Proof of reserves attestation process: what it actually verifies

02 September 2026

An exchange wants you to believe your funds are safe. It hires an auditor, publishes a Merkle tree, and calls it transparency. That process has a name: proof of reserves. It does not mean what most people think.

Let’s walk through the steps. Then we cover the gap that makes the whole thing optional.

Step 1: The Exchange Constructs a Merkle Tree

Every customer’s balance becomes a leaf in a binary tree. The exchange hashes each leaf. Parent nodes are hashes of their two children. This continues up to a single root hash. That root is a snapshot of all customer balances claimed by the exchange at one moment.

The exchange publishes this root. It also gives each customer a path of hashes from their leaf to the root. That path lets the customer check that their balance is included. No customer sees anyone else’s balance.

Step 2: A third-party auditor verifies aggregate balances

The auditor receives the same Merkle tree or the full list of customer balances. It checks that the root hash matches. It may also spot-check random leaves. The firm then signs a statement: as of a specific date, the exchange’s total customer liabilities equal at least the sum of those leaves.

The auditor does not control the exchange’s wallets. It takes the exchange’s word on what wallets are owned. It does not independently verify asset ownership.

Step 3: the exchange reports asset holdings

The exchange tells the auditor how much Bitcoin, Ether, or stablecoin it holds across its wallets. The auditor checks wallet signatures or uses an API to confirm balances. This is where the critical gap opens.

The critical gap: liabilities are client-reported

Proof of reserves verifies assets. It does not verify liabilities. An exchange can show a billion dollars in wallets while hiding a two-billion-dollar shortfall. The auditor only knows what the exchange tells it about customer balances.

This is not hypothetical. It is structural. Proof of reserves without proof of liabilities does not prove solvency. An exchange can be insolvent by billions and still pass the attestation.

Real-World Examples

Kraken publishes a proof-of-reserves page with wallet balances and a Merkle tree. You can check your inclusion. Kraken claims a 1:1 ratio. The page says nothing about what happens if liabilities exceed assets.

Binance publishes a similar page. It uses a zk-SNARK-based verification that hides individual balances while proving aggregate numbers. The auditor, Mazars, stopped doing crypto audits in 2022. Binance now uses a different firm. The core problem remains: liabilities are self-reported.

Both pages rely on the exchange’s honesty about what it owes. Neither proves that the exchange hasn’t loaned out customer bitcoin and recorded it as a platform liability or a trading profit.

On-Chain verification tools exist

Chainlink provides a proof-of-reserves feed for several exchanges. It checks on-chain wallet balances periodically and reports the total. That feed is available to anyone. It is a verifiable record of what the exchange holds. It says nothing about what the exchange owes.

Arkham Intelligence offers on-chain wallet tracking. It tags exchange wallets and shows inflows and outflows. You can watch a wallet drain in real time. That is useful for catching fraud after it starts. It does not prevent it.

Both tools tighten the asset side of the equation. Neither touches the liability side.

What an attestation actually proves

An attestation proves that an exchange held a certain amount of a certain asset in disclosed wallets on a certain date. That is the entire claim.

It does not prove: - The exchange owns those wallets. - The exchange has not borrowed the assets. - Customer liabilities are lower than assets. - The balance snapshot is representative of normal operations.

An exchange can pass and collapse a week later. It can pass while commingling funds. It can pass while hiding debts.

The Bottom Line

Proof of reserves is better than nothing. It is far from enough. A real solvency proof requires both sides of the balance sheet: assets verified by an independent party and liabilities verified by a process that cannot be gamed. No major exchange has produced one that fully satisfies that standard.

If you see a “proof of reserves” badge, ask two questions. Who controlled the wallets? And who counted the customers you cannot see?

Back to exchange failures