Proof of Reserves Explained: What It Does and Doesn't Prove

Proof of reserves is a cryptographic snapshot showing that a crypto exchange holds enough assets on-chain to cover what it owes customers, at one point in time. It became standard practice across the industry after FTX collapsed in November 2022 while claiming solvency it didn't have. It's a genuinely useful check, but it verifies assets only — not liabilities, not solvency going forward, and not what happens the day after the snapshot is taken.

What proof of reserves actually checks

A standard proof-of-reserves report does two things. First, it publishes the exchange's on-chain wallet addresses (or has an auditor confirm control of them) and totals the crypto held there. Second, it uses a Merkle-tree structure to let individual users verify their own account balance was included in the total, without exposing every other customer's balance. If the published reserve total is greater than or equal to total customer liabilities, the exchange is said to be "fully backed" at that moment.

Binance, Kraken, OKX, Bybit, KuCoin, Bitget, MEXC, Gate.io, Crypto.com, and Bitfinex all publish some version of this. Coinbase and CoinEx are notable exceptions among major platforms — Coinbase instead relies on being a US-listed public company with SEC-audited financial statements, a different but comparable form of transparency.

The Merkle-tree method, in plain terms

Every customer balance gets hashed into a leaf of a Merkle tree; the leaves combine upward into a single root hash that the exchange publishes. You can take your own account balance, run it through the same hashing process using a tool the exchange provides, and confirm it produces a path that leads to the same published root. If it does, your balance was genuinely counted in the total — the exchange can't quietly leave you out or under-report your holdings without the math failing. This is the actual cryptographic proof part; everything else in a proof-of-reserves report is closer to a standard financial disclosure.

What it does not verify: liabilities

This is the single biggest gap. A reserves report shows assets held; it usually does not independently verify what the exchange owes in total. An exchange could, in theory, publish a reserves figure that comfortably covers only the liabilities it chooses to disclose, while excluding other obligations — loans, rehypothecated collateral, or claims from a lawsuit — from the picture entirely. Genuinely rigorous proof-of-reserves programs pair the asset attestation with a liabilities attestation from an independent auditor, but the depth and frequency of that second half varies a lot between exchanges, and few make the full liabilities methodology as easy to inspect as the asset side.

It's a snapshot, not a livestream

Most exchanges publish these reports periodically — monthly or quarterly, not continuously. Nothing stops an exchange from temporarily borrowing assets to look fully backed on the day of the snapshot, then moving them elsewhere afterward — a practice sometimes called "window dressing." A single clean report is reassuring but not conclusive; a consistent track record of reports over time, ideally from a named third-party auditor rather than the exchange's own accounting team, is a stronger signal than any one snapshot.

Proof of reserves didn't prevent recent hacks

It's worth being clear about what proof of reserves is not for: it's a solvency check, not a security control. Bybit published proof-of-reserves reports before losing roughly $1.5 billion in ETH from a cold wallet in February 2025, when attackers compromised a Safe{Wallet} multisig transaction. The reserves system worked exactly as designed afterward — Bybit's solvency meant it could replenish the stolen funds using bridge liquidity from Galaxy Digital, FalconX, and Wintermute within 72 hours, and no customer lost money. But the report itself did nothing to stop the hack; it only meant the exchange had the balance-sheet strength to absorb it without passing the loss to users.

• KuCoin's 2020 breach (~$285M) and CoinEx's 2023 breach ($54-70M) were both hot-wallet security failures, not reserves failures
• Both exchanges reimbursed affected users in full afterward — proof of reserves is about the ability to make that reimbursement possible, not about preventing the breach

How to actually use a reserves report as a trader

Check three things rather than just the headline coverage ratio. First, who ran the attestation — an independent named auditing firm carries more weight than an internal report. Second, how recent it is — a report from over a year ago tells you little about today's balance sheet. Third, whether it includes a liabilities figure alongside the assets figure, not just the assets side. A 100%+ coverage ratio on assets alone, with no visible liabilities methodology, is a much weaker signal than it looks.

Exchanges without a standard reserves report aren't automatically riskier

Coinbase is the clearest counter-example: it's a Nasdaq-listed public company (ticker COIN) subject to SEC reporting requirements and independent financial audits, which is arguably a more comprehensive disclosure regime than a crypto-native proof-of-reserves snapshot, even though it doesn't use the Merkle-tree method. CoinEx, on the other hand, doesn't publish either format, which means traders evaluating it have less independent verification available and should weigh that gap accordingly, alongside its 2023 hack history and full reimbursement record.

Why FTX changed the industry's standard

Before November 2022, proof of reserves was a niche practice used by a handful of exchanges. FTX collapsed while publicly claiming to be solvent, and it later emerged that customer deposits had been commingled with and lent out through a related trading firm, Alameda Research, leaving a multi-billion-dollar shortfall that no external report had caught in advance. Within weeks, most major exchanges rushed to publish their first proof-of-reserves reports, largely as a trust-rebuilding exercise for an industry that had just watched a top-five platform turn out to be insolvent. That origin story is worth keeping in mind: the practice exists because self-reported solvency claims had already failed once, badly, and it was built to restore confidence quickly rather than as a mature, standardized audit framework from day one.

That history is also why the quality of proof-of-reserves programs varies so much between exchanges even today. Some have matured into recurring, third-party-audited disclosures; others remain closer to a one-time trust exercise published shortly after FTX and updated only sporadically since.

Where this fits into a broader safety check

Proof of reserves is one input among several, alongside regulatory status, security-incident history, insurance funds, and your own account security practices (covered in our companion guide on keeping crypto safe on an exchange). Treat a strong reserves report as a reason to feel somewhat more confident, not as a substitute for keeping only actively-traded funds on any exchange, regulated or not.

Frequently asked questions

What is proof of reserves in crypto?

A cryptographic report, usually built with a Merkle tree, showing an exchange holds enough on-chain assets to cover customer balances at a specific point in time. It became standard practice industry-wide after FTX's 2022 collapse exposed the risk of unverified reserves.

Does proof of reserves check liabilities too?

Not always, and this is the biggest limitation. A reserves report proves assets held; a separate, less standardized attestation is needed to verify total liabilities. Without both, a high coverage ratio can be misleading.

Which exchanges publish proof of reserves?

Binance, Kraken, OKX, Bybit, KuCoin, Bitget, MEXC, Gate.io, Crypto.com, and Bitfinex all publish some form of it. Coinbase relies on SEC-audited public-company financials instead; CoinEx currently publishes neither.

Can an exchange fake a proof-of-reserves report?

The Merkle-tree portion is hard to fake for individual balances, since users can verify their own inclusion against the published root hash. But an exchange can still temporarily borrow assets before a snapshot ("window dressing") or omit liabilities, so a single report isn't conclusive proof of ongoing solvency.

Did proof of reserves stop the Bybit hack?

No. Bybit published reserves reports before losing about $1.5 billion in a February 2025 cold-wallet hack. Proof of reserves is a solvency check, not a security control — it meant Bybit had the balance-sheet strength to reimburse users afterward, but did nothing to prevent the breach itself.

Why did proof of reserves become common practice?

It spread rapidly after FTX collapsed in November 2022 despite claiming solvency, when it emerged customer funds had been commingled with a related trading firm. Most major exchanges began publishing their first reports within weeks, largely to rebuild trust after the industry's biggest platform turned out to be insolvent without warning.