Proof of reserves explained: what it shows, and what it can't prove

After several crypto platforms collapsed in 2022, exchanges started publishing “proof of reserves” reports to reassure customers that their crypto was really there. They sound reassuring. The US regulator that oversees auditors has a clear warning about how much they can actually prove.

What a proof-of-reserves report is

A proof of reserves (PoR) is a report, often prepared by an outside firm, stating that a crypto platform controlled certain crypto assets at a particular moment. Some reports also compare those assets with a total of customer balances at the same moment.

How the customer side usually works

Many platforms use a Merkle tree: a cryptographic structure that combines every customer balance into a single fingerprint (the “root”). Each customer can then check that their own balance was included in the total, without the platform revealing anyone else’s balance.

A Merkle check, step by step

NIST defines a Merkle tree as a structure where data is hashed and combined until a single root hash represents all of it. Imagine an exchange with just four customers, A, B, C and D:

1. Each customer’s account ID and balance are turned into a hash, a short fingerprint. Change a single digit of a balance and the fingerprint changes completely.
2. The fingerprints are combined in pairs: A with B, and C with D, each pair hashed into a new fingerprint.
3. Those two are combined and hashed again into the root, which the exchange publishes in its report.
4. To check that your balance (say C) was included, the exchange gives you only the fingerprints you need: D’s, and the A-B pair’s. You recompute the path up to the root yourself.
5. If your result matches the published root, your balance was part of the total. If anyone had changed your balance, the root wouldn’t match.

Real exchanges have millions of accounts, but the check works the same way, needing only a few dozen fingerprints. What it proves is inclusion: your balance was counted. It doesn’t prove the exchange has the assets to pay everyone.

On the asset side, the platform demonstrates control of certain blockchain addresses, for example by signing messages with their keys, so that the holdings can be checked on-chain.

What the PCAOB says

On 8 March 2023, the PCAOB’s Office of the Investor Advocate issued an Investor Advisory about proof of reserve reports issued to crypto entities, such as exchanges and stablecoin issuers. Its key messages:

• Proof of reserve engagements are not audits and do not provide any meaningful assurance to investors or the public.
• The procedures likely don’t address the entity’s liabilities, the rights and obligations of the people holding the digital assets, or whether the assets were borrowed to make it look as though there were enough reserves.
• Because the reports concern assets at one point in time, they give no assurance about whether the assets were used, lent or otherwise became unavailable to customers after the report.
• Customers should exercise extreme caution when relying on these reports to conclude that a platform has enough assets to meet what it owes customers.

The gaps, in plain terms

A platform could hold enough bitcoin to match customer bitcoin balances and still be insolvent overall, if it owes large amounts elsewhere.

A simple example of the gap

Imagine an exchange whose customers hold a combined 10,000 BTC in their accounts. On the report date, it shows control of addresses holding 10,000 BTC. The report looks perfect: 100% backed.

Now suppose 3,000 of those bitcoins were borrowed from a lender a few days earlier and are due back next week, or that the exchange owes large debts in dollars to other creditors. Neither fact would necessarily appear in a proof of reserves. The day the lender takes its coins back, customers are only 70% covered, and nobody reading the report would have known.

This is exactly the kind of limit the PCAOB points to: the report covers certain assets at one moment, not the full picture of what the company owes.

What actually protects customer assets: custody rules

Regulators have generally tackled the gaps that proof of reserves leaves by setting rules on how platforms hold customer assets, rather than relying on snapshots:

• Canada. After several platform failures, the Canadian Securities Administrators asked crypto trading platforms seeking registration to commit, among other things, to hold clients’ assets separate from their own, in trust for clients, with crypto kept by approved third-party custodians, which must hold at least 80% of the value of client crypto. Platforms must not pledge, re-hypothecate or otherwise use clients’ crypto, and must not offer margin or leverage. The custodians themselves need audited financial statements showing what they owe custody clients.
• United Kingdom. From 25 October 2027, crypto custody firms will have to follow new safeguarding rules in the FCA’s client assets sourcebook (CASS 17). See the UK’s new crypto rules.
• US stablecoins. Under the GENIUS Act, payment stablecoin issuers must hold 100% reserves in liquid assets such as US dollars or short-term Treasuries, and publish the composition of their reserves monthly. See stablecoins explained.

These rules go to the heart of what the PCAOB says proof of reserves can’t show: whether customer assets are borrowed, lent or used by the platform.

Questions to ask about any report

Before you take comfort from a proof of reserves, look for answers to these:

1. Who prepared it, and what kind of engagement was it? Remember it isn’t an audit.
2. What date does it cover? An old snapshot tells you even less.
3. Which assets are included? All customer assets, or only a few major coins?
4. Does it say anything about liabilities? Most don’t, and that’s the biggest gap.
5. Can you check your own balance was included?
6. Is it repeated regularly? One report is a single photo; a regular series at least shows a pattern, though each one has the same limits.

How to use PoR sensibly

Treat a proof of reserves as one small signal, never the main reason to trust a platform. Better signals:

1. Regulation where you live. In Canada, for example, registered platforms must meet conditions to protect client assets. See how to check if an exchange is registered.
2. Audited financial statements, where the platform publishes them.
3. Clear terms on custody: are customer assets segregated? Are they lent out?
4. Your own limits: keep only what you need on any platform, and consider self-custody for long-term holdings. See hot vs cold wallets.

And remember the protection gap: the FDIC says deposit insurance doesn’t protect against the failure of crypto exchanges, custodians or wallet providers. See is your crypto insured?