Proof of Reserves Won’t Guarantee Trust in Crypto Exchanges

Proof-of-reserves (PoR) is increasingly cited as a transparency tool in crypto markets, but it remains a partial signal rather than a guarantee. At its core, PoR is a public demonstration that a custodian holds the assets it claims to hold for users, typically verified through cryptographic methods and on-chain transparency. When exchanges publish PoR reports, they aim to show verifiable asset custody at a specific moment in time. Yet critics note that a snapshot cannot fully capture a platform’s solvency, liquidity, or governance controls—factors that matter when withdrawals spike or markets turn volatile.

As exchanges continue to publish PoR documentation, the limits of the methodology are becoming clearer. The industry has observed that PoR reports can provide comfort about asset custody but do not inherently prove that a platform can meet all of its obligations. The conversation intensified after past crises in the sector, prompting regulators and standard-setters to stress the need for broader disclosures and more robust assurance frameworks. A recent data point cited by a major exchange indicated that user asset balances publicly verified through PoR had reached substantial levels by the end of 2025, underscoring the growing appetite for public verifiability in a sector that has faced high-profile losses and liquidity strains.

For readers seeking a deeper dive, PoR is frequently discussed alongside audits, attestations, and other verification approaches. These discussions reflect a broader market push toward greater transparency, while also highlighting the ongoing debate over what PoR can and cannot guarantee. The ongoing evolution of PoR practice—how liabilities are captured, how encumbrances are disclosed, and how verification processes are governed—will shape how investors and users assess risk in the months ahead. See the broader explainer on what PoR reports cover and how they differ from traditional audits for additional context.

Did you know? On Dec. 31, 2025, Binance’s CEO wrote that the platform’s user asset balances publicly verified through proof-of-reserves had reached $162.8 billion.

What PoR proves and how it is usually done

In practice, PoR involves two checks: assets and, ideally, liabilities.

On the asset side, exchanges demonstrate control over certain wallets by publishing addresses or signing messages, which allows outsiders to verify that the platform possesses the claimed assets. For liabilities, many operators create a snapshot of user balances and commit it to a Merkle tree (often a Merkle-sum tree). Each user can confirm that their balance is included without exposing everyone’s data. When implemented rigorously, PoR aims to prove that on-chain assets cover customer balances at a specific moment. Binance, for example, has offered a verification page where individual users can confirm their inclusion in the PoR snapshot through cryptographic proofs based on a Merkle tree.

How an exchange can “pass PoR” and still be risky

PoR can improve transparency, but it shouldn’t be relied on as the sole measure of a company’s financial health.

A straightforward asset snapshot does not reveal whether a platform has sufficient liabilities to meet all obligations, especially under stress. Even if on-chain wallets appear robust, a full view of liabilities may be incomplete or narrowly defined—excluding loans, derivatives exposure, legal claims, or off-chain payables. That means a platform can show funds exist on its books while still facing liquidity or solvency challenges when customers seek to withdraw en masse.

Another limitation: a single attestation captures only a moment in time. It does not reveal the balance sheet trajectory before or after the report. In theory, assets could be temporarily borrowed to improve the snapshot and then moved back afterward, masking real risk. Complex encumbrances—assets pledged as collateral, lent out, or otherwise tied up—often do not appear in standard PoR disclosures, leaving users with an incomplete picture of what remains available during a run. Furthermore, liquidity risk and asset valuation can be misleading; simply holding assets is not the same as being able to liquidate them quickly and at scale in stressed conditions.

As a result, many observers argue that PoR should be complemented by broader disclosures and more explicit risk reporting. This includes clearer information about liquidity profiles, the concentration of reserves, and the degree to which assets are encumbered or held in restricted or less liquid markets. A growing body of work points to the need for better disclosure around how assets would be valued in a crisis and how quickly they could be realized in practice.

PoR isn’t the same as an audit

A lot of the trust problem comes from a mismatch in expectations.

Many users treat PoR as a safety certificate, but in truth, many PoR engagements align more closely with agreed-upon procedures (AUPs). In AUP engagements, practitioners perform specific checks and report what was found without delivering an audit-style assurance opinion about the company’s overall health. Audits or reviews are conducted within formal frameworks designed to provide an assurance conclusion, whereas AUPs are narrower in scope and leave interpretation to the reader.

Regulators have underscored this gap. The Public Company Accounting Oversight Board has warned that PoR reports are inherently limited and should not be treated as proof that an exchange holds sufficient assets to meet liabilities, given the lack of consistency in how PoR work is performed and described. This scrutiny intensified after 2022, when the industry reevaluated reporting practices following high-profile events. In that period, some auditing firms paused PoR work for crypto clients amid concerns about how such reports might be understood by the public.

What’s a practical trust stack, then?

PoR can be a starting point, but real trust comes from pairing transparency with proof of solvency, strong governance and clear operational controls.

The path forward involves proving solvency, not just assets. Merkle-based liability proofs, together with newer zero-knowledge approaches, aim to verify that liabilities are covered without exposing individual balances. Beyond transparency, it becomes essential to demonstrate robust governance and operational controls—key elements such as private-key management, controlled access permissions, change management, incident response, segregation of duties, and custody workflows. Institutional due diligence increasingly leans on SOC-style reporting and related frameworks that measure controls over time, not just a single balance snapshot. Clarity around liquidity and encumbrances is crucial: solvency on paper must be matched by the ability to convert reserves into liquid assets quickly if needed.

Ultimately, credible oversight hinges on governance and disclosure. Clear custody frameworks, explicit conflict management, and consistent reporting—particularly for products that add obligations such as yield strategies, margin, or lending—are essential to align user expectations with actual risk. In this sense, PoR should be viewed as one piece of a broader governance puzzle, not the sole marker of trust.

PoR helps, but it can’t replace accountability

PoR is better than nothing, but it remains a narrow, point-in-time check (even though it’s often marketed like a safety certificate).

When evaluating PoR reports, readers should consider several guardrails. Are liabilities included, or is the report assets-only? What is in scope—do the notes include margin accounts, yield products, loans, or off-chain obligations? Is the report a single snapshot or an ongoing process? Are reserves unencumbered, or are some assets pledged or tied up? And what exactly does the engagement cover—are we looking at a full audit-like assurance or a limited-scope procedure?

1. Are liabilities included, or is it assets only? Assets-only reporting cannot demonstrate solvency.

2. What is in scope? Are margin, yield products, loans or offchain obligations excluded?

3. Is it reporting a snapshot or ongoing? A single date can be dressed up. Consistency matters.

4. Are reserves unencumbered? “Held” is not the same as “available during stress.”

5. What kind of engagement is it? Many PoR reports are limited in scope and should not be read like an audit opinion.