Proof of Reserves Explained: What It Proves and What It Misses

Proof of reserves is a report showing the crypto an exchange holds at one moment, ideally compared with what it owes customers, plus a way to check that your own balance was counted. It is not an audit, and on its own it does not prove the exchange is solvent.

The warning comes from the US body that oversees the audits of public companies. Staff at the Public Company Accounting Oversight Board (PCAOB) issued an investor advisory in March 2023 that said proof of reserves engagements are not audits and that the reports do not provide any meaningful assurance. This guide explains what the reports do show, what they leave out, and how to read one. Nothing here is a claim about any exchange’s finances.

What is proof of reserves?

Proof of reserves is a check that compares what a crypto exchange holds on the blockchain with what it owes all of its customers. If holdings are at least as large as customer balances, reserves cover customers at that moment. Kraken, which publishes one, describes its review as “a procedure performed by an independent 3rd party accountant.”

The words “at that moment” matter. A report is a photo, not a video.

How does a Merkle tree let you check your own balance?

A Merkle tree lets you check your own balance by folding every customer balance into one short fingerprint, called the root, that changes if any single balance changes. Kraken calls it “a privacy-friendly data structure that encapsulates all client balances.” You see only the path from your own entry up to the root, never anyone else’s balance.

Ethereum co-founder Vitalik Buterin wrote about this method in November 2022. With a properly built tree, he said, “the user would then have a guarantee that their balance is correctly included as part of the total.”

The method has a catch. Buterin described an exchange hiding a shortfall by adding a fake account with a negative balance, which better designs block. But he noted the exchange “could also just exclude those users from the tree and have the same effect.” That is why customer checks matter: the more people check, the harder a missing account is to hide.

Why is proof of assets alone not enough?

Proof of assets alone is not enough because a pile of coins only means something next to the list of what is owed. Buterin’s post notes that in 2011 Mt. Gox, then the largest Bitcoin exchange, proved it had funds by moving 424,242 BTC to a pre-announced address. That showed the coins existed, not what was owed against them.

Kraken made the same argument in a December 2022 blog post titled “Proof of Reserves or Proof of Nothing.” Buterin put the two halves together: prove what is owed and what is held, “then you have a proof of solvency: you’ve proven the exchange has the funds to pay back all of its depositors.”

A made-up example shows why. An exchange shows 100 coins on-chain. If it owes customers 120, there is a 20-coin hole, and a page that only shows the 100 would never tell you.

Is proof of reserves an audit?

Proof of reserves is not an audit. A financial statement audit examines a company’s full accounts under formal auditing standards. A proof of reserves report is usually narrower: a check of specific numbers at a specific time. The PCAOB’s advisory said these engagements are not equivalent to an audit and are not conducted under PCAOB auditing standards.

Feature	Financial statement audit	Proof of reserves report
Scope	The company’s full financial statements	Selected assets, sometimes customer balances
Timing	A full reporting period	A single snapshot date
Liabilities	Included	May not be covered, per the PCAOB
Who picks the procedures	Set by auditing standards	May be directed by the company’s management, per the PCAOB
Published	Required for public companies	Usually voluntary

“Agreed-upon procedures” means the company and the accountant agree on a list of checks, and the report states what was found without an overall opinion. The PCAOB also warned that a report is a snapshot of one moment, and that its procedures may not address the company’s liabilities or whether assets had been borrowed to make holdings look sufficient. It said customers “should exercise extreme caution when relying on them.”

Kraken’s own page lists similar limits. It says the procedure “cannot identify any hidden encumbrances or prove that funds had not been borrowed for purposes of passing the review,” and cannot prove exclusive possession of private keys that may have been duplicated by an attacker.

How do you check your balance on a proof of reserves page?

You check your balance on a proof of reserves page by finding your account’s entry and verifying it against the published root. Using Kraken’s page as an example (menus differ by exchange and change over time):

1. Find the section. Kraken says it sits under the account icon in the Kraken Pro interface.
2. Get your record ID, which Kraken says identifies your account details and the review ID for that report date.
3. Get your Merkle leaf, which ties your account to the balances you held at the snapshot.
4. Verify it with Kraken’s tool, the outside accountant’s tool, or your own code.
5. Check the scope. Kraken says verification only reflects balances “in the in-scope assets at the time of the review,” and not balances held in assets that are not in scope.

If the coin you hold wasn’t in scope, a green tick says nothing about it. Using the accountant’s tool rather than only the exchange’s own page is Bullrunners’ suggestion, not Kraken’s.

Why does a proof of reserves report matter to your money?

A proof of reserves report matters because a promise is not a proof. FTX founder Sam Bankman-Fried was convicted in November 2023 of seven counts, including wire fraud and conspiracy, and sentenced in March 2024 to 25 years in prison, according to the US Attorney’s Office for the Southern District of New York. Then-US Attorney Damian Williams described it as stealing over $8 billion of his customers’ money.

The reports still have value. Kraken’s 2022 post says involving an auditor “is not a complete guarantee of accuracy, but acts as an additional increment of rigor.” A report that includes liabilities, lets you check your balance and names the firm is a real step up from a promise. Buterin’s post says the ideal long-term solution is self-custody, though that brings its own risks. Our guides to exchange shutdowns and whether Coinbase can freeze your crypto cover the other side of custody risk.

How to read a proof of reserves report: 5 questions

1. Does it show what’s owed to customers, or only what’s held? Holdings alone are half a picture.
2. Can you check that your own balance is included, with a record ID or Merkle tree tool?
3. Who checked it, is the firm named, and is it an audit, an attestation or agreed-upon procedures?
4. What date was the snapshot, and how often is it repeated?
5. What does it say it can’t prove? Look for borrowed funds, hidden claims on the coins, internal controls and out-of-scope assets.

Then ask one about yourself: how much do you keep on that platform, and why is it there?

What to check next

Check the date of the latest snapshot on each exchange you use, and whether the coins you hold were in scope. If you move coins off an exchange, our guides on hot and cold wallets and test transactions cover the next steps.

Sources

• PCAOB Investor Advisory: Exercise Caution With Third-Party Verification/Proof of Reserve Reports (Mar 8, 2023)
• Kraken: Proof of Reserves
• Vitalik Buterin: Having a safe CEX: proof of solvency and beyond (Nov 19, 2022)
• Kraken Blog: Proof of Reserves or Proof of Nothing (Dec 12, 2022)
• US Attorney’s Office SDNY: Samuel Bankman-Fried Sentenced To 25 Years In Prison (Mar 28, 2024)