifiable, but it does not make them risk-free.