Exchange Proof of Reserves: What the Reports Actually Prove

By Chanuka Geekiyanage Oct 30, 2026

Exchange proof of reserves (PoR) reports are meant to show that a centralized exchange holds the crypto it owes its customers, but most prove less than the headline suggests. A report can show full wallets while saying nothing about loans, re-lent customer assets, or debts the exchange never lists. This article explains what each type of report verifies, where it fails, and what to check before you trust an exchange with your funds.

Panaprium est indépendant et pris en charge par les lecteurs. Si vous achetez quelque chose via notre lien, nous pouvons gagner une commission. Si vous le pouvez, veuillez nous soutenir sur une base mensuelle. La mise en place prend moins d'une minute et vous aurez un impact important chaque mois. Merci!

What a Proof of Reserves Report Actually Proves

A PoR report can make three separate claims. The exchange controls certain wallets, those wallets held a certain amount on a certain date, and customer liabilities are no larger than those assets. Only the third claim speaks to solvency, and many reports skip it. QuillAudits makes the same point: a report that shows only assets does not prove solvency.

Report quality varies by type. A plain list of wallet addresses is the weakest, because without a signed message you cannot confirm the exchange controls them. A third-party attestation is stronger, but the PCAOB’s Office of the Investor Advocate warned in March 2023 that these reports are point-in-time and give no meaningful assurance about liabilities.

Image source: Spark

The strongest type uses a Merkle tree, which hashes every customer balance into one published root so each user can verify their own balance is included. A plain tree can hide negative balances that shrink the apparent total owed. Zero-knowledge proofs (zk-SNARKs or zk-STARKs) close that hole. For the mechanics, see our step-by-step explanation of how proof of reserves works.

How Major Exchanges Compare

The table reflects methods reported by Spark’s comparison tools in August 2026. Reserve ratios change every cycle, so check the live report before relying on any figure.

Exchange	Method	Verifier	Liabilities covered?	Main weakness
Binance	Merkle tree + zk-SNARK	Self-published, open-source code	Partial (proves no negative balances)	No independent auditor
Kraken	Merkle tree	Independent auditor (The Network Firm)	Yes, total client liabilities	Periodic, not continuous
OKX	Merkle tree + zk-STARK	Hacken	Partial	Asset scope unclear
Bybit	Merkle tree	Hacken, monthly	No, per Spark	Cannot detect theft risk
BitMEX	Merkle sum tree	Self-published, open-source	Yes, cryptographically	Smaller venue

Kraken and BitMEX give the strongest liability evidence. Binance has the best open verification tooling but grades its own work. Spark’s tracker lists Binance BTC at 100.25%, which is a thin margin.

Image source: binance.com/en/proof-of-reserves

What Proof of Reserves Cannot Catch

Hidden liabilities. Off-chain loans and corporate debts are not in a customer Merkle tree. CoinGecko notes the full extent of liabilities may not be known.
Borrowed or re-lent assets. The PCAOB warned that reports give no assurance about whether assets were used or lent.
Snapshot timing. A report describes one moment, and conditions can change right after.
Security failure. Reserves say nothing about whether a wallet can be drained.
Partial asset coverage. Some exchanges prove only major assets, so your holdings may be outside the report.

Bybit is the clearest example. On February 21, 2025, Lazarus Group attackers stole about $1.4 to $1.5 billion in ETH and staking derivatives after compromising the Safe{Wallet} front end that Bybit’s signers used. Its reports had shown reserves above 100%, yet PoR could not warn about a stolen-wallet risk.

Bybit then restored reserves through emergency loans and large deposits, and a Hacken report on February 23 showed in-scope reserves above 100%. That helped customers, but the ratio depended on borrowed funds that the report does not explain.

What You Can Conclude From a Report

Question	Answered by a typical report?	What to conclude
Were assets there on the snapshot date?	Yes	Nothing about days before or after
Do assets exceed customer balances?	Only with liability proof	Assets alone mean nothing
Is my balance included?	Yes, with Merkle verification	Useful, but only for your account
Is the exchange safe from hacks or other debts?	No	Check separately

How to Check a Report Before Trusting It

Confirm the report includes liabilities, not only wallet balances.
Check who verified it. An independent firm beats self-attestation.
Verify your own balance with the exchange’s Merkle tool.
Check that the asset list covers your main holdings.
Compare the report date with today and note the publishing frequency.
Read the scope note, since phrases like “in-scope assets” are carve-outs.
Search the exchange’s incident history and any withdrawal freezes.

My Take

Treat PoR as a filter, not a guarantee. It can expose an obviously insolvent exchange, but it cannot show an exchange is safe. I would rank an exchange higher for including liabilities, using an outside verifier, and publishing often, not for a 150% ratio over a 105% one.

Kraken and BitMEX give the best liability evidence in the table above. Use PoR to decide how much to keep on an exchange. Active traders can accept limited exposure, while long-term holders should move most funds to self-custody. If you are weighing that choice, our breakdown of whether a centralized or decentralized exchange is safer for beginners covers it.

Conclusion

Proof of reserves is useful but narrow. Reports with signed wallets, a liability proof, and an independent verifier tell you something real, while asset-only or self-graded reports tell you much less.

The biggest risks sit outside the report: undisclosed debts, borrowed assets, and security failures like the Bybit theft. Verify your balance, read the scope, and keep only what you need on any exchange.

FAQs

1. Does a reserve ratio above 100% mean an exchange is safe?

No, it only means in-scope assets exceeded in-scope liabilities on one date. Hidden debts, borrowed assets, and hacks sit outside that number.

2. Is a Merkle tree report better than an auditor’s attestation?

It lets you verify your own balance, which an attestation does not. The strongest setup combines both, with an independent firm reviewing a Merkle-based liability proof.

3. Can an exchange fake a proof of reserves report?

Yes, for example, by borrowing assets for the snapshot or leaving liabilities out of scope. Zero-knowledge proofs and independent verifiers make the tree harder to rig, but they do not reveal off-report debts.

4. How often should an exchange publish proof of reserves?

Monthly is common, and more frequent is better because snapshots are easy to game between dates. Frequency matters less than whether liabilities and an independent verifier are included.

5. Should I withdraw funds if a report looks weak?

A weak report is a reason to reduce exposure, not necessarily to panic. Move funds you do not need for trading, and watch for missed publications or shrinking coverage.

References

PCAOB, Investor Advisory on Proof of Reserve Reports: https://pcaobus.org/resources/information-for-investors/investor-advisories/investor-advisory-exercise-caution-with-third-party-verification-proof-of-reserve-reports

Spark, Crypto Exchange Proof of Reserves Tracker: https://www.spark.money/tools/crypto-exchange-proof-of-reserves-tracker

Spark, Crypto Proof of Reserves Attestation Services Compared: https://www.spark.money/tools/crypto-attestation-service-comparison

QuillAudits, Proof of Reserves Audit: https://www.quillaudits.com/blog/web3-security/Proof-of-Reserves-Audit:-How-It-Works-and-Who-Needs-It

CoinGecko, Proof of Reserves methodology: https://blog.coingecko.com/?p=2348

Cet article vous a-t-il été utile ? S'il vous plaît dites-nous ce que vous avez aimé ou n'avez pas aimé dans les commentaires ci-dessous.

About the Author: Chanuka Geekiyanage

Chanuka is a content writer, editor and contributor at Panaprium, specializing in long-form editorial articles. He conducts in-depth research and produces well-structured, carefully edited content with a strong focus on clarity, SEO best practices, and consistent formatting. His work spans lifestyle, fashion, wellness, and technical topics, and all articles are reviewed and refined to meet Panaprium’s editorial standards.

Contre Quoi Nous Luttons

Les groupes multinationaux surproduisent des produits bon marché dans les pays les plus pauvres.
Des usines de production où les conditions s’apparentent à celles d’ateliers clandestins et qui sous-payent les travailleurs.
Des conglomérats médiatiques faisant la promotion de produits non éthiques et non durables.
De mauvais acteurs encourageant la surconsommation par un comportement inconscient.
- - - -
Heureusement, nous avons nos supporters, dont vous.
Panaprium est financé par des lecteurs comme vous qui souhaitent nous rejoindre dans notre mission visant à rendre le monde entièrement respectueux de l'environnement.

Si vous le pouvez, veuillez nous soutenir sur une base mensuelle. Cela prend moins d'une minute et vous aurez un impact important chaque mois. Merci.