Proof of Reserves Explained: How Crypto Exchanges Prove They Hold Funds

Introduction

In November 2022, FTX — at the time the world’s second-largest crypto exchange — collapsed within days. The investigation revealed that the exchange had been using client funds for its own trading operations. The officially stated reserves did not match reality. Trust was not broken by technology — it was broken by its absence.

After the FTX collapse, the question “how much money does the exchange actually have?” stopped being academic. The industry received a hard lesson: reputation without verification is worthless. That is when the concept of crypto proof of reserves moved from technical discussion to the forefront as a standard of trust.

What Is Proof of Reserves?

Proof of Reserves (PoR) is a cryptographically verifiable confirmation that an exchange or custodial service holds sufficient assets to cover all customer obligations. Proof of reserves crypto is not just a report — it is mathematically verifiable proof that any user can confirm independently, without relying on a company’s word.

What is proof of reserves in practical terms? Imagine a bank that does not just publish an annual capital adequacy report, but allows every depositor to verify in real time that their specific deposit is included in the total reserves. That is the level of transparency proof of reserve provides in the crypto industry.

Proof of reserves is not a standard accounting audit, and it is not a promise. It is a cryptographic mechanism based on mathematics that cannot be falsified.

How Proof of Reserves Works

Wallet Verification

The first step is proving ownership of addresses. The exchange publishes a list of blockchain addresses and signs a message with the private key to each one. Since only the private key owner can create the signature, this cryptographically proves the exchange controls the corresponding wallets.

The balances of these addresses are visible on the public blockchain — anyone can check them. The aggregate of verified addresses forms the “asset side” of the exchange’s balance.

Asset Disclosure

Simultaneously, the exchange compiles a complete list of liabilities — all customer balances in aggregate. The task of proof of reserves is to prove that total reserves are not less than total obligations.

But a challenge arises here: how to disclose the total amount of obligations without exposing individual user data? This is exactly where the Merkle tree is used.

Third-Party Audits

The most reliable variant is when the entire verification process is conducted by an independent auditor: cryptographically verifying signatures, validating blockchain address balances, and confirming the correspondence of assets to liabilities. Companies like Armanino or Mazars specialize in exactly these checks.

However, it is important to understand: third-party audits capture a state at a specific moment. The day after an audit, reserves may change. This is why more advanced platforms are moving toward continuous reserve monitoring.

Merkle Tree Verification Explained

What Is a Merkle Tree

A Merkle tree is a data structure that allows efficiently proving the inclusion of a specific element in a large dataset without revealing the entire dataset. Conceptually: each element (a user’s balance) is hashed; adjacent hashes are combined pairwise and hashed again; the process repeats up to a single root hash — the Merkle Root.

The root hash mathematically depends on all balances in the tree. Changing one balance and maintaining the same root is impossible. This makes the Merkle tree a cryptographically secured aggregate of all customer balances.

How User Balances Are Verified

Each customer receives a unique “leaf” in the Merkle tree — a hash of their balance. Along with the leaf, the user receives a “Merkle path” — a set of adjacent hashes needed to independently compute the root hash.

If the root computed by the user matches the Merkle Root published by the exchange — this confirms that the user’s balance is genuinely included in the stated reserves. This verification can be performed using a simple script or specialized tools on exchange websites.

Privacy in Verification

The key property of the Merkle tree in the context of proof of reserves: to verify their own balance, a user does not need to know the balances of other customers, and the exchange does not publicly disclose individual data.

This resolves the classic transparency-versus-privacy dilemma: the system proves everything necessary without revealing anything unnecessary.

Why Proof of Reserves Became Important

Before the FTX collapse, most exchanges operated on a “trust us” model: annual financial reports (if published at all) and management statements about the reliability of fund storage. Users had no tools for independent verification.

The FTX crash exposed a systemic risk: custodial services can use client funds in ways clients are unaware of. The $8 billion gap between stated reserves and actual obligations became the largest fraud in crypto industry history.

The market responded quickly. Within weeks of the FTX collapse, major exchanges — Binance, Kraken, OKX, Bybit, Gate.io — published their first proof of reserves. Conducting them became not just “good practice” but a necessary condition for maintaining trust.

Regulators also responded: in several jurisdictions, PoR is transitioning from a voluntary measure to a licensing requirement.

Benefits of Proof of Reserves

Transparency without trust. Users can mathematically verify an exchange’s solvency without relying on promises. This is a fundamentally different level of trust compared to traditional finance.

Fraud prevention. Regular PoR creates a mechanism for early detection of reserve problems. If an exchange cannot or will not conduct proof of reserves — that itself is a red flag.

Competitive pressure. Exchanges publishing PoR set a standard others must match. This raises the bar for the entire industry.

User protection. Customers gain a tool for independent verification — not depending on promises, but checking themselves.

Regulatory readiness. Amid tightening regulation (MiCA in the EU, legislation in the US), PoR becomes part of the compliance infrastructure. Exchanges with working PoR are better prepared for regulatory requirements than competitors.

Limitations of Proof of Reserves

Snapshot, not continuous monitoring. Traditional PoR is a check at a specific moment. An exchange can temporarily move funds to verified addresses at the time of an audit and return them afterward. Without continuous monitoring, this limitation remains relevant.

Does not account for full liabilities. Proof of reserves proves that assets are not less than customer deposits. But it does not account for other exchange obligations: debts, loans, operational liabilities. An exchange that passes PoR may still have serious financial problems.

Auditor quality matters. PoR conducted by a questionable auditor or without independent verification is worth little. The reputation and methodology of the auditing firm are critically important.

Not all assets are blockchain-verifiable. Exchanges hold part of their reserves in fiat or “traditional” instruments that cannot be verified via blockchain. Complete PoR must account for these assets — requiring traditional audit in addition to cryptographic verification.

Does not protect against operational risk. PoR proves solvency but not operational reliability. An exchange can have sufficient reserves and still suffer from a hack, regulatory pressure, or technical problems.

Proof of Reserves vs Traditional Financial Audit

To understand the value of PoR, it helps to compare it with what already exists in traditional finance.

A traditional financial audit is conducted annually by an accredited audit firm. It covers the company’s entire balance sheet, including assets, liabilities, and equity. The result is a standardized IFRS or GAAP report read by analysts, investors, and regulators. This is a powerful tool — but with limitations: the audit captures the state at the end of the reporting period, takes months, and users receive aggregated data without the ability to verify their specific account.

Cryptographic proof of reserves addresses exactly the part of the problem that traditional audits do not cover: it allows any specific user to verify in real time that their balance is included in the aggregate reserves. And it relies not on trust in an auditor but on mathematics.

The optimal solution is a combination of both tools. This is how the most transparent platforms operate: cryptographic PoR for verifying customer balances plus traditional financial audit for the complete picture of company obligations.

Exchanges Using Proof of Reserves

After the FTX collapse, most major exchanges implemented some form of PoR. The transparency leaders publish PoR regularly and provide users with tools for independent verification.

Binance has published PoR since November 2022 through the Merkle Science platform and provides an interface for individual balance verification. Bybit and OKX have implemented similar self-verification tools through Merkle trees. Kraken has historically applied the strictest approach: regular audits involving independent firm Armanino, with results published on the website. Gate.io and Bitfinex are also among platforms with regular PoR.

Coinbase as a NASDAQ-listed public company undergoes a full financial audit under SEC requirements — which in some respects represents a higher standard than most crypto-specific PoR.

How Users Can Verify Proof of Reserves

Verifying proof of reserves does not require programmer-level technical knowledge. Most exchanges that have implemented PoR provide built-in tools.

Step by step: Go to the Proof of Reserves or Audit section on the exchange website. Find your balance in the published snapshot — usually by account ID or username. The exchange will provide your “Merkle path” — data for verification. Use the built-in verification tool or enter the data into an independent verifier (many PoR systems publish open-source code).

Check that the computed Merkle Root matches the officially published one. A match means: your balance is included in the stated reserves.

For those who want to go deeper: public blockchain addresses of the exchange can be checked in any block explorer (Etherscan, Blockchair) to confirm balances match the stated amounts.

Practical PoR Examples in Action

Binance. The largest exchange publishes monthly PoR broken down by each significant asset. Data is available on a dedicated page where users can enter their UID and receive proof of balance inclusion. As of January 2025, Binance showed a reserve ratio above 100% for all major assets — meaning assets exceed customer deposits.

Kraken. Historically one of the first exchanges to implement independent PoR auditing. Collaboration with Armanino included verifying not just address ownership but real-time balance correspondence.

Exchanges without PoR. An interesting detail: several major exchanges still do not publish PoR, or publish it in a format that does not support independent verification. For users, this is a signal: before entrusting funds to a platform, it is worth clarifying whether it conducts PoR and in what format.

The Role of PoR in the DeFi Ecosystem

Proof of reserves is critical not only for centralized exchanges. In the DeFi world, PoR solves a fundamentally important problem: verifying the collateral backing of tokenized assets.

Many DeFi protocols work with tokens supposedly backed by real assets — gold, dollars, BTC. Without PoR, users must trust the issuer’s word. With oracle-based PoR, a smart contract can automatically verify collateral in real time and react if reserves fall below the stated level. This opens the path to truly trustless decentralized finance.

Projects like wBTC (Wrapped Bitcoin) already use such mechanisms. As tokenization of real-world assets (RWA) grows, the role of automated PoR in DeFi will only increase.

Technical Nuances of PoR Implementation

Merkle Sum Tree. Beyond the standard Merkle tree (which proves inclusion of an element), a Merkle Sum Tree is often used for PoR. It allows proving not only that a user’s balance is in the tree, but that the aggregate sum of all leaves (customer balances) does not exceed stated reserves. This eliminates the possibility of “double counting.”

Negative balances. One non-obvious vulnerability of classic PoR: what if the exchange includes an account with a negative balance to artificially reduce the stated obligations? Modern Merkle tree implementations for PoR include checks for negative values.

Attestation vs Audit. An important distinction: attestation is the auditor confirming PoR was conducted and the mathematics are correct. Audit is a broader review including operational processes, internal controls, and regulatory compliance. The best PoR implementations combine both elements.

Future of Proof of Reserves

The industry is moving from snapshot PoR to continuous monitoring. Oracle networks, in particular Chainlink, are developing infrastructure for automatic, continuous reserve verification — eliminating the main limitation of traditional PoR.

Regulatory pressure is accelerating standardization. PoR is expected to move from “voluntary best practice” to a licensing requirement in most developed jurisdictions within the next few years.

In parallel, the use of ZK-proofs (zero-knowledge proofs) applied to PoR is growing. ZK-proof-of-reserves allows an exchange to prove solvency without disclosing any balance data — even aggregated — with a higher level of cryptographic assurance than classical Merkle Tree PoR. This is the next technological frontier several teams are actively developing.

Key Takeaways

• Proof of reserves crypto is a cryptographically verifiable confirmation that an exchange holds sufficient assets to cover all customer obligations; it is mathematically verifiable proof, not a promise.
• The mechanism rests on three elements: verifying ownership of blockchain wallets through cryptographic signatures, disclosing aggregate obligations through a Merkle tree, and (ideally) independent third-party auditing.
• The FTX collapse in 2022 was the main catalyst for widespread PoR adoption: trust in custodial exchanges cannot be built on reputation — it must be verifiable.
• Main limitations of PoR: snapshot nature (not continuous monitoring), failure to account for off-balance-sheet obligations, and dependence on auditor quality.
• Users can independently verify their balance through built-in exchange tools, requiring no technical knowledge.
• The future of PoR is continuous monitoring through oracle networks and ZK-proofs, alongside regulatory standardization under MiCA and other frameworks.

Expert Insight

Chainlink’s documentation on Proof of Reserves describes automated reserve verification as a critically important element of DeFi financial infrastructure: “Chainlink Proof of Reserves enables smart contracts to automatically verify that tokenized assets are backed by real reserves — reducing the risk of fractional reserves and establishing a new transparency standard for the entire ecosystem.”

The key word here is “automatically.” Traditional PoR requires trust in an auditor and is a snapshot check. Integrating oracle networks transforms PoR from a periodic check into continuous monitoring — which fundamentally changes the level of guarantees for users of DeFi protocols that accept tokenized assets.

Conclusion

Proof of reserves is not a panacea. It is a tool: powerful, mathematically sound, but with real limitations. An exchange with PoR is more reliable than one without — but PoR does not replace a full financial audit and does not guarantee the absence of other risks. Understanding this distinction means making more informed decisions about who to trust with your assets.