Proof of reserves is a way for a crypto exchange to show that it held enough assets to match customer balances at one moment in time. It usually combines a Merkle tree of customer balances with proof that the exchange controls certain wallets. It cannot prove solvency on its own, because it can miss debts, borrowed coins, fiat holdings and anything that changes after the snapshot.
Reserves are not the same as solvency
An exchange is solvent if its assets are worth more than everything it owes. Proof of reserves usually answers a narrower question: at this time, did the exchange control enough of these coins to cover customer balances in those coins?
That gap matters because a centralized exchange is custodial. Your account shows a number in the company's database, and the coins sit in wallets it controls. Proof of reserves is an attempt to make that promise checkable.
A full check has two halves:
- Proof of assets: what the exchange controls.
- Proof of liabilities: what it owes customers.
A claim of "$10 billion in reserves" covers only the first half. As Vitalik Buterin wrote in 2022, Mt. Gox moved 424,242 BTC to a pre-announced address in 2011 to show it controlled the coins. That proved control, but it said nothing about what customers were owed.
How a Merkle tree proves your balance is counted
A Merkle tree condenses a large list of data into one short fingerprint, called the root. Change any entry and the root changes. Exchanges use it to commit to customer balances without publishing the whole list.
Buterin's post describes a stronger version called a Merkle sum tree, in which each node also carries a running total. Here is a tiny example with four customers.
- Create leaves. Each customer's balance is hashed with a private account ID: Ana 20 BTC, Ben 50 BTC, Cho 10 BTC, Dev 20 BTC.
- Combine pairs. Ana and Ben's leaves combine into a node showing 70 BTC. Cho and Dev's combine into one showing 30 BTC.
- Reach the root. Those two combine into a root showing 100 BTC. The exchange publishes this root and total.
- Check inclusion. Ana receives her Merkle path: Ben's leaf and the 30 BTC node. She recomputes up to the root. If the fingerprint and the total match, her 20 BTC is counted in the 100 BTC.
Ana doesn't need anyone else's data. If the exchange had left her out or understated her balance, her check would fail.
A simple tree has a weakness, though. An exchange could add a fake account with a negative balance to shrink its total. Buterin's example is an exchange with 1,390 ETH of liabilities and 890 ETH of reserves that inserts a fake account at minus 500 ETH. A sum tree makes this detectable, but only if someone in the affected branch actually checks.
How to check your own balance
Each exchange has its own process, so follow its instructions. Kraken and Binance follow a similar pattern:
- Log in and open the proof-of-reserves or verification page.
- Choose the snapshot date.
- Note your record ID, Merkle leaf and the balances shown for that date.
- Compare those balances with what you actually held at that time.
- Check your leaf and path against the published root, ideally with an independent tool.
Success tells you one thing: your balance at that time was in the tree. It doesn't confirm the tree is complete, and it says nothing about later trades or out-of-scope assets.
How on-chain address attestations work
The assets half is where public chains such as Bitcoin help, since balances are visible to anyone. The exchange lists its wallet addresses and proves control, usually by signing a message with each wallet's key or by moving funds in a pre-announced way. Anyone can then add up those balances with a block explorer.
Three problems remain.
- Control isn't ownership. A signature shows someone had access to a key at that moment. Kraken's own page concedes the process can't prove exclusive possession of keys, since duplicates could exist.
- Coins can be shared. Buterin warned that exchanges could shuttle the same collateral back and forth to pass their reviews at different times.
- Cold storage complicates it. Signing with offline keys is costly and risky, which Buterin flags as a practical obstacle.
What zero-knowledge proofs add
A zero-knowledge proof lets an exchange prove a claim about its data without revealing the data. For liabilities, that fixes two weaknesses of a plain Merkle tree: leaked balances and fake negative accounts.
Binance added zk-SNARKs in February 2023. Its page says the circuit ensures that each account's total net balance is greater than or equal to zero, and that balances feed correctly into the claimed total.
This is a real improvement with a clear limit. As security firm OtterSec wrote about a similar design, "we cannot guarantee that all users were included in the ZK analysis." An exchange could prove a correct sum over an incomplete list. That is why the Merkle check still matters, and why it only works if users actually run it.
What proof of reserves doesn't show
| Blind spot | Why it matters |
|---|---|
| Debts outside the tree | Loans from lenders, unpaid bills and legal claims can make a firm insolvent even if customer coins are all there |
| Borrowed reserves | Coins borrowed for a day still appear in a wallet. Kraken says the process can't confirm funds weren't borrowed to pass the review |
| Pledged assets | Coins in a wallet may already be promised to a lender. Kraken says the process can't detect these hidden encumbrances |
| Asset quality | A large holding of the exchange's own token can look strong on paper and collapse in a crisis |
| Time | A snapshot says nothing about the next day. Kraken's latest published snapshot, as of November 2026, was dated June 30, 2026 |
| Fiat | Bank balances can't be proved cryptographically, so they rely on trust in banks and accountants |
| Scope | Reports may cover only some coins. Check the list of covered assets |
A ratio above 100% is therefore a narrow finding. Kraken reported 102.9% for BTC on its June 2026 snapshot. That is useful information about BTC reserves on that date, and it doesn't amount to a verdict on the company's solvency.
What FTX shows about the limits
FTX is why proof of reserves became a mainstream demand. It also shows where the method would have fallen short.
The SEC alleged in December 2022 that FTX customer funds were diverted to Alameda Research, Sam Bankman-Fried's trading firm, through a "virtually unlimited 'line of credit' funded by the platform's customers." Its complaint describes how: Alameda alone was allowed to carry a negative balance in its FTX account. That is close to Buterin's fake-account example, except it was real code applied to a real account.
The balance sheet CoinDesk reported showed the other weakness. Of Alameda's $14.6 billion in assets at June 30, 2022, $3.66 billion was "unlocked FTT" and $2.16 billion was "FTT collateral." FTT was FTX's own token. A token like that can look valuable on paper and fall fast when holders rush to sell, which is why a token's supply and liquidity matter as much as the headline number.
FTX's bankruptcy team later put what it owed customers at $8.7 billion, and reported about $6.4 billion of misappropriated customer funds held in fiat and stablecoins. A crypto-only review of on-chain wallets would not have seen fiat at all. Bankman-Fried was convicted, and in March 2024 he was sentenced to 25 years, with the judge finding that customers lost $8 billion.
Attestation vs audit: what Mazars taught everyone
"Audited" gets used loosely here, and the words have specific meanings.
| Report type | What the accountant does | What you get |
|---|---|---|
| Agreed-upon procedures | Runs steps agreed with the client and reports the results | Findings, with no opinion or assurance |
| Attestation | Reports on a specific claim, such as reserves on a date | Depends on the engagement; read the wording |
| Financial statement audit | Examines the company's financial statements under auditing standards | A formal opinion that covers assets and liabilities |
The Mazars episode shows why the wording matters. On December 7, 2022, Mazars published a report saying Binance controlled 575,742.42 BTC and was 101% collateralized in bitcoin as of November 22. Many read that as an audit. The report said otherwise: "the AUP engagement is not an assurance engagement. Accordingly, we do not express an opinion or an assurance conclusion."
Within days, Mazars paused its proof-of-reserves work for crypto clients, citing "concerns regarding the way these reports are understood by the public." Binance said it had approached several large firms, including the Big Four, which were unwilling to do such a review for a private crypto company.
In March 2023, the US audit regulator's investor advocate went further. The PCAOB advisory warned that these reports "do not provide any meaningful assurance," and that the procedures likely don't address liabilities. An audit isn't a guarantee against fraud either, but it is a broader examination.
Public companies are different. Coinbase, for instance, files annual reports with the SEC, which include audited financial statements. The same logic applies to stablecoin issuers: read what a report actually says before you rely on it.
A checklist for reading any proof of reserves
- Are liabilities included? Reserves with no customer total tell you little.
- Can you verify your own balance, and did you try it?
- Which assets are covered? Compare the list with what you hold.
- How old is the snapshot, and how often is it repeated?
- Are wallet addresses public, so you can check balances yourself?
- Who prepared it, and what does the report say about assurance?
- Does it rule out negative balances, through a ZK proof or otherwise?
- What makes up the reserves? Be wary of a large share in the exchange's own token.
- What does the company owe elsewhere? Look for audited statements or regulatory filings.
- Do you need to keep funds there at all? Moving to self-custody removes this risk and adds the risk of managing your own keys.
Rules on custody and customer protection vary by country, so check what applies where you live and ask a professional about significant sums. Our security coverage and cryptography guides go further into these topics.
Key takeaways
- Proof of reserves shows assets against customer balances at one moment. Solvency needs a full view of what a firm owes.
- A Merkle tree lets you confirm your balance was counted, but only you can run that check for your own account.
- Zero-knowledge proofs can rule out negative balances and protect privacy, but they don't prove every customer was included.
- Borrowed coins, pledged assets, outside debts and fiat are the main blind spots.
- FTX's hidden negative balance and reliance on its own token show why those blind spots matter.
- Mazars and the PCAOB both made the same point: these reports are not audits.
Sources
- Vitalik Buterin: Having a safe CEX: proof of solvency and beyond
- Kraken: Proof of Reserves
- Binance: Proof of Reserves
- SEC complaint against Samuel Bankman-Fried
- SEC press release on the FTX charges
- DLA Piper: summary of the PCAOB's proof-of-reserves advisory
- CoinDesk: Mazars pauses proof-of-reserves work
Get the weekly commit
New blockchain deep dives every week.
