Proof of reserves: what an exchange's audit does and doesn't prove
After several large exchanges collapsed with customer funds missing, "proof of reserves" became the industry's answer. Many exchanges now publish one: a report, a dashboard or a set of addresses meant to show that customer deposits are really there.
It's a genuine step forward. It's also easy to read more into it than it says. Here's what a proof of reserves actually demonstrates — and the gaps it leaves open.
The basic idea
An exchange holds your coins in its own wallets and records your balance in its own database. You can't see either directly. The worry is simple: has it quietly lent, lost or spent the coins it says it's holding for you?
A proof of reserves tries to answer that in two halves:
- Assets. The exchange shows it controls certain on-chain addresses, usually by signing a message with their keys or moving funds in a pre-announced way, and anyone can add up the balances on the chain.
- Liabilities. The exchange commits to the total of all customer balances, typically with a Merkle tree — a cryptographic structure that lets each customer check their own balance was included without revealing anyone else's.
If assets are at least as large as liabilities, the exchange looks solvent for those assets at that moment.
What it genuinely proves
Done properly, a proof of reserves does establish real things:
- The coins existed at the addresses shown, at the time of the snapshot — that part is on-chain and verifiable by anyone.
- Someone controlled those addresses, if the exchange signed with them.
- Your balance was counted. If you check your own entry in the Merkle tree, you know you weren't left out of the liability total.
That's more than customers had before, and an exchange willing to publish it regularly is showing more than one that won't.
What it doesn't prove
The gaps are where failures hide:
- Liabilities are self-reported. The Merkle tree proves your balance is in the total. It can't prove the total includes every customer, or every debt — loans the exchange took, money owed to other firms, obligations off the books.
- It's a snapshot. Funds can be borrowed for the day of the snapshot and returned afterwards. A report from last quarter says little about this morning.
- Control isn't ownership. Coins in an address the exchange can sign for might be pledged as collateral, borrowed from someone else, or owed to a third party.
- Several exchanges, same coins. Without coordination between firms, the same coins could in principle be shown by more than one entity.
- The auditor's scope matters. Many reports are "agreed-upon procedures" — an accountant checking specific things the exchange asked them to check — not a full audit of the business.
None of this means proof of reserves is useless. It means it's a floor, not a guarantee. It answers "were these assets there?" much better than "is this company solvent?"
How to read one
If you keep funds on an exchange, a few questions separate a meaningful report from a marketing one:
- Are liabilities included, or just a list of wallets? Assets alone prove almost nothing.
- Can you verify your own balance in the published tree?
- How often is it done? Monthly or continuous beats a one-off.
- Who checked it, and what exactly did they check? Read the scope, not just the headline.
- Does the ratio cover each asset, or only a total that mixes the exchange's own token with real reserves?
The alternative: nothing to prove
Proof of reserves exists because a custodian asks you to trust it with your coins. Every one of its limits comes from that arrangement: the exchange holds the keys, and you hold a number in its database. As the old saying goes, not your keys, not your coins.
Self-custody doesn't need a proof of reserves, because there's nothing to reconcile. Your coins sit at your own addresses, and you can check them on any block explorer at any time. With SSP, those addresses are 2-of-2 multisig vaults controlled by your own two devices — no company holds a key, so there's no company whose solvency you need to verify.
That doesn't mean exchanges have no place. They're where most people buy and sell, and the trade-offs between custodial and non-custodial are real. The practical approach is to treat an exchange as a place funds pass through, not where they live — and to know the ways exchanges can fail before you leave anything there long-term.
The honest summary
A proof of reserves shows that certain coins were at certain addresses at a certain moment, and that your balance was counted. It doesn't show what the exchange owes, what it borrowed, or what happened the next day.
It's worth checking if you use an exchange — and worth remembering that the only reserves you can verify completely, at any moment, are your own.
