Proof of Reserves Explained: How to Check Whether an Exchange Really Holds User Assets

An exchange’s proof of reserves can help users confirm whether the platform holds on-chain assets that correspond to customer balances. However, it is not a full financial audit and cannot, on its own, prove that an exchange has no hidden liabilities. When reviewing an exchange’s reserves, check user balances, platform wallets, reserve ratios, snapshot timing, and the report’s scope together.

What Is Proof of Reserves?

Proof of reserves is a disclosure and verification mechanism used to determine whether a cryptocurrency custodian holds customer assets.

A reasonably complete exchange proof-of-reserves report normally includes two components:

• Reserve assets: on-chain wallets controlled by the exchange and the assets held in them;
• User liabilities: account balances that the exchange owes to all users.

From an exchange’s perspective, the Bitcoin, Ether, and stablecoins in user accounts are liabilities owed to users. A reserve ratio of at least 100% is achieved only when verifiable reserve assets are no less than the corresponding user liabilities.

The basic reserve-ratio formula is:

Reserve ratio = verifiable platform assets ÷ user account balances × 100%

For example, if users collectively hold 10,000 BTC on a platform and the exchange can prove that wallets under its control hold 10,500 BTC, the reserve ratio is 105%.

This only describes the coverage of specified assets at a particular snapshot time. It does not guarantee that withdrawals will continue to operate normally in the future.

How Does Proof of Reserves Work?

An exchange proof-of-reserves report is typically generated through the following process:

1. Record all user balances at the snapshot time;
2. Anonymize user identities and balances with hashes;
3. Add the user balances to a Merkle tree;
4. Publish the Merkle root representing all user data;
5. Provide wallet addresses controlled by the platform;
6. Prove control of the wallets through signatures or test transactions;
7. Compare on-chain reserves with user account balances;
8. Allow users to verify that their balances were included in the calculation.

Some exchanges also use zero-knowledge proofs to demonstrate that the balance aggregation process follows predefined rules without disclosing each user’s exact balance.

What Is Merkle Tree Proof of Reserves?

A Merkle tree is a data structure that condenses a large data set into a single hash.

In an exchange proof-of-reserves system, each user’s anonymized account identifier and balance form a leaf node at the bottom of the tree. Adjacent nodes are repeatedly combined and rehashed until they produce the Merkle root at the top.

If any user’s balance changes, the related nodes and Merkle root also change. Using their Merkle leaf and verification path, users can confirm whether their account balances were included in the liabilities published by the exchange.

The main purposes of a Merkle tree include:

• Enabling verification without disclosing other users’ balances;
• Preventing arbitrary changes to data after a snapshot is created;
• Allowing users to confirm that their balances were counted;
• Reducing privacy risks associated with publishing a complete customer list.

A Merkle tree only proves that particular data was included in a snapshot. It does not automatically prove that the exchange disclosed every account, or that the on-chain assets were not pledged or borrowed.

How to Verify an Exchange’s Reserves

Step 1: Confirm That the Reserve Page Uses the Official Domain

Do not access a proof-of-reserves page through a social media direct message or search advertisement. Navigate to it from the security, transparency, or proof-of-reserves section of the exchange’s official website.

Stop immediately if the page asks for a password, verification code, private key, or seed phrase. A legitimate reserve verification process will never require your private key.

Step 2: Check the Report Date

Proof of reserves typically reflects conditions at one specific point in time. The older the report, the less it can say about the platform’s current asset position.

Check whether the page provides:

• The snapshot date and exact time;
• The corresponding block height;
• The report publication date;
• Historical reports;
• A fixed update schedule.

If an exchange released proof of reserves only once during a market crisis and has not updated it for a long time, the report’s usefulness is substantially reduced.

Step 3: Check the Asset Coverage

Do not look only at the “total reserve ratio.” Confirm that the assets you hold are covered by the report.

For example, an exchange may verify only Bitcoin, Ether, and selected stablecoins while excluding exchange tokens, small-cap tokens, earn accounts, or derivatives accounts.

Key points to check include:

• Whether spot accounts are included;
• How derivatives and margin accounts are calculated;
• Whether earn and staking assets are included;
• How negative balances created by lending are handled;
• Whether each asset has individually reached 100% coverage;
• Whether the same stablecoin on different blockchains is fully counted.

Step 4: Verify Your Own Account Balance

After signing in to the exchange, locate the snapshot record, Merkle leaf, record identifier, or verification button on the proof-of-reserves page.

Check whether the assets and balances shown in the snapshot match your account records at that time. If you held an asset on the snapshot date but the system says there is no verification record, contact the platform for clarification.

Step 5: Check the Exchange’s Wallet Addresses

The reserve report should provide the platform’s wallet addresses or allow users to download a corresponding wallet-address file.

Copy each address into the appropriate blockchain explorer and check:

• Whether the address balance matches the report;
• Whether you are viewing the correct network;
• Whether the block height corresponds to the report snapshot;
• Whether the wallet shows unusual large transfers in or out around the snapshot;
• How the exchange proves that it controls the address.

Publishing a single wallet address is not sufficient because exchange assets may be distributed among multiple hot wallets, cold wallets, and custodial addresses.

Step 6: Confirm Control of the Wallets

Blockchain addresses are publicly visible, but the presence of assets at an address does not prove that the exchange publishing the report controls those assets.

An exchange can prove wallet control by:

• Signing a specified message with the wallet’s private key;
• Sending a specified test amount from a reserve address;
• Having an independent verification firm confirm control of the addresses.

When checking wallet control, verify that the evidence covers all major addresses in the report rather than only one wallet.

Step 7: Check the Reserve Ratio for Each Asset

Compare the reserve ratios for Bitcoin, Ether, and stablecoins separately instead of relying only on the total asset value calculated in US dollars.

For example, an exchange may hold a large amount of its own token, making the total asset value exceed aggregate user balances even when stablecoin reserves are insufficient. During market volatility, a falling exchange-token price could rapidly weaken the platform’s ability to meet its obligations.

A more useful report should publish:

• User balances for each asset;
• Platform reserves for each asset;
• The corresponding reserve ratio;
• Wallet addresses and networks;
• The calculation methodology and report scope.

How Can You Judge Whether Proof of Reserves Is Credible?

You can assess it from the following eight perspectives:

If an exchange refuses to disclose user liabilities and only displays a few wallets with large balances, this is closer to an “asset showcase” than a complete proof-of-reserves report.

What Can Proof of Reserves Not Prove?

It Cannot Prove That the Platform Has No Hidden Liabilities

An exchange may have bank loans, over-the-counter borrowing, affiliated-company debt, legal liabilities, or other obligations that are not included in the Merkle tree.

It Cannot Prove That the Assets Are Unencumbered

Assets in a wallet may already have been pledged as collateral for a loan or may be subject to another institution’s claims. Looking only at blockchain balances generally cannot reveal these legal and financial relationships.

It Cannot Rule Out Temporarily Borrowed Assets

A platform could temporarily transfer assets in before a snapshot and move them out after the report is completed. Continuous reporting and real-time wallet monitoring can reduce this risk, but cannot eliminate it.

Kraken also explicitly describes such limitations in its reserve documentation, including that proof of reserves cannot identify hidden encumbrances or prove that assets were not temporarily borrowed to pass an inspection. Read about proof-of-reserves limitations

It Cannot Replace a Full Financial Statement Audit

The U.S. Public Company Accounting Oversight Board warns that proof-of-reserves reports have inherent limitations and that investors should not rely on them alone to determine whether a platform has enough assets to repay all customer liabilities. Read the regulatory risk advisory

It Cannot Guarantee That Future Withdrawals Will Work Normally

Proof of reserves reflects a historical snapshot. A hack, poor investment, affiliated-company loss, or concentrated wave of withdrawals can change a platform’s financial position after the snapshot.

What Warning Signs Should You Watch for in Proof of Reserves?

• The report has not been updated for a long time;
• The page publishes only total assets and does not disclose user balances;
• Users cannot verify that their individual accounts were included;
• Reserve ratios for major assets are below 100%;
• A large share of reserves consists of the platform’s own token;
• Wallet addresses lack proof of control;
• The reserve report suddenly disappears after market volatility;
• The audit or verification firm ends its engagement;
• Unusual large transfers occur before or after the report date;
• The platform is simultaneously delaying or restricting withdrawals.

One issue alone does not necessarily mean an exchange is insolvent. However, if opaque reserves, abnormal withdrawals, and management turmoil occur together, reducing your exposure to assets held on the platform should take priority.

Frequently Asked Questions

Is an Exchange Absolutely Safe If Its Reserve Ratio Reaches 100%?

No. A 100% reserve ratio only indicates that the assets covered by the report had corresponding asset support at a specific snapshot time. It cannot rule out hidden debt, encumbered assets, hacking, or incomplete report coverage.

Can Merkle Tree Proof of Reserves Show Other Users’ Balances?

No. Users can normally verify only their own balance and corresponding verification path. They cannot see other users’ identities or complete account details.

Is an Exchange Without Proof of Reserves Necessarily Unsafe?

Not necessarily. Some regulated or publicly listed platforms may provide transparency through audited financial statements, regulatory capital reports, and custody disclosures rather than user-level Merkle tree verification.

What Is the Difference Between Proof of Reserves and an Audit?

Proof of reserves primarily checks specified assets, user balances, and wallet control. A complete financial audit also examines debt, revenue, expenses, internal controls, related-party transactions, and other assets and liabilities.

Do Users Need to Run Verification Code Themselves?

Most users can use the verification page provided by the exchange to confirm their Merkle record. Technically proficient users can also download open-source tools and independently calculate the Merkle leaf and verification path.

How Can You Verify That an Exchange Really Controls Its Reserve Wallets?

Check whether the exchange provides a wallet signature, a test transfer of a specified amount, or independent confirmation of address control. Address labels and wallet balances alone do not fully establish control.