Proof of reserves: What it proves — and what it doesn't

FTX's collapse in 2022 rewired how crypto holders think about counterparty risk. In the aftermath, centralized exchanges started leaning on verifiable, on-chain evidence of the assets they claim to hold — proof of reserves became less of a nice-to-have and more of a baseline expectation for trust.

That evidence ranges from static audit reports to full cryptographic proofs. But all of it shares the same limitation: it's a snapshot, and the exchange's actual holdings can look completely different within hours of publication.

TL;DR

• Proof of reserves (PoR) shows that an exchange's on-chain assets match or exceed what it owes its users, at one specific moment in time.
• It's not the same as a traditional audit. PoR generally only covers on-chain assets, not off-chain liabilities like loans or sister-entity debt.
• A good ratio isn't proof of safety. Reserves can be temporarily inflated, methodologies vary wildly between exchanges, and hidden debt can make a seemingly solvent exchange insolvent in reality.
• You can verify some of it yourself. Blockchain explorers, Merkle tree tools, and entity trackers like Arkham let you check an exchange's claims independently.
• Frequency matters. Some exchanges publish PoR in real time; others only after something's gone wrong.

How proof of reserves works

Proof of reserves is on-chain evidence of all the digital assets a platform holds in its own wallets at a given time. In practice, it looks like a dashboard: a list of the exchange's holdings next to an aggregated total of what it owes its customers.

The goal is simple — show that customer balances are backed 1:1 by real, verifiable assets. If an exchange has $6 billion in user liabilities, its PoR should show it controls at least $6 billion across its hot and cold wallets.

Hot wallets handle day-to-day withdrawals; cold wallets hold funds in longer-term, more secure storage. Together, they're meant to prove that even in a worst-case bank run — every user rushing to withdraw at once — the exchange could actually cover it.

A PoR report typically breaks down into four parts:

• Total assets — every public blockchain address the platform controls, with exact token amounts and on-chain balances anyone can verify.
• Total liabilities — a top-line figure of what the exchange owes its users, structured as a Merkle tree so individual account data stays private.
• Assets-to-deposits ratio — a percentage (100% or higher, ideally) showing total assets match or exceed customer deposits. In the chart from the Kraken report above, it is called Collateralization Ratio.
• User verification tool — a place to enter your own account hash and confirm your balance was actually counted in the total.

Where proof of reserves falls short

PoR isn't automatically credible, complete, or sufficient on its own — and sometimes that's by design, with exchanges selectively disclosing scope or methodology. Independent, third-party verification helps, but even that isn't foolproof.

A few specific gaps worth knowing about:

It's just a snapshot

Hacks, fraud, or insider manipulation can happen the moment after the report is published. There's no guarantee reserves stay intact once the evidence goes out.

There's no universal standard

Different exchanges use different methodologies, auditors, and levels of detail, which makes side-by-side comparisons genuinely hard.

It can be gamed

Some exchanges practice "window dressing" — temporarily borrowing assets or using flash loans to inflate reserves right before the snapshot, then returning the funds afterward. This is exactly why oversight from reliable third parties and real anti-manipulation safeguards matter.

Auditors aren't automatically trustworthy either

Expertise and independence vary, and an auditor being paid by the exchange it's reviewing creates an obvious conflict of interest.

Off-chain liabilities can be left out entirely

Hidden loans, sister-entity debt, or other off-chain obligations often don't appear in a PoR at all — which can make an exchange look solvent on paper while it's carrying obligations the report never shows.

Some assets look real but aren't necessarily free and clear

A PoR confirms an asset exists in a wallet; it doesn't confirm that asset is unencumbered. Large debts can hide behind assets that technically show up in the report.

Poor implementation can leak user data

A badly built verification tool can expose account balances or other sensitive details, turning a transparency measure into a privacy risk.

PoR vs. formal audits

Audits are conducted by external firms and cover a much broader scope — both assets and liabilities, on-chain and off. PoR, by contrast, is narrower almost by definition: it's built to prove on-chain solvency at a moment in time, not to certify the full financial health of the business behind it.

How often should exchanges publish PoR?

There's no universal requirement here. The more transparent an exchange wants to appear, the more often it tends to publish — some major exchanges update monthly or close to real time, while others only release a report after something's already gone wrong, which somewhat defeats the purpose.

How to verify proof of reserves yourself

You don't have to take an exchange's PoR page at face value. A few ways to check it independently:

• Cross-check the reserve wallets. Major exchanges publish their reserve wallet addresses. A blockchain explorer — Etherscan for Ethereum, Solscan for Solana — lets you confirm the balances actually match what the PoR claims.
• Use Merkle tree verification tools. A Merkle tree is a cryptographic structure that records every customer balance while keeping identities hidden. Most PoR pages include a tool that lets you paste in your account hash and confirm your own balance was included in the total.

• Check the portfolio breakdown by chain and asset. Blockchain analytics companies like Arkham let you see exactly what an exchange's reserves are made of. If a large chunk sits in illiquid altcoins or the exchange's own native token, that's a real risk factor in a downturn — those assets can be much harder to convert to cash than the headline number suggests.

• Look at balance history over time. The same entity trackers show how an exchange's holdings have shifted. Steady or gradually growing reserves that track the broader market are a good sign. Sudden, unexplained drops — the kind seen in TradeOgre's wallet history — are worth treating as a red flag, since they can point to large withdrawals, a security breach, or funds moving to unidentified wallets.

What you still can't see

Even with all of that, off-chain liabilities remain effectively invisible to an ordinary user. Nothing in a standard PoR report — and none of the blockchain analytics tools built around it, including Arkham — will show you debt that never touched the chain.

That gap matters more than it might seem. An exchange holding $5 billion on-chain but owing creditors $6 billion off-chain is still insolvent, no matter how clean its PoR looks. The report can be entirely accurate and still tell you nothing about the debt sitting just outside its scope.

Top tools for verifying proof of reserves

Arkham isn't the only lens into this, either. A handful of other tools approach the same problem from different angles.

• Nansen's dashboards track stablecoin flows, token concentration, and historical balance shifts with the kind of depth that institutional researchers actually rely on.
• 0xScope uses a knowledge graph to stitch scattered wallet addresses back into a single entity, so a sprawling cluster of Binance or OKX wallets shows up as one unified picture instead of dozens of disconnected addresses.

If digging through individual wallets isn't what you're after, the aggregators are faster.

• DefiLlama's CEX Transparency dashboard is free and gives a running view of exchange reserves and daily inflows and outflows — it also calculates a "clean asset" score, which is a genuinely useful shortcut for spotting how much of a reserve is propped up by an exchange's own native token rather than something more liquid.
• CoinGecko and CoinMarketCap both do a version of the same thing under their exchange listings, aggregating third-party data into a quick visual breakdown of hot and cold wallets, with CMC going a step further by scoring exchanges on a financial transparency scale.

If you already know an exchange's exact cold wallet addresses, going straight to a block explorer like Etherscan or BscScan is the most unfiltered option — no labeling, no dashboard, just the raw balance. The trade-off is that you're on your own for mapping which addresses belong to whom. One more worth a mention: Bubblemaps. It's less about confirming a specific balance and more about seeing the shape of a token's distribution — useful if you're trying to understand how an exchange's holdings are spread across a web of smaller, interconnected wallets rather than sitting in one obvious place. None of these replace checking the actual PoR report. They're just different windows into the same underlying data — some built for speed, some for depth, and some for spotting patterns a plain balance sheet wouldn't show you.

Bottom line: Verify, don't just trust the ratio

Proof of reserves is a real improvement over the total opacity that let FTX collapse without warning, but it was never designed to be a complete picture of an exchange's health. It tells you what's on-chain right now — not what's owed off-chain, not what happens tomorrow, and not whether the auditor behind the report can actually be trusted.

Treat a clean PoR as a starting point, not a verdict. Check the wallets yourself, look at how reserves have moved over time, and stay aware of what the report simply doesn't cover. A 100% ratio is reassuring, but it's a snapshot — not a promise.