Understanding Proof-of-Reserves in Cryptocurrency

Proof-of-reserves (PoR) is a critical topic for anyone involved in cryptocurrency, as it relates to the trustworthiness of exchanges. This article explores what PoR entails, its implications for exchange transparency, and why it should not be seen as an absolute measure of a platform's financial health.

Key Takeaways:

What is Proof-of-Reserves? It's a method used to verify that an exchange holds the assets it claims for its users, utilizing cryptographic techniques.
Limitations of PoR: While PoR can indicate asset existence at a certain time, it does not confirm a platform's overall solvency or risk management.
Asset vs. Liability Checks: PoR primarily focuses on assets but often lacks comprehensive liability assessment.
Misinterpretation Risks: Users sometimes misinterpret PoR as an assurance of safety, when it is more akin to a snapshot rather than a full audit.
Need for Comprehensive Trust: Relying solely on PoR is inadequate; transparency must be accompanied by robust governance and clear risk disclosures.

What is Proof-of-Reserves?

At its essence, proof-of-reserves is a public affirmation that a custodian, such as a cryptocurrency exchange, possesses the assets it claims to manage for users. This confirmation usually employs cryptographic methods and ensures on-chain transparency.

However, if all exchanges can publish PoR reports, why do withdrawals still face issues during crises? The reality is that PoR does not guarantee trust. It merely indicates that verifiable assets are present on a platform at a specific moment, but it does not ensure that the platform is solvent, liquid, or governed by sufficient controls to prevent hidden risks. Even when done correctly, PoR often represents just a snapshot that may not capture events before or after the moment of reporting. Without a clear overview of liabilities, PoR fails to establish the solvency users require during times of withdrawal pressure.

Proof-of-Reserves Demonstration

Did you know? On December 31, 2025, Binance's CEO announced that the platform's user asset balances, verified through proof-of-reserves, reached $162.8 billion.

What PoR Demonstrates and Its Common Practices

In practical terms, PoR includes two primary evaluations: assets and, ideally, liabilities.

To show asset ownership, exchanges typically provide proof that they control certain wallets by publishing wallet addresses or signing messages.

Assessing liabilities, however, is more complex. Most exchanges take a snapshot of user balances and integrate this data into a Merkle tree, often referred to as a Merkle-sum tree. This method allows users to confirm their balance is included without disclosing everyone's balances publicly. When executed properly, PoR can confirm whether on-chain assets cover customer balances at a specific time.

Did you know? Binance allows each user to independently verify their balance within its PoR snapshot. By using its verification page, Binance generates a cryptographic proof from a Merkle tree of user balances, enabling users to confirm their account was counted without revealing any other data.

Why an Exchange Can "Pass PoR" Yet Remain Risky

While PoR can enhance transparency, it shouldn't be relied on as the sole indicator of a company's financial health.

A report revealing assets without a comprehensive view of liabilities does not establish solvency. Even if on-chain wallets seem strong, liabilities might be incomplete or defined selectively, often excluding factors such as loans, derivatives exposure, legal claims, or off-chain payables. This setup can indicate asset presence without confirming that the business can meet all its obligations.

Additionally, a single confirmation does not reflect what the balance sheet looked like in the past or future. Assets can be borrowed temporarily to present an improved snapshot and later returned. Furthermore, valuable information about encumbrances is often omitted. PoR does not typically indicate whether assets are collateralized, loaned out, or otherwise tied up, suggesting they may not be available when withdrawals surge.

Liquidity and valuation can also be misleading. Holding various assets doesn't equate to the ability to liquidate them promptly, particularly during market stress, especially if reserves are concentrated in low-liquidity tokens. Clarity around risk and liquidity disclosures could better address this issue.

PoR vs. Audits

A significant part of the trust problem stems from a mismatch in user expectations. Many users treat PoR as a safety certificate, but most PoR engagements resemble agreed-upon procedures (AUPs). In these scenarios, practitioners carry out specific checks and report findings without giving an overall health opinion on the company.

In contrast, audits are designed to provide assurance within a formal framework. AUP reporting is narrower, detailing what has been tested and observed while leaving interpretation to the reader. Under the International Standard on Related Services (ISRS) 4400, AUP engagements do not express an opinion.

Regulators have drawn attention to this gap. The Public Company Accounting Oversight Board has cautioned that PoR reports are inherently limited and should not be seen as definitive proof that an exchange possesses enough assets to meet its liabilities. This discrepancy prompted increased scrutiny of PoR in 2022, causing firms like Mazars to pause work with crypto clients due to concerns over the presentation and public perception of PoR reports.

Practical Approaches to Establish Trust

PoR can serve as an initial measure, but true trust comes from combining transparency with proof of solvency, robust governance, and clear operational controls.

Start with solvency. The key step is demonstrating that assets match a complete set of liabilities, ensuring assets equal or exceed liabilities. Solutions using Merkle trees for liability proofs, along with innovative zero-knowledge methods, strive to close the gap without disclosing individual balances.

Next, it’s vital to understand how the exchange operates. A snapshot fails to illustrate whether the platform adheres to disciplined controls like key management, access permissions, change management, incident response, and segregation of duties. That's why institutional due diligence often relies on System and Organization Controls (SOC) reports and similar frameworks that measure operational controls over time instead of just a point-in-time balance.

Visibility into liquidity and encumbrance is crucial. Just because a platform appears solvent on paper does not mean it will survive a run. Users require transparency around whether reserves are unencumbered and how quickly holdings can be converted into liquid assets during high-demand scenarios.

Lastly, anchor this approach in governance and disclosure. Credible oversight hinges on transparent custody frameworks, conflict management, and consistent disclosures for products that introduce additional financial obligations such as yield or margin lending.

Conclusion: PoR as a Supplement, Not a Replacement

While PoR is an improvement, it should not replace accountability. PoR merely provides a narrow, point-in-time verification, often marketed as a safety certificate.

When considering PoR as a sign of safety, users should ask themselves:

Are liabilities included, or is it assets only? Reporting solely on assets cannot show solvency.
What is included? Are margin, yield products, loans, or off-chain obligations part of the report?
Is the report a snapshot or ongoing? A single date can be manipulated; consistency is key.
Are the reserves unencumbered? “Held” assets are not necessarily available in stress situations.
What kind of engagement is it? Many PoR reports are limited and should not be interpreted as audit conclusions.

By understanding these factors, users can make more informed decisions regarding trust in cryptocurrency exchanges.