Proof of reserves is evidence, published by a crypto exchange, custodian or stablecoin issuer, that it holds enough assets to cover what its customers have on deposit. In its fuller form it has two halves: a proof of assets, showing the company controls wallets holding a given number of coins, and a proof of liabilities, showing the total it owes customers in each coin. Dividing one by the other gives a reserve ratio. The idea predates the 2022 failures: in 2011 Mt. Gox, then the largest bitcoin exchange, moved 424,242 BTC to an address announced in advance to show it had the coins, according to Vitalik Buterin's history of the technique. The crypto hub covers exchanges and custody more broadly.
How does proof of reserves work?
An exchange proves it controls certain wallets, totals what it owes customers in a tamper-evident list, and compares the two coin by coin at one point in time.
The asset side runs on the blockchain itself. Anyone can read the balance of a wallet address; the hard part is showing the exchange owns it. The usual methods are signing a message with the private key behind each address, moving coins at a pre-agreed time, or letting an auditor pick addresses at random and ask for proof of control. Cold storage makes this awkward, because every signature means bringing offline keys into use, which is one reason reports are periodic rather than continuous.
The liability side is harder, because customer balances live in the exchange's private ledger, not on-chain. Publishing a plain list would expose every customer's holdings, so exchanges commit to the list with a Merkle sum tree: each node carries a hash plus the sum of the balances beneath it, and the top node, the root, carries the total. The root is published; each customer receives the short branch needed to tie their own balance to it. How blockchain works explains ordinary Merkle trees, which use the same pairing of hashes without the sums.
How do you check your balance in a Merkle tree proof?
You hash your own account record, combine it with the sibling nodes the exchange sends you, and confirm the result matches the published root and total.
Worked example: A four-customer Merkle sum tree, worked
Four customers hold Ana 2.00 BTC, Ben 0.50 BTC, Caro 1.25 BTC and Dev 0.25 BTC. All figures are illustrative.
- Bottom layer: each leaf is a hash of the customer's ID, a secret salt and the balance, with the balance attached.
- Middle layer: Ana + Ben = 2.50 BTC; Caro + Dev = 1.50 BTC. Each node also stores a hash of the two nodes below it.
- Root: 2.50 + 1.50 = 4.00 BTC, published with the root hash.
- Caro's proof is two nodes: Dev's leaf (0.25 BTC) and the Ana + Ben node (2.50 BTC). She computes 1.25 + 0.25 = 1.50, then 1.50 + 2.50 = 4.00, recomputing each hash along the way.
- If her result matches the published root hash and the 4.00 BTC total, her balance was counted. If the exchange had left her out or understated her balance, it would not match.
- Asset side: signed proofs show wallets holding 4.20 BTC, so the reserve ratio is 4.20 ÷ 4.00 = 105%.
The proof's length grows with each doubling of the customer count, not with the count itself, so a tree of a million accounts needs only about 20 sibling nodes per customer. The scheme protects everyone only if many customers actually check, because an exchange could quietly omit accounts it expects nobody will verify.
What do attestations and audits of reserves cover?
Most reserve reports are attestation engagements with a narrow scope, and the PCAOB's investor advocate says none of them is an audit.
| Type of report | Who sets the scope | What it concludes | What it leaves out |
|---|---|---|---|
| Self-published cryptographic proof | The exchange | That its Merkle root and signed wallets add up | Any independent check of the ledger behind the tree |
| Agreed-upon procedures | Management chooses the steps | Factual findings from those steps only, with no opinion | Whether the steps were enough |
| Limited or reasonable assurance attestation | The practitioner, against criteria management selects | That a stated assertion, such as reserves at least equal liabilities on a date, is fairly presented | Other dates, other debts, and internal controls unless separately covered |
| Financial statement audit | The auditor, under auditing standards | That the company's full accounts are fairly stated | Real-time balances; it looks back over a reporting period |
The March 8, 2023 advisory adds that proof-of-reserve engagements fall outside PCAOB standards and inspection, that some are performed by firms that are not accountants, and that management decides how much of a report to publish. Whether crypto is safe on an exchange lists the advisory's warnings and what customers recover when a platform fails.
What does proof of reserves miss?
It misses anything outside the snapshot: debts other than customer balances, coins borrowed for the day, dollars at banks, and how assets are valued and controlled afterward.
- Other liabilities. A loan the exchange took out, or collateral it pledged, does not appear in a tree of customer balances, so a 105% ratio can coexist with insolvency.
- Borrowed or recycled coins. Assets borrowed just before the snapshot, or shuttled between firms that report on different days, can be counted more than once. Frequent proofs, or proofs on a schedule shared across exchanges, narrow this gap.
- Negative balances. A fake account with a negative balance shrinks the liability total. Merkle sum trees reject any node below zero, but a report that publishes only a total has no such check.
- Dollars and other off-chain assets. Bank cash and loans to affiliates can be confirmed only by trusting banks or accountants.
- Valuation. Reserves held in the exchange's own token can fall in value at the moment customers ask for their money.
- Time. Nothing stops coins leaving the day after the report, and nothing in it describes internal controls.
Worked example: Reserves that rest on the exchange's own token
An illustrative exchange owes customers $10 billion and reports $10.5 billion of assets, a ratio of 105%. Of those assets, $4 billion is its own token.
- Assets other than the token: $10.5 billion − $4 billion = $6.5 billion
- The token falls 80%, as FTX's FTT did on November 8, 2022: $4 billion × 0.20 = $0.8 billion
- New assets: $6.5 billion + $0.8 billion = $7.3 billion
- New ratio: $7.3 billion ÷ $10 billion = 73%
A report counting the token at its last trade overstated the cushion by the whole value the token could lose in a run.
What did FTX's collapse show about proof of reserves?
FTX showed that the gap usually sits on the liability side and in dollars, where a check of on-chain wallets cannot reach.
The timeline was short. On November 2, 2022, a news report said FTX's affiliated trading firm, Alameda Research, held a large position in FTX-linked tokens, according to the SEC's complaint. On November 6 a rival exchange said it would sell its FTT tokens and customers rushed to withdraw, and on November 7 FTX's founder posted that the exchange had enough to cover all client holdings, a claim the SEC later called false. On November 8 FTX paused all customer withdrawals and its FTT token fell about 80%; on November 11 it and about 100 affiliates filed for Chapter 11.
The debtors' June 26, 2023 report found that about $8.7 billion of customer assets had been misappropriated from FTX.com by the petition date, more than $6.4 billion of it in fiat currency and stablecoins. Customers' dollars had flowed through Alameda's bank accounts, and the report found no evidence of the regular reconciliation of customer balances that FTX had claimed. By August 2022, it said, executives privately estimated a fiat shortfall of more than $8 billion and booked a sham customer account showing the exchange was owed $8.9 billion. That entry worked like the negative leaf a Merkle sum tree is built to reject, but it sat in a private ledger no customer could test. FTX's founder was convicted of fraud and sentenced on March 28, 2024 to 25 years in prison. Custodial vs non-custodial wallets shows what one bitcoin left on FTX was worth in the bankruptcy.
How is proof of reserves different from proof of solvency, an audit or a stablecoin reserve report?
Proof of reserves covers assets and, in fuller versions, customer balances; proof of solvency adds every other debt, and an audit reviews the company's full accounts.
| Term | What it shows | Typical gap |
|---|---|---|
| Proof of reserves | Assets the company controlled at one moment, often set against customer balances | Other debts; time after the snapshot |
| Proof of liabilities | The total owed to customers, usually as a Merkle sum tree | Needs customers to verify; covers customer balances only |
| Proof of solvency | Assets at least equal to all liabilities | Rarely complete outside the crypto held on-chain |
| Financial statement audit | Full accounts for a period under auditing standards | Backward-looking, published months later |
| Stablecoin reserve report | Assets behind tokens whose supply anyone can count on-chain | Point-in-time; depends on the custodians of the cash |
Stablecoins invert the problem. Their liabilities are the tokens in circulation, so the hard work is confirming the bank deposits and Treasury bills behind them. Circle's September 2026 report, examined by an accounting firm, showed $73.96 billion of reserves against 73.88 billion USDC in circulation on September 30, 2026. From January 18, 2027, the GENIUS Act requires permitted US issuers to publish the makeup of their reserves monthly and to have a registered public accounting firm examine each report; the GENIUS Act guide covers the rule, and a stablecoin depeg is what tends to happen when holders stop believing a report.
Where do you see proof of reserves?
You meet it on exchange transparency pages, in stablecoin issuers' monthly or quarterly reserve reports, and in dashboards that track the published wallets of large platforms.
On an exchange page, look for the date of the snapshot, which coins are covered, whether liabilities are included and who checked the work. Exchanges that publish a Merkle tree generally let each customer download the proof for their own account to check against the published root, and the exchange's listed addresses can be read on any block explorer. USDC vs USDT compares how the two largest stablecoin issuers report, and the top stablecoins page tracks their supply, which is the liability side of those reports. On a decentralized exchange the question changes, because customer funds sit in public contracts rather than a company ledger; CEX vs DEX sets out that trade-off.