A crypto exchange's Proof of Reserves (PoR) is a published audit showing the exchange holds at least as many assets as it owes to customers, verified using cryptographic Merkle tree proof. It emerged as a standard after the FTX collapse in November 2022 revealed an $8B customer-fund deficit. PoR is a meaningful safety signal, but not a guarantee of solvency — read why below.
How a Proof of Reserves Merkle Tree Audit Works
A Merkle tree is a data structure where every customer balance is a 'leaf' node. Each leaf is cryptographically hashed, and those hashes are combined up the tree until a single root hash represents the entire liability set. This structure has one key property: you cannot alter any individual balance without changing the root hash.
In a PoR audit, the process works like this: (1) The exchange compiles every customer balance into a Merkle tree and publishes the root hash. (2) Each customer receives a unique Merkle path — a set of sibling hashes they can use to verify their balance is included in the tree, without seeing anyone else's data. (3) An independent auditor confirms the exchange's on-chain wallet balances (assets) match or exceed the total liabilities represented by the tree root.
A customer who receives their Merkle path can run the verification themselves using open-source tools, confirming their balance is part of the audited total. This is what makes PoR more trustworthy than a simple statement from the exchange.
What Proof of Reserves Does NOT Prove
PoR is not a clean bill of health. There are several important limitations regulators, auditors, and critics have identified since the practice became widespread post-FTX.
It does not prove assets are unencumbered. An exchange could technically hold the assets shown in a PoR while simultaneously having pledged them as collateral for loans. The PoR snapshot would show the assets; it would not show the liability against them.
It does not prove the operating entity is solvent. FTX had attestations that appeared to show customer funds were present — the problem was that those funds had been lent to Alameda Research, FTX's affiliated trading firm. A PoR that includes only exchange wallets, not intercompany transfers, can miss exactly this failure mode.
It is a point-in-time snapshot. Assets could be moved into wallets the day before an audit and moved out the day after. Frequent audits (monthly or quarterly) reduce but do not eliminate this risk.
It does not cover all asset types equally. On-chain assets like BTC and ETH are straightforward to verify. Stablecoins, tokenised assets, or off-chain fiat reserves require additional attestations that not all PoR reports include.
This is information, not financial advice. No audit standard eliminates counterparty risk entirely — diversify custody and only hold on exchange what you intend to trade.
Which Exchanges Publish Proof of Reserves Audits
Following the FTX collapse, several major exchanges moved quickly to publish PoR audits. The quality, frequency, and auditor independence vary considerably.
Kraken has published regular Proof of Reserves reports using Merkle tree verification since 2022, audited by third-party accountancy firms. Kraken's reports include both assets and liabilities, which is considered best practice.
Coinbase, as a publicly listed company in the United States, is subject to SEC reporting requirements that include independent financial audits — a higher standard than a standalone PoR, though structured differently.
OKX publishes monthly PoR reports covering major assets using Merkle tree verification, with results available on-chain for independent verification.
Binance publishes PoR data with Merkle tree proof and has engaged external auditors. Note that Binance's regulatory status varies by jurisdiction — check the regulator in your country before depositing.
Not all exchanges publish PoR. Absence of a PoR audit is not proof of insolvency, but it is a due-diligence gap. Always check what the most recent audit covers, who conducted it, and when it was published.
What to Look for in a PoR Audit
Not all Proof of Reserves reports are equal. When evaluating a PoR audit, ask these questions before treating it as a meaningful safety signal.
- Who is the auditor? An independent, named accounting firm adds credibility. An internal attestation signed only by the exchange carries much less weight.
- Does it include liabilities? A reserve report that shows assets but not customer liabilities cannot confirm a 1:1 ratio. Best-practice reports show both.
- Is it a full Merkle tree audit or just an attestation? A Merkle tree audit lets you verify your own balance is included. A simple attestation is just the exchange's word.
- How frequently is it published? Monthly or quarterly is meaningful. An annual report can be stale. Check the date on any report you rely on.
- Which assets are covered? BTC and ETH are easiest to verify on-chain. If the exchange holds significant customer funds in stablecoins or fiat, check whether those are separately audited.
- Is the report still current? Exchanges have published PoR reports and then stopped. Confirm the exchange maintains an ongoing audit programme, not a one-time publication made under post-FTX pressure.
Frequently asked questions
Did FTX have Proof of Reserves before it collapsed?
FTX did not publish a formal Merkle tree PoR audit before its November 2022 collapse. It had circulated an informal balance sheet that was later shown to be inaccurate and excluded critical liabilities, including funds lent to affiliated trading firm Alameda Research. The FTX collapse is the primary reason the industry moved toward formal PoR audits — but it also illustrates why PoR is a floor, not a ceiling, for due diligence.
Can I personally verify my balance is included in a PoR audit?
Yes, if the exchange uses a Merkle tree audit. The exchange provides you with your personal Merkle path — a set of cryptographic hashes — and you can use open-source verification tools (typically provided by the auditor or the exchange itself) to confirm your balance is included in the published root hash. This does not require trusting the exchange's word; the mathematics is independently verifiable.
Is Proof of Reserves the same as an official financial audit?
No. A PoR audit is narrower in scope — it verifies that on-chain assets match customer deposit liabilities at a point in time. A full financial audit (as required of publicly listed companies) covers the entire entity: revenue, expenses, debts, intercompany relationships, and operational liabilities. Exchanges that are publicly listed, like Coinbase, are subject to full audit standards. A PoR alone does not provide that level of assurance.
Should Proof of Reserves be the main factor when choosing an exchange?
PoR is one useful signal among several. Regulatory authorisation in your jurisdiction, the exchange's track record, insurance coverage, withdrawal history during market stress, and fee structure all matter. An exchange with a strong Tier 1 regulatory licence (FCA, ASIC, MAS) and regular PoR audits offers more combined assurance than PoR alone. Treat PoR as a minimum hygiene standard, not a recommendation by itself. This is information, not financial advice.
Sources & further reading
An independent publisher mapping the regulation of cryptocurrency exchanges. Our editorial desk verifies every licence and availability claim against primary sources — the ESMA MiCA register, the FCA register, ASIC, MAS, VARA and each exchange's own terms — and never accepts payment for a better assessment or placement. We publish information only; nothing here is financial advice.