What Is Proof of Reserves?

Have you ever wondered what a centralized exchange does with your coins? You deposit crypto, withdraw fiat, and trust your balance will always be there. Until one day it’s not.

Maybe your money is working for someone else. Lent out for interest, used for fake trading volume, who knows. No one does until there’s a bank run in a bear market.

That’s where Proof Of Reserves comes into play. To prove 1:1 deposit backing. And if you think that’s enough to protect your balance, this article will be an eye opener for you.

What Is Proof Of Reserves (PoR)?

Proof of Reserves (PoR) is a verification practice used by cryptocurrency exchanges, custodians, and lenders to publicly demonstrate they hold sufficient assets to cover all customer deposits. It provides an independent check — via cryptographic proofs, third-party audits, or on-chain disclosures — that the institution isn’t lending out, misappropriating, or otherwise unable to return user funds on demand.

Crypto platforms aren’t like traditional brokers. Because most cryptocurrencies use public networks, transparency isn’t an option. Client or not, anyone can see company balances on every wallet and network.But do those balances match with depositors’ ones? That’s what proves the Merkle Tree technique. Merkle Tree PoR involves grouping customer “hashes” (Merkle Leaves) in pairs over and over until there’s only one hash left— the Merkle root. 

A hash is an unreadable string of letters and numbers that results from applying an algorithm to other data— such as wallet balances. Hashing is irreversible, but entering the same data should result in the same string. It’s a compact and useful way to prove balances without revealing them.

On centralized exchanges, each balance is hashed then paired to another one and hashed again until there’s a single balance and hash. So with 1,000 balances, 1,000 hashes will pair and convert to 500 hashes, then 250, and again until the last. This way, exchanges can prove total deposits without revealing individual balances.

The problem is, exchanges can still manipulate data. They can borrow tokens from DeFi apps, include wallets that they don’t own, exclude depositor wallets, or switch balances from fiat. Even with third-party agencies, all of the above can still happen.

Doing PoR once would be like auditing Ethereum in 2015 and expecting it not to have bugs with the 2023 version. It’d be ideal to show PoR in real-time, or at least bimonthly. While the post-FTX collapse in late 2022 prompted most major centralized exchanges to publish their first PoR, many smaller platforms still have not completed even a single independent audit.

What Is a Coverage Ratio — And What Does 100% Actually Mean?

The coverage ratio is the core metric in any PoR report:

Coverage Ratio = Total Reserve Assets ÷ Total Customer Liabilities

• 100% = The exchange holds exactly enough assets to cover every customer withdrawal simultaneously.
• >100% = Over-collateralized; a buffer exists.
• <100% = Undercollateralized; the exchange cannot pay all customers at once.

Worked Example:

An exchange holds 10,500 BTC in verified wallets. Customer deposits total 10,000 BTC. Coverage ratio = 10,500 ÷ 10,000 = 105%. This exchange has a 5% buffer.

If that same exchange later takes on $200M in undisclosed loans collateralized by customer BTC, the true coverage ratio could drop below 100% — without the published PoR changing at all.

The 4 Types of Proof of Reserves

👉 Quick takeaway: The most trustworthy Proof of Reserves systems allow users to verify data themselves on-chain, while others rely on third-party audits or partial transparency.

Bottom line: Merkle Tree and real-time PoR give you the most verifiable proof. Attestation-only reports require trusting the auditor’s independence.

Merkle Tree Proof: How To Verify Your Funds

If you’re only comparing on-chain assets vs deposits, there’s a lot you still don’t know. You don’t know how many of those assets are borrowed to pretend there’s 1:1 backing. You neither know which depositors were fabricated or excluded. 

But at least, you can prove whether or not your balance was included in the last PoR:

• After the first PoR, the exchange should have a tool to self-verify your balance within the Merkle Tree. The exact path and tool should appear on the Help page. 
• On the verification page, you’ll find all PoR audits and your Merkle Leaf hash.
• The latest Merkle Tree should be public on the exchange with a search tool. If you paste your Merkle Leaf and it finds it, then the last PoR did include your deposits.

If it can’t find your Merkle leaf, it might mean:

• PoR is pending or outdated
• You didn’t have a balance or it was too low for consideration
• The exchange doesn’t have the liquidity to back your balance

How to Evaluate Any PoR Report: A 5-Point Checklist

Not all PoR reports are equal. Use this checklist before trusting any exchange’s claims:

1. Scope — Does the report cover ALL assets (crypto + fiat + tokens) and ALL liabilities? Reports that only cover BTC while hiding USD obligations are incomplete.
2. Independence — Was the audit performed by a third party with no financial relationship to the exchange? Check if the auditor’s full report is publicly available.
3. Method — Are on-chain holdings cryptographically reconciled to customer balances (Merkle proof)? Or is it just a signed statement?
4. Cadence — Is this a one-time snapshot or a recurring/real-time attestation? A 12-month-old PoR is nearly meaningless during market stress.
5. Caveats — Read the footnotes. Material exclusions, scope limitations, or ‘subject to management representations’ language are red flags.

Red flag checklist: If an exchange’s PoR report is missing 3 or more of the above, treat it as unverified.

Proof Of Reserves vs Crypto Audits

It’s not uncommon for crypto audit agencies to also offer PoR services. That’s because both require blockchain data to be verified. Both transactions and the code that makes them possible are public in blockchains like Ethereum, Pulsechain, or BNB Chain.

👉 Quick takeaway: Proof of Reserves verifies an exchange can cover user funds; a crypto audit checks whether smart contract code is secure against attacks. Both matter — but for different reasons.

Does Proof-of-Reserves Actually Protect Users?

What is PoR? Verified crypto assets minus deposits. If it’s positive, everyone can cash out without hassle. Liquidity.

Solvency? Different story. Then you need to disclose liabilities like lender debt and operational costs. If the exchange can’t offset those liabilities long-term, eventually those “reserves” run out.

PoR is a meaningful transparency signal — but it has five structural limitations every user should understand:

1. Timing risk — PoR is a snapshot. During heavy market stress or mass withdrawals, conditions can change within hours of a published report.
2. Hidden liabilities — Unsecured loans, counterparty exposures, and off-chain obligations may not appear in the PoR. FTX is the clearest example: a PoR showing 1:1 asset backing would not have revealed the $8B+ in undisclosed liabilities owed to Alameda Research.
3. Custody complexity — Multi-signature wallets, sub-accounts, cross-chain assets, and third-party custodians add layers that can obscure true risk even in a well-intentioned audit.
4. Illiquidity risk — Assets may exist but be impossible to liquidate quickly at full value during a market crisis. Holding $1B in an illiquid altcoin is not the same as holding $1B in BTC.
5. Fraud risk — If the auditor is not truly independent, or if the exchange temporarily borrows assets from DeFi protocols to inflate balances at snapshot time, the results are unreliable.

The most robust solution is decentralized, real-time PoR. Chainlink provides this infrastructure for exchanges including Gemini and Paxos, publishing reserve data directly on-chain where anyone can verify it continuously.

Why Do Exchanges Publish Proof of Reserves?

Exchanges don’t publish PoR out of altruism. There are three driving motivations:

• Rebuilding trust after incidents — Following the FTX collapse in November 2022, nearly every major exchange rushed to publish PoR reports to reassure users their funds were safe. Binance, Kraken, Coinbase, and others published within weeks.
• Regulatory pressure — Regulators in the EU (MiCA), US, and Asia-Pacific are increasingly requiring or strongly encouraging reserve disclosures as part of licensing and compliance frameworks.
• Competitive differentiation — In a crowded exchange market, PoR has become a trust signal. Kraken, for example, markets its PoR as proof it ‘exceeds the transparency offered by legacy financial firms.’

Understanding the motivation helps you evaluate the PoR: a report published under regulatory pressure with a named independent auditor carries more weight than one published voluntarily with no third-party verification.

The Bottom Line

Proof of Reserves is one of the most important transparency tools available to crypto users — but it’s not a guarantee of safety. A strong PoR report is independent, cryptographically verifiable, frequently updated, and covers all liabilities — not just the assets the exchange wants you to see.

Before trusting any exchange with significant funds, run through the 5-point checklist above. Look for Merkle-proof verification, named independent auditors, and real-time or monthly cadence.

For users who want to eliminate custodial risk entirely, decentralized protocols like Liquid Loans maintain full, algorithmically-enforced collateral ratios using immutable, admin-key-free smart contracts — removing the need for trust in any institution’s PoR report altogether.