Proof of reserves

It answers one half of the solvency question: what a custodian holds, not what it owes. Kraken has published Merkle tree proofs since 2014, while the wave that followed the FTX collapse was thinner, with Mazars pulling its Binance report and halting work for crypto clients within weeks in December 2022. Treat a passing proof as a floor under an exchange, never as a reason to leave coins on one.

How it works

A complete proof of solvency has two halves, and most published reports only do the first properly.

Proof of assets shows control of coins. The exchange publishes its wallet addresses and signs a challenge message with each corresponding private key, or moves a specified amount at a specified time. Anyone can verify the signatures and add up the balances on the ledger themselves. This part is genuinely cryptographic and hard to fake.

Proof of liabilities shows what customers are owed. Each account balance becomes a leaf in a Merkle tree, where every parent node carries the sum of the balances beneath it as well as a hash. The exchange publishes the root, which is a single hash plus a total. You then request your own inclusion proof: a short list of sibling hashes that lets you recompute the root from your own balance. If it matches the published root, your money was counted. If enough customers check, the exchange cannot quietly understate the total, because a missing or shrunken leaf changes the root.

Assets greater than or equal to liabilities, with both sides proven and a named auditor attesting that nothing is missing, is proof of solvency. Almost nothing published under the label goes that far. The standard gaps are worth memorizing:

• It is a snapshot. Control is proven at one instant. Coins borrowed the day before and returned the day after satisfy the proof perfectly.
• Debt is invisible. On-chain balances cannot show a loan secured against those same coins, an obligation to an affiliate, or a court judgment.
• Coverage is partial. A report may cover bitcoin and skip everything else, or cover one legal entity in a group of twenty.
• The engagement may not be an audit. Many reports are "agreed-upon procedures", which perform a checklist the client specified and explicitly disclaim any opinion. The document usually says so in the fine print.
• Privacy leaks. Naive Merkle trees expose balance information to neighbouring leaves, which is why newer designs use zero-knowledge proofs instead.

Why this matters when you buy bitcoin

Proof of reserves is a way to compare custodians, not a substitute for having your own keys.

If you keep a trading balance somewhere, the questions to ask are specific. Does the proof cover bitcoin specifically, or a headline total across dozens of assets? Who signed it, and is it an audit or a procedures checklist? How recent is it, and how often is it repeated? Can you actually fetch your own inclusion proof, or is verification only theoretical? Kraken, our top-rated venue, has run proof of reserves since 2014 and lets customers verify their own balance against the published root, which is the version of this that means something.

Note that it is not the only form of assurance, and not always the strongest. Coinbase has been listed on Nasdaq since 2021 and files audited financial statements with the SEC, a heavier obligation than any voluntary attestation. Even so, its own first-quarter 2022 filing warned that in the event of bankruptcy, customer crypto assets could be treated as property of the estate and customers as unsecured creditors. That sentence, from a large regulated public company, is the clearest argument on this page: no disclosure regime changes who legally owns the coins in a custodial account.

The conclusion is the one this site keeps returning to. Use an exchange as a conversion venue, then withdraw. Coins on a hardware wallet require no proof, no auditor, and no trust in a company's balance sheet, and the sites in our archive that failed, from Mt. Gox in February 2014 to LocalBitcoins in February 2023 and Bittrex's Chapter 11 filing in May 2023, all had customers who intended to withdraw later.

What FTX's proof of reserves would have shown

FTX filed for Chapter 11 bankruptcy protection on November 11, 2022, and it is the reason every exchange started publishing attestations that month.

Run the thought experiment. A proof of assets would have listed wallets, signed messages, and demonstrated control of a large pile of digital assets. A Merkle tree of customer balances would have produced a root that individual users could check. Both halves could have passed. The bankruptcy petition estimated liabilities somewhere between 10 billion and 50 billion dollars across more than 100,000 creditors, and a large share of what the group counted as assets was FTT, a token FTX had issued itself and largely controlled.

That is the limitation in one example. Proof of reserves demonstrates control of assets; it does not test whether those assets are liquid, independently valued, unencumbered, or worth anything at all in the moment when every customer asks for their money at once. A custodian can pass the cryptography and still be insolvent.

Proof of reserves vs rehypothecation

Proof of reserves is a measurement; rehypothecation is a practice it is bad at detecting. Rehypothecation means the custodian lends out or pledges the assets you deposited, which can be entirely legal and disclosed in the terms you accepted. A point-in-time proof of assets shows the coins present at that instant, not whether they are promised elsewhere, and it is exactly the kind of arrangement that unwinds when a lender is called and the coins have to come back at once.

Proof of reserves vs not your keys, not your coins

"Not your keys, not your coins" is a claim about ownership; proof of reserves is a claim about inventory. The first says that a balance in a custodial account is a promise from a company, enforceable in bankruptcy court alongside every other creditor's claim, no matter how much bitcoin the company can prove it holds today. The second is genuinely useful as a way of ranking companies, which is why the good exchanges publish it. It just answers a different question, and a strong proof from a well-run venue still leaves you holding an IOU rather than a coin.