Proof of Reserves Explained: What It Can’t Prove

Disclosure: This article is information and opinion, not financial advice. See our full disclaimer.

After FTX imploded in November 2022, the crypto industry rushed to adopt a mechanism for proving honesty. Exchanges published cryptographic attestations, auditors signed reports, dashboards went live. And then a detail that tells you most of what you need to know: the accounting firm behind several of those early reports paused its crypto work within weeks, reportedly worried about how the public was interpreting them.

That’s proof of reserves in one story. Genuinely useful, genuinely oversold, and worth understanding properly before you trust it with your deposit decisions. I’ve dug through a lot of PoR pages over the years, and the gap between what they prove and what people think they prove is where the risk lives.

The short version

Proof of reserves (PoR) is a cryptographic method exchanges use to show they hold the assets backing customer deposits. Customer balances are hashed into a Merkle tree, the exchange proves control of on-chain wallets, and anyone can verify their own balance is included in the total. It proves assets exist at a snapshot in time. It does not prove solvency, because it shows what an exchange has, not what it owes.

How it actually works, without the jargon fog

Three moving parts.

The liabilities side. The exchange takes a snapshot of every customer balance at a specific moment. Each account becomes a hashed “leaf” in a Merkle tree, leaves get combined and hashed in pairs, and the process repeats until one root hash remains. That root is a mathematical commitment to the entire set of balances. Change any single account by one satoshi and the root changes. It’s the crypto equivalent of proving what’s in a sealed envelope without opening it.

The assets side. The exchange demonstrates control of its wallets, usually by signing a message from them, and the on-chain balances get totaled. Sometimes an independent auditor oversees this part. Sometimes nobody does, which is worth noticing when you read a PoR page.

Your part. Good implementations give you a record ID or hash so you can personally check that your balance was included in the tree. If your account is in the liabilities and the wallets cover the liabilities, the exchange was backed 1:1 at that moment, for the assets covered. Kraken ran the first audit of this kind back in 2014, long before it was fashionable. It took FTX’s collapse to make it standard.

How to check an exchange’s PoR in five minutes

The routine I actually use, in order.

1. Find the PoR page. Usually footer or security section. No PoR page at all on a major exchange in 2026 is itself an answer, and I treat it as one of the ten red flags.

2. Check the date. A snapshot from eight months ago proves what existed eight months ago. Real-time or monthly beats quarterly beats “we did it once in 2023”.

3. Look for the liabilities half. Wallets full of coins are only half the equation. If there’s no Merkle tree, no way to verify your own balance, just a list of fat addresses, that’s proof of wallets, not proof of reserves. Marketing teams love to blur this line.

4. Verify your own inclusion. If you hold funds there, run the self-check with your record ID. Takes two minutes and it’s the entire point of the system.

5. Cross-reference independently. Compare the exchange’s claimed wallets against a third-party tracker like DefiLlama’s CEX transparency dashboard. Numbers should roughly agree. Big unexplained gaps are a question you want answered before depositing, not after.

What PoR cannot prove, and this part matters more

It shows assets, not debts. An exchange can display $2 billion in wallets while owing $3 billion to lenders, market makers, or its own trading arm. Nothing in a Merkle tree reveals that. Solvency means assets minus liabilities, and PoR only ever shows the first half. This is the single most misunderstood thing about it.

It’s a photograph, not a video. The snapshot proves a moment. Coins can be borrowed for the photo and returned the next morning. Recurring or real-time attestations shrink this window but never close it completely.

Control isn’t ownership. Signing from a wallet proves access, not that the funds are free of claims. Coins pledged as collateral elsewhere look identical on-chain.

Coverage has gaps. Early audited reports openly noted that not every token or chain was covered by the verification tools. Read the fine print on which assets the attestation actually includes, because your altcoin might not be in it.

None of this makes PoR worthless. It makes it a floor. An exchange that publishes recurring, self-verifiable proof of reserves has cleared a bar that FTX never could have cleared quietly. But a floor is not a ceiling, and “we have proof of reserves” is not a synonym for “we are solvent”. The honest framing: PoR moves an exchange from “trust me” to “trust, but here’s partial verification”. Partial. For the rest, you still want a verifiable license, withdrawal tests, and the discipline to keep long-term holdings in self-custody.

FAQ

Does proof of reserves mean an exchange is safe?

No. It means the exchange controlled sufficient on-chain assets to match customer balances at a snapshot in time, for the assets covered. It says nothing about debts, off-chain obligations, or what happens tomorrow. Treat it as one necessary check among several, not a safety certificate.

How do I verify my own balance in a proof of reserves?

On the exchange’s PoR page, find the self-verification tool, enter the record ID or hash from your account, and confirm your balance appears as a leaf in the published Merkle tree. If an exchange offers no way to verify your own inclusion, what it’s publishing is a wallet list, not a real proof of reserves.

Why did auditors distance themselves from PoR reports?

In late 2022, the accounting firm that produced several high-profile PoR reports paused its crypto work, reportedly over concerns that the public read the reports as full audits of solvency. They aren’t. A PoR attestation is much narrower than a financial audit, and even the people signing them wanted that understood.

Which is better: audited snapshots or real-time proof of reserves?

Real-time or frequently recurring attestations are stronger, because they shrink the window in which funds could be borrowed just for the snapshot. An audited snapshot adds independent oversight but only for one moment. The strongest setups combine both: frequent attestations plus periodic third-party verification.