Crypto Gloss

Proof of Reserves

Proof of Reserves (PoR) is a cryptographic auditing method for cryptocurrency exchanges, lending platforms, and custodians. It answers the question that FTX’s collapse made impossible to ignore: Does the exchange actually hold the crypto it claims to hold on behalf of customers? PoR uses Merkle tree data structures to allow exchanges to prove total customer liabilities match on-chain assets — and allow individual custoners to verify their specific balance is included — without exposing all customer data publicly. After FTX’s $8B+ customer fund misappropriation became public in November 2022, PoR adoption across major exchanges accelerated dramatically.

The Problem PoR Solves

Traditional exchange opacity:

Centralized exchanges hold customer funds in pooled wallets. There is no mechanism for customers to verify their specific BTC/ETH/USDC is actually held 1:1 on their behalf. Exchanges can, and have:

  • Fractional reserve: Hold less than 100% of deposits (bank run risk)
  • Rehypothecation: Lend customer funds without disclosure
  • Outright fraud: Use customer deposits for proprietary trading, expenses, or theft

FTX’s failure mode:

FTX transferred ~$8B of customer deposits to Alameda Research (its sister trading firm) to cover trading losses. Customers had no mechanism to detect this until it was too late.

How Proof of Reserves Works

The following sections cover this in detail.

Step 1: On-Chain Holdings Verification

The exchange signs a message with their private key associated with their wallets:

  1. Exchange publishes list of all custody wallet addresses
  2. Third-party auditor (or anyone) verifies total on-chain balance: ?(balances) = claimed total holdings
  3. The cryptographic signature proves the exchange controls these addresses

Example: Binance publishes 300 hot/cold wallet addresses holding 570,000 BTC ? blockchain data confirms this

Step 2: Customer Liability Merkle Tree

The harder challenge: proving total customer balances equal claimed holdings.

Merkle Tree structure for PoR:

  1. Each leaf node = one customer’s balance (anonymized: hashed customer ID + balance)
  2. Each parent node = hash of two children
  3. Root node = Merkle Root (single hash representing ALL customer balances)
  4. Total liabilities = sum of all leaf-level balances, provably committed in the Merkle Root

Individual verification:

  1. Exchange provides you your “Merkle path” — the specific branches from your leaf to the root
  2. You verify: your balance is included in the commitments that produce the Merkle Root
  3. You cannot see other customers’ balances (privacy preserved at leaf level)

What this proves:

  • Assets = Liabilities: Holdings = Sum of all customer balances in the Merkle tree
  • Your balance specifically is included in the calculation

Step 3: Third-Party Attestation

Typically a public accounting firm (Hacken, Mazars, Armanino) attests:

  • They verified the on-chain holdings
  • They verified the Merkle tree construction (no customers were omitted, no negative balances)
  • Point-in-time statement: assets = liabilities at a specific timestamp

Limitations of Proof of Reserves

What PoR does NOT prove:

  1. No snapshot gaming: Exchange could borrow BTC, do PoR, return BTC after — assets and liabilities both clear at moment of audit but don’t reflect normal operations
  2. No liabilities coverage beyond balances: PoR proves crypto is held but doesn’t verify the exchange has no debt that would subordinate customer claims in bankruptcy
  3. Full asset ? full liability picture: Fiat deposits, derivatives exposure, operational liabilities not captured
  4. Single point in time: PoR is not continuous — balances between audits are unknown
  5. Not a full audit: PoR is a specific attestation, not a comprehensive financial audit per GAAP/IFRS

Mazars and Binance:

Mazars issued PoR attestations for Binance in late 2022, then suspended the crypto PoR practice — citing that the public didn’t understand the scope limitations. This highlighted the gap between PoR’s promise and what it actually guarantees.

Exchanges With Proof of Reserves

After FTX (November 2022), major exchanges rushed to publish:

  • Binance: Merkle tree PoR on a rolling basis; Hacken attestation
  • Kraken: Longest-running PoR since 2014 (Merkle tree)
  • OKX: Merkle tree PoR; Hacken attestation
  • Bybit: Merkle tree PoR
  • Coinbase: Listed company with SEC filings; doesn’t use PoR per se but public financial statements

Notably absent at time of FTX:

FTX’s “proof of reserves” was an Alameda-prepared balance sheet — not a proper Merkle tree PoR. The distinction matters.

Zero-Knowledge PoR (Advanced)

ZK-proof-based PoR extends the guarantees:

  • ZK-SNARK PoR: Exchange proves solvency (assets = liabilities) in zero-knowledge without revealing any customer data even to auditors
  • Benefits: Better privacy (not even auditor sees customer data), more easily automatable
  • Complexity: Requires ZK circuit engineering; early implementations (Summa by Privacy & Scaling Explorations) in 2023-2024

Industry Context

Regulatory developments:

  • Singapore’s MAS requires PoR for VASPs
  • US bipartisan bills proposed requiring exchange PoR reporting
  • EU MiCA guidelines include a custody attestation requirement
  • NYDFS requires regulated custodians to maintain 1:1 asset backing

Social Media Sentiment

Post-FTX, PoR has become expected exchange practice and CT now scrutinizes exchanges that don’t publish it. Debates continue about PoR limitations — snapshot gaming, missing liability data — but Kraken’s long-standing PoR is widely cited as the industry standard. Mazars’ withdrawal from crypto PoR work is still referenced as a trust gap.

Last updated: 2026-04

Related Terms

Sources

Todd, P. (2014). Proving the Existence of Non-Zero Net Worth With A Merkle Tree. Peter Todd Blog.

Bunz, B., Agrawal, S., Zamani, M., & Boneh, D. (2020). Provisions: Privacy-Preserving Proofs of Solvency for Bitcoin Exchanges. ACM CCS.

Nakamoto, S. (2008). Bitcoin: A Peer-to-Peer Electronic Cash System. bitcoin.org.

Zeng, F., & Zhang, L. (2023). FTX Collapse: Systemic Risk, Contagion, and Lessons for Exchange Governance. SSRN.

Shen, D. W., Urquhart, A., & Wang, P. (2020). Does the introduction of futures improve the efficiency of Bitcoin? Finance Research Letters.