'Proof of Reserves' Sounds Like a Guarantee Your Exchange Has Your Coins. It Isn't. Here's What It Misses
6 min read
Loading...
6 min read
An exchange posts a page that says "Proof of Reserves: passed." You feel a bit safer. But what did it actually pass?
Proof of reserves is a report that shows an exchange holds a pile of coins on the blockchain. It is meant to show the pile is big enough to cover what customers have deposited. That is useful. It is also much weaker than the word "proof" suggests, and this post explains why.
A crypto exchange keeps your coins in wallets it controls. You see a balance on screen. The exchange owes you that balance.
Proof of reserves tries to answer one question: does the exchange hold at least as many coins as it owes?
It has two halves:
If the first number is at least as big as the second, the report "passes."
You cannot publish everyone's balance. That would expose private data. So exchanges use a tool called a Merkle tree.
Here is the idea in one paragraph. Each customer's balance is turned into a short code, called a hash. Pairs of codes are combined into new codes, again and again, until one code is left at the top. That top code is the Merkle root. It locks in every balance. If anyone changes a single balance, the root changes.
Now a made-up example. Four customers hold these amounts of Bitcoin on a small exchange:
| Customer | Balance (BTC) |
|---|---|
| A | 5 |
| B | 3 |
| C | 2 |
| D | 10 |
| Total owed | 20 |
The exchange publishes the Merkle root and the total of 20 BTC. Customer B can ask for a small proof. It lets B check that their 3 BTC is inside the total, without seeing anyone else's balance.
Then you look at the exchange's published wallets. They hold 20 BTC. The report passes.
Now add one fact the report does not show. The same exchange borrowed 8 BTC from a lender and has not repaid it.
Its real obligations are 28 BTC: 20 owed to customers plus 8 owed to the lender. Its wallets hold 20. It cannot pay everyone.
The report still says "passed." Nothing in a basic proof of reserves lists loans, or money owed to other firms. This is the point critics keep making. A Merkle-tree report proves the exchange holds coins that match user balances at one moment. It does not prove the exchange is solvent. (Solvent means it owns more than it owes.)
Two more limits sit on top of that:
The idea is old. Kraken ran an early Merkle-tree audit in 2014. In February 2022, Kraken announced a new one, done by the accounting firm Armanino. According to Kraken's announcement, it covered Bitcoin and Ether only, out of more than 100 assets on the platform (Business Wire, 3 February 2022).
Then FTX collapsed in November 2022. Public filings and reporting after the bankruptcy pointed to a customer funds shortfall of roughly $8 billion, with customer money lent to its sister trading firm, Alameda Research (per press summaries of the case, including TokenTax's guide to the collapse). Exchanges rushed to publish reserves reports in response.
Binance published one for Bitcoin. Reports at the time said it showed 582,485 BTC in reserves against 575,742 BTC owed to users, a 101% ratio. The report came from the audit firm Mazars.
Then, in mid-December 2022, Mazars paused all its proof-of-reserves work for crypto clients. It said this was due to "concerns regarding the way these reports are understood by the public." It also took down the Binance report. In March 2023, the US audit regulator, the PCAOB, warned investors not to rely on proof-of-reserves reports from crypto companies as a sign of financial health.
We read these events in search summaries of the original articles, because several of the original pages could not be opened when we wrote this. Check the primary sources before you quote any figure.
A full audit looks at both sides. It would ask:
Item 4 matters a lot. The FTX problem was not only a missing pile of coins. It was customer money used for other purposes. A wallet count alone cannot see that.
You do not need to be an auditor. Ask five short questions:
If a report cannot answer these, treat it as marketing, not as a guarantee.
Two related risks are covered in other posts. Exchange insurance claims look protective but have caps. And keeping coins on an exchange versus in your own wallet is the bigger choice behind all of this.
You cannot make an exchange prove everything. You can decide how much you leave there.
Open your Holdings page on NetWort and look at how much of your portfolio is in crypto, such as Bitcoin or Ether. That share is the amount you are trusting to someone else's wallets. Seeing the number is the first step to deciding if it is the right size for you.