Proof of reserves: what it shows and what it doesn't

What is proof of reserves?

When you leave crypto on an exchange, you cannot see the coins. You see a number on a screen. Proof of reserves (often shortened to PoR) is a way for the platform to show that the crypto behind those numbers really exists.

A typical proof of reserves has two halves:

1. Customer balances. The platform adds up what it owes customers for one asset, such as bitcoin, and publishes the total in a way each customer can check.
2. Reserves. The platform shows that it controls blockchain addresses holding at least that much of the asset, for example by moving coins or signing a message from those addresses at an agreed time.

Sometimes an outside firm checks the numbers and issues a report. The US Public Company Accounting Oversight Board (PCAOB), which oversees auditors of US listed companies, describes these reports as ones that “purport to provide an asset verification for an asset type at a particular moment in time, subject to significant limitations based on the procedures performed.” Keep the words one asset type and a particular moment in mind; they matter later.

Why do crypto exchanges publish proof of reserves?

Because customers have good reason to ask. On a centralized exchange the platform holds your crypto, as explained in our guide to CEX vs DEX. The US Securities and Exchange Commission (SEC) warns that some custodians use deposited crypto “as collateral for their own purposes (i.e., lending)” and that some “may commingle crypto assets, instead of holding them individually for customers.”

The SEC also reported in 2023 that some crypto firms had suspended withdrawals and that “Some crypto asset entities have entered bankruptcy proceedings, and it is unclear how much of their holdings (if any) customers might be able to recover.” Proof of reserves is one way platforms try to answer that worry. Whether it actually does depends on what it covers.

How does a Merkle tree work?

To publish customer balances in a way each person can check, platforms can use a Merkle tree. The US National Institute of Standards and Technology (NIST) defines it as “A data structure where the data is hashed and combined until there is a singular root hash that represents the entire structure.”

A hash is a fixed-length fingerprint of some data. Change one character of the data and the fingerprint changes completely. Our guide to what a blockchain is explains hashes in more detail. Blockchains already use Merkle trees: the Bitcoin whitepaper says transactions “are hashed in a Merkle Tree”, with only the top hash (the root) included in the block’s hash.

For proof of reserves, a version called a Merkle sum tree is often used. Ethereum co-founder Vitalik Buterin set out the design in a 2022 essay:

• Each leaf (bottom box) holds one customer’s balance and a scrambled (“salted”) fingerprint of their user ID, so names are not published.
• Each box above holds the sum of the two balances below it and a hash of those two boxes.
• The single box at the top, the root, holds the total of all customer balances and one hash that depends on every account in the tree.

Illustrative example (four invented customers, no real data). Leaves: A = 2 BTC, B = 5 BTC, C = 1 BTC, D = 4 BTC.
Next level: A+B = 2 + 5 = 7 BTC; C+D = 1 + 4 = 5 BTC, each with a hash of the two boxes below.
Root: 7 + 5 = 12 BTC, plus one root hash. The platform publishes the root and must then show reserves of at least 12 BTC.

How can you check that your balance is included?

The platform gives each customer the short path from their leaf up to the root, called a Merkle branch or Merkle proof. The idea is the same one the Bitcoin whitepaper uses to let a light wallet confirm a payment without downloading the whole blockchain: “obtain the Merkle branch linking the transaction to the block it’s timestamped in.”

In the example above, customer C would receive their own leaf, D’s box and the A+B box. C then:

1. Checks that their own leaf shows the right balance: 1 BTC.
2. Recomputes C+D from their leaf and D’s box: 1 + 4 = 5 BTC, plus the hash.
3. Recomputes the root from C+D and A+B: 5 + 7 = 12 BTC, plus the root hash.
4. Compares the result with the root the platform published. If the sum and hash match, C’s balance was counted.

Some limits are built in. C learns that someone holds 4 BTC, so a little privacy leaks. A platform could understate or leave out some accounts and hope those customers never look, so the method only works well if many customers actually check. And it confirms only that you were counted on the snapshot date.

What does proof of reserves not prove?

This is where US regulators are most direct. The PCAOB’s Office of the Investor Advocate issued an investor advisory in March 2023 that says: “Proof of reserve reports are inherently limited, and customers should exercise extreme caution when relying on them to conclude that there are sufficient assets to meet customer liabilities.” It lists what such reports usually leave out:

• Liabilities. The procedures “likely do not address the crypto entity’s liabilities, the rights and obligations of the digital asset holders, or whether the assets have been borrowed by the crypto entity”. A platform can hold all its customers’ coins and still owe lenders far more.
• Borrowed assets. “If the assets were borrowed by the crypto entity at the time of the PoR engagement, investors would not know based on the PoR Report.”
• What happens afterwards. Because the reports cover one point in time, “they do not provide any assurance about whether the assets were used, lent, or otherwise became unavailable to customers following issuance of the PoR Report.”
• Controls and governance. They “provide no assurance regarding the effectiveness of internal controls or of governance of the crypto entity.”

Two more gaps follow from how the method works. Ordinary money held in banks cannot be proved on a blockchain, so it relies on bank statements or auditors instead. And the PCAOB describes these reports as covering “an asset type”, so a proof may cover only some of the coins a platform holds or owes.

Illustrative example (an invented exchange). Snapshot: reserves of 10,000 BTC against customer balances of 9,800 BTC. Reserve ratio = 10,000 ÷ 9,800 = 102.0%. Now suppose 1,000 BTC of those reserves were borrowed the day before and must be paid back. Assets truly available = 10,000 − 1,000 = 9,000 BTC. Real ratio = 9,000 ÷ 9,800 = 91.8%, a shortfall of 800 BTC. The snapshot alone would still show 102%.

Is a proof-of-reserves report the same as an audit?

No. The PCAOB advisory says that, despite any claims to the contrary, “PoR Reports are not equivalent or more rigorous than an audit”, and “they are not conducted in accordance with PCAOB auditing standards.” Some are “agreed-upon procedures”, where “the management of the crypto entity, not the provider of the PoR Report, determines the procedures to be performed by the third party when conducting the engagement.” In other words, the platform chooses what gets checked.

The SEC’s Chief Accountant, Paul Munter, made the same point to accounting firms in July 2023: “Non-audit arrangements are neither as rigorous nor as comprehensive as a financial statement audit, and may not provide any reasonable assurance to investors.” On marketing that presents such work as equal to an audit, he wrote: “Such suggestions are false.” His statement reflects his own staff view, not necessarily the Commission’s.

What would stronger protection for customer assets look like?

The International Organization of Securities Commissions (IOSCO), which brings together securities regulators from around the world, published 18 policy recommendations for crypto markets in November 2023. We found no mention of proof of reserves in them. Instead, they ask regulators to require ongoing safeguards:

• Recommendation 13: “Regulators should require a CASP to place Client Assets in trust, or to otherwise segregate them from the CASP’s proprietary assets.” (A CASP is a crypto-asset service provider.)
• Recommendation 15: “Regulators should require a CASP to have systems, policies, and procedures to conduct regular and frequent reconciliations of Client Assets subject to appropriate independent assurance.”

These are recommendations to regulators, not rules that automatically apply to any platform. Whether they protect you depends on the law where the platform is authorised. See how to check if a crypto firm is authorised.

What should you ask about a proof-of-reserves claim?

If a platform points to its proof of reserves, these questions help you read it:

• What date is the snapshot? An old snapshot says little about today.
• Does it include liabilities? Assets alone cannot show whether the platform can pay everyone it owes.
• Which assets are covered? One or two coins, or everything you hold there?
• Who did the work, and to what standard? Is it an audit, a limited review or agreed-upon procedures chosen by the platform?
• Can you check your own leaf? If the platform offers a Merkle proof, use it.
• Are customer assets kept separate from the company’s own money, and can they be lent out? Read the terms of service.

For a wider checklist, see how to choose a crypto exchange.

What are the risks of relying on proof of reserves?

• False comfort. A published report can make a platform look safer than it is. PCAOB staff say customers should exercise “extreme caution” before treating one as evidence of enough assets to meet customer liabilities.
• Hidden debts. Liabilities and borrowed assets usually sit outside the report.
• Stale data. Assets can be moved or lent the day after the snapshot.
• No protection scheme. Even with a clean proof of reserves, the SEC says that, unlike accounts at registered brokers, “There are no such protections for accounts that you place with crypto asset entities.” If a custodian fails, the SEC warns, “you may lose access to your crypto assets.”
• Self-custody is no free pass. Moving crypto to your own wallet removes platform risk but adds private key risk: lose the key and you lose the assets.

Blockhorizon is an education site. Nothing on this page is a judgement on, or recommendation of, any exchange.