Proof of Reserves (PoR)

Proof of reserves (PoR) is a process in which a cryptocurrency exchange, custodian or token issuer demonstrates that it holds assets at least equal to the balances it owes its customers. It usually combines a public list of wallet addresses the firm controls with a cryptographic summary of customer balances that each user can check for their own account.

PoR became widely used after the collapse of FTX in November 2022, when customers discovered that deposits had been used elsewhere. Many centralized exchanges (CEXs) then began publishing reserve reports. It is related to, but weaker than, a full financial audit, and differs from the reserve attestations that a stablecoin issuer publishes for the cash and bonds backing its tokens.

Imagine a cloakroom that holds coats for a thousand guests. A nervous guest asks whether all the coats are still there. The attendant opens the doors so anyone can count the coats, and gives each guest a way to confirm their own ticket is on the list. If the number of coats matches the number of tickets, the cloakroom looks honest.

Proof of reserves does that for a crypto exchange. The weakness is also visible in the picture: counting coats does not reveal whether the cloakroom has borrowed coats from next door for the day, or has promised the same coat to two guests.

A typical PoR exercise has two halves:

1. Assets. The firm proves control of on-chain wallets, often by signing a message with the private keys of a custodial wallet or moving a small amount at an agreed time. Anyone can read the balances on the public blockchain.
2. Liabilities. The firm takes a snapshot of every customer balance and builds a Merkle tree: each balance is hashed, pairs of hashes are combined again and again, and a single "root" hash summarises all of them. Customers receive a path that lets them confirm their balance is included in that root without seeing anyone else's.

The reserve ratio is then:

Here "assets held" is the verified on-chain balance of a given coin and "customer liabilities" is the total of customer balances in the same coin. If an exchange controls 10,500 Bitcoin (BTC) in verified wallets and owes customers 10,000 BTC, the ratio is $10{,}500 \div 10{,}000 \times 100\% = 105\%$, meaning every customer bitcoin is covered with a 5% buffer.

Newer designs use zero-knowledge proofs (ZKPs) to show that no customer balance is negative and that totals add up, without revealing the balances themselves.

Kraken published one of the first reserve audits in 2014, after the failure of Mt. Gox earlier that year. Interest faded until 2022, when the failures of Celsius, Voyager and FTX made crypto custody risk front-page news. Withdrawals surged at several platforms in a pattern much like a bank run, and customers found that balances shown in their accounts were unsecured claims in bankruptcy. Several large exchanges launched Merkle-tree reports within weeks, and some hired accounting firms to review them; at least one firm, Mazars, stepped back from this work in December 2022. As of 2026, exchanges such as Kraken, Binance and OKX publish recurring reports, and some jurisdictions expect regular reserve reporting as part of licensing.

The US Public Company Accounting Oversight Board warned investors in December 2022 that PoR reports are not audits and give limited assurance. Key gaps include:

• Liabilities beyond customers. PoR rarely covers loans, debts or other obligations, so a firm can hold all customer coins yet still be insolvent.
• Borrowed assets. Coins can be borrowed for the snapshot day and returned afterwards.
• Encumbrance. Assets may be pledged as collateral elsewhere.
• Incomplete liabilities. Users can check that their balance is included, but not that every account is.
• Point in time. A snapshot says nothing about the next day.

For this reason, supporters see PoR as one part of a wider set of protections: segregation of funds, independent audited financials, licensing under regimes such as MiCA (Markets in Crypto-Assets Regulation), client money-style rules on how customer assets are held, and the option of keeping coins in a non-custodial wallet rather than on an exchange.

The term is also used for tokens backed by off-chain assets. Issuers of fiat-backed stablecoins such as Tether (USDT) and USDC publish periodic attestations from accounting firms on the reserves behind their tokens. Wrapped tokens and gold-backed tokens use similar reports, and some projects feed reserve data into smart contracts through oracles so that minting stops automatically if reserves fall short. These reports face the same questions about scope and timing as exchange PoR, and do not replace a full audit.

• Kraken: Proof of Reserves