Understanding Proof of Reserves: A Deeper Dive into Cryptocurrency Exchange Transparency
At its core, a proof of reserves is public proof that a custodian holds the assets it claims to hold on behalf of users, typically using cryptographic methods and on-chain transparency. However, the question remains as to why withdrawals can still be delayed or stopped during a crisis, even if every crypto exchange can publish a Proof-of-Reserves (PoR) report.
The truth is that proof of reserves is not a guarantee of trust. It shows whether there are provable assets on a platform at any given time, but it does not confirm that the platform is solvent, liquid, or subject to controls that prevent hidden risks. Even when done properly, PoR is often a snapshot in time that may not capture what happened before and after the reporting moment.
Without a credible view of liabilities, PoR cannot demonstrate solvency, which is what users actually need during periods of withdrawal stress. This limitation is crucial to understanding the role of PoR in ensuring the financial health of a cryptocurrency exchange.
Did you know? On December 31, 2025, Binance’s CEO wrote that the platform’s user assets, publicly verified through proof of reserves, had reached $162.8 billion.
What PoR Proves and How It Is Usually Done
In practice, PoR involves two checks: assets and, ideally, liabilities. On the asset side, an exchange shows that it controls certain wallets, usually by publishing addresses or signing messages. Liabilities are more difficult, as most exchanges take a snapshot of user balances and submit it to a Merkle tree, often a Merkle sum tree.
Users can then use proof of inclusion to confirm that their balance is included without everyone’s balances being made public. When done correctly, PoR shows whether on-chain assets cover customer balances at a given point in time.
Did you know? Binance allows each user to independently verify their inclusion in their PoR snapshot. Through its verification page, Binance generates cryptographic proof based on a Merkle tree of user balances, allowing users to confirm that their account has been counted without revealing anyone else’s details or balances.
How an Exchange Can “Pass PoR” and Still Be Risky
PoR can improve transparency, but it should not be used as the sole measure of a company’s financial health. A statement of assets without complete liabilities does not prove solvency. Even when on-chain wallets appear stable, liabilities may be incomplete or selectively defined, missing elements such as loans, derivative risks, legal rights, or off-chain liabilities.
This can show that funds are available without proving that the company can meet all of its obligations. Even a single certificate does not reveal what the balance sheet looked like last week and what it looks like the day after the report. In theory, assets can be borrowed temporarily to improve visibility and then withdrawn.
In addition, charges are often not reported. PoR typically cannot tell you whether assets are pledged as collateral, loaned, or otherwise tied up, meaning they may not be available when withdrawals increase. Liquidity and valuation can also be misleading, as holding assets is not the same as being able to liquidate them quickly and at scale during periods of stress.
PoR Is Not the Same as an Audit
Much of the trust problem stems from a mismatch between expectations. Many users treat PoR like a security certificate, but in reality, many PoR orders are similar to agreed-upon procedures (AUPs). In these cases, the practitioner carries out specific controls and reports the results without providing an audit-like opinion on the overall health of the company.
In fact, an audit or even a review is designed to provide an operationally sound conclusion within a formal framework. AUP reporting is narrower, explaining what was tested and observed and then leaving the interpretation to the reader. Regulators have highlighted this gap, warning that PoR reporting is inherently limited and should not be viewed as evidence that an exchange has sufficient assets to meet its liabilities.
What Then Is a Practical Trust Stack?
PoR can be a starting point, but true trust comes from combining transparency with proof of solvency, strong governance, and clear operational controls. Start with solvency, showing assets against a full set of liabilities and ensuring that the assets are greater than or equal to the liabilities.
Merkle-based liability proofs, along with newer zero-knowledge approaches, aim to close this gap without disclosing individual balances. Next, add certainty about how the exchange actually works, including disciplined controls such as key management, access permissions, change management, incident response, segregation of duties, and custody processes.
Make liquidity and burdens visible, as solvency on paper does not guarantee that an exchange can survive a run. Users need clarity on whether reserves are unencumbered and how quickly holdings can be converted into liquid assets at scale. Anchor it in governance and disclosure, with credible supervision depending on clear custody frameworks, conflict management, and consistent disclosures.
PoR Helps, but It Cannot Replace Responsibility
PoR is better than nothing, but it remains a narrow, point-in-time test, even if it is often marketed like a security certificate. By itself, PoR is not proof of solvency, liquidity, or quality of control. So, before considering a PoR badge “secure,” consider the following:
-
Are liabilities included or are they just assets? Pure asset reporting cannot demonstrate solvency.
-
What is included? Are margins, return products, loans, or off-chain obligations excluded?
-
Is it a snapshot or a rolling message? A single date can be embellished. Consistency is important.
-
Are the reserves unencumbered? “Held” is not the same as “available when stressed.”
-
What type of engagement is this? Many PoR reports are limited in scope and should not be read like an audit opinion.
For more information on the role of Proof of Reserves in ensuring cryptocurrency exchange transparency, visit Cointelegraph.
