Exchange proof of reserves: what it proves — and what it doesn't

In the thirteen months since FTX collapsed, proof of reserves has gone from a niche cryptographic exercise to a fixture of exchange marketing. Binance published a Merkle-tree attestation within weeks of the bankruptcy filing; OKX committed to monthly snapshots; Kraken could fairly point out that it ran a proof-of-reserves audit back in 2014, when the wound being treated was Mt. Gox. If you keep coins on any major exchange today, there is a page somewhere inviting you to verify your assets — and by most accounts, very few depositors ever click it.

This article is not a sneer at that page. It represents real progress over the pre-FTX standard, which was nothing at all. But it is worth much less than the confidence it tends to produce. Proof of reserves is a public demonstration that an exchange controlled specific on-chain assets at a specific moment in time. It cannot demonstrate the one thing a depositor actually wants to know: whether the exchange owes more than it holds. Solvency is a property of both sides of a balance sheet, and the attestation photographs only one.

Why every exchange suddenly has a proof-of-reserves page

FTX did not fall to a hack or a market crash. Its customer shortfall — widely reported at roughly $8 billion — was a liability problem: obligations to depositors that the assets on hand could not cover, discovered only when withdrawal requests surged. When the exchange filed for bankruptcy in November 2022, every competitor faced the same question overnight: how do we show we are not FTX? A Merkle-tree attestation was the fastest credible-looking answer, and within weeks it was an industry norm. We looked at what that collapse taught depositors last month, in what “not your keys” means in practice.

The skepticism arrived almost as quickly as the attestations. Mazars, the accounting firm that produced early reports for several large exchanges, paused its crypto proof-of-reserves work in December 2022 and withdrew the reports it had already published — a widely reported retreat, driven by concern that the public was reading far more assurance into the documents than the procedures behind them could support. When the firm signing the reports worries they are being over-read, the rest of us should take the hint.

How a Merkle-tree proof of reserves works

The mechanism is genuinely elegant, which is part of why it persuades. On a chosen snapshot date, the exchange records every customer balance. Each balance is hashed — reduced to a short digital fingerprint — and becomes a leaf of a tree. Leaves are hashed together in pairs, then the pairs are hashed in pairs, and so on until a single value remains: the Merkle root. Publishing that root commits the exchange to every balance underneath it, without revealing any individual account.

Two checks then become possible. You, as a customer, receive a record ID and can verify that your balance was included in the tree — if it had been omitted or shrunk, the arithmetic would never reach the published root. And the exchange demonstrates control of on-chain addresses, usually by signing messages with the corresponding keys, showing that at the snapshot moment it held at least as much as the tree's total. Counted customer balances on one side, visible assets on the other: if the second covers the first, the attestation succeeds.

What it genuinely proves

Credit where due. A well-run attestation establishes three things. First, that your balance was counted: if enough customers verify their own leaves, systematically under-reporting obligations to customers becomes hard to hide. Second, that the exchange had access to keys controlling real on-chain assets at the snapshot moment — not a screenshot, not a spreadsheet, but signatures anyone can check. Third, when the exercise repeats on a fixed schedule, it imposes a recurring cost on fraud: a hole in the books has to be papered over again every month, not once.

None of that is trivial. Kraken's 2014 exercise, run in the shadow of Mt. Gox, was built on the same insight: an exchange that can be checked, even partially and occasionally, is meaningfully safer than an exchange that simply asks to be believed. Proof of reserves shrinks the amount of trust an exchange demands. It does not eliminate it — and the gap between those two is where the trouble lives.

The four things it cannot prove

Every limitation below is structural. None of them requires assuming any particular exchange acts in bad faith; they are simply what the mathematics does not cover.

1. That the assets weren't borrowed. The attestation is a photograph, and photographs can be staged. Coins can arrive the day before the snapshot, pose for the camera, and leave the day after. A monthly attestation proves twelve instants a year; between instants, nothing. Window-dressing a reporting date is one of the oldest maneuvers in finance, and a snapshot regime invites it.
2. That there are no hidden liabilities. The Merkle tree contains the customer balances the exchange chose to include. Loans from market makers, obligations to affiliates, margin owed to trading desks, legal claims — none of these live on-chain, and none appear in the tree. FTX's failure had exactly this shape: the fatal numbers were never on a list of assets. They were liabilities nobody outside could see.
3. That key control is exclusive. Signing a message with an address proves access to a key at that moment. It does not prove the exchange is the only party with that access, that the keys are not shared with an affiliated trading firm, or that the same coins are not pledged as collateral somewhere off-chain.
4. That anyone stands behind the numbers. Most attestations are agreed-upon-procedures engagements: a firm performs a fixed list of steps and reports what it observed. That is not an audit, carries no opinion on financial health, and usually says so in fine print almost nobody reads. Mazars' withdrawal was, in effect, the fine print standing up and leaving the room.

A proof of reserves without a proof of liabilities is a photograph of one side of a balance sheet.

How to read an attestation like a skeptic

If you keep a balance on an exchange — and if you trade actively, you almost certainly do — the practical question is not whether the mechanism is perfect but how much weight to put on the attestation in front of you. A few questions separate serious efforts from theater:

• Does it address liabilities at all? An attestation that pairs the asset snapshot with an independent attempt to enumerate obligations is categorically stronger than assets alone.
• Is it regular? A standing monthly cadence is harder to stage than a one-off event announced mid-crisis.
• Are the addresses published? Reserves you can watch between snapshots beat reserves revealed only on photo day.
• Is the verifying firm named, and is its report public? "Verified by a leading firm" with no document attached is marketing.
• Did you check your own leaf? The scheme constrains an exchange only if a meaningful number of customers actually verify inclusion. Take the five minutes.

Every box ticked still adds up to less than a solvency guarantee. It adds up to an exchange that has made lying more expensive — which is worth something, and is also the ceiling.

Self-custody is a proof of reserves that never goes stale

There is one arrangement in which reserves are provable continuously, hidden liabilities are impossible by construction, and no accounting firm is involved: coins at an address whose keys only you control. Every node on the network re-verifies that balance with every block. The reserve ratio is exactly 1:1 forever, because there is no intermediary balance sheet to drift. Self-custody is not a snapshot of solvency; it is the absence of the question.

The same verify-don't-trust standard applies to wallet vendors, and this year users showed they understood that — the reaction we examined in the Ledger Recover backlash was depositor-grade skepticism arriving at the hardware wallet's door. It is a standard we invite. Ownbit's secure self-custody keeps keys on your device and never on our servers, every key is a standard BIP39 seed phrase, and recovery works without our infrastructure. For balances that deserve more than one key, MultiSig spreads control across several seed phrases behind an M-of-N threshold, and the multisig contracts are open source — the point, throughout, is that you can check the claims rather than believe them.

None of this makes exchanges useless. If you trade, you need an order book, and a working balance will live on one; a credible proof of reserves genuinely makes that balance safer than it was before FTX. The mistake is treating the attestation as a reason to keep everything there. Size the exchange balance to your trading, and keep the rest where the chain itself is your auditor.

Frequently asked questions