A proof-of-reserves (PoR) disclosure is meaningful only to the extent that you can establish what it covers, when it was measured, how the assets and liabilities were checked, and what the verification actually proves. Treat it as dated, limited evidence—not a guarantee that an exchange is solvent or can repay customers later.
What a proof of reserves can—and cannot—tell you
A PoR report generally describes evidence about assets held at a particular time. Its value depends on the report’s scope and procedures: a list of wallet balances alone does not show that the exchange controls those wallets, that all customer and other obligations were counted, or that the assets were free of borrowing or claims by others.
As an Amazon Associate I earn from qualifying purchases.
The PCAOB Office of the Investor Advocate characterizes PoR reports as point-in-time asset verification with significant limitations. In its March 8, 2023 advisory, it warned: “Proof of reserve reports are inherently limited, and customers should exercise extreme caution when relying on them to conclude that there are sufficient assets to meet customer liabilities.” This is investor-advocacy guidance, not a finding about any particular exchange.
- Assets and liabilities are separate questions. A report that identifies assets does not establish that the exchange counted every relevant customer balance and other obligation.
- A snapshot has a timestamp, not a shelf life. It does not establish what happened to the assets or liabilities after the measurement time.
- A ratio is only as useful as its inputs. A stated 1:1 or higher ratio is not proof of full coverage if the figures use different dates, entities, asset definitions, or liability populations.
How to evaluate a disclosure step by step
- Locate the underlying report or verification page. Record its title, the exchange or entity that issued it, the verifier, the snapshot date and time, and the publication date. Treat a marketing statement as the issuer’s claim unless the underlying evidence supports it.
- Map the scope. Note which legal entities, products, customer account types, assets, networks, and wallets are included. Look for exclusions and whether liabilities beyond customer crypto balances are counted. The SEC has noted that management can influence matters such as assessment frequency, wallet and account selection, assurance level, provider type, and which results are made public.
- Check whether your own balance is included. If the exchange supplies a customer-specific Merkle proof, follow its stated verification method. Confirm that the balance and asset set correspond to the disclosed snapshot, and keep the verification record ID and time. This checks your record against the supplied commitment; it does not establish that the commitment includes every liability.
- Inspect evidence of wallet control. Check whether wallet addresses are identified and whether the report explains how control was demonstrated—for example, through signed messages or controlled transactions. Compare on-chain balances at the stated snapshot with the report’s figures where that comparison is possible. An address list without a control procedure leaves an important evidentiary gap.
- Compare assets and liabilities on matching terms. Check that their dates, units, and entity scope align. Look for treatment of assets that are borrowed, pledged, lent, or otherwise unavailable, and for obligations outside crypto customer balances. Do not infer full coverage from a headline ratio alone.
- Read the verifier’s engagement and procedures. Identify who performed the work, their independence and professional role, the criteria used, procedures performed, assurance level, and any exceptions. Determine whether it is an audit, agreed-upon procedures, or another form of engagement; those labels are not interchangeable.
- Assess freshness and continuity. Note whether evidence is recurring and whether the exchange explains what happens between snapshots. More frequent snapshots may make evidence fresher, but do not fix omissions in asset or liability scope.
- State only the conclusion the evidence supports. For example: “At the stated date, the disclosed wallets held the reported assets, and this account appeared in the disclosed liabilities commitment.” Do not turn that into a claim that the exchange is solvent unless broader evidence supports it.
What a Merkle proof verifies
A Merkle tree combines individual records into a root value, or commitment. A customer can use a supplied proof to check whether their record and balance follow a path to that root. This can allow individual inclusion checks without publishing every customer’s information.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
The crucial distinction is inclusion versus completeness. A valid proof supports the claim that the supplied record is included under the supplied root. It does not, by itself, show how the exchange built the underlying records or whether all customer accounts and relevant obligations were included. Ask how the exchange handles negative balances, other liabilities, omitted accounts or entities, and reconciliation of the committed records to the full liability population.
Binance describes a user verification process using Merkle structures and zk-SNARK validation, along with individual verification records. That is an issuer-described method, not independent proof that the exchange’s complete liabilities are represented. The same boundary applies to any exchange’s customer-level inclusion tool.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
How to compare two PoR disclosures
There is no universal scoring standard for PoR. The criteria below are practical evaluation axes drawn from regulator cautions and the mechanics described in exchange materials—not a formally adopted regulatory rating system.
| What to compare | Stronger evidence | Warning sign |
|---|---|---|
| Snapshot freshness | Exact measurement timestamp and a stated recurring publication cadence. | An undated or stale snapshot, or no way to identify when balances were measured. |
| Asset scope | Named entities, assets, networks, and wallets, with exclusions disclosed. | Unspecified entities or an unexplained selection of wallets. |
| Asset control | A described, reproducible procedure showing control at the snapshot. | Addresses or balances listed without evidence of control. |
| Liability scope | An explanation of the customer and other obligations counted, the population covered, and how totals were reconciled. | A customer-level proof with no explanation of the total liability population. |
| Customer verification | A method for customers to validate their own record against the disclosed commitment. | Reliance on a screenshot or account balance page without a verification method. |
| Borrowing and encumbrances | Clear treatment of borrowed, pledged, lent, or otherwise unavailable assets. | No explanation of whether listed assets are free to meet customer claims. |
| Verifier and assurance | Provider, independence, criteria, procedures, assurance level, and exceptions are described. | “Audit” used as a label without a clear scope or applicable standards. |
| Continuity | Repeated evidence and an explanation of asset and liability movements between snapshots. | A one-time point-in-time claim presented as evidence of enduring solvency. |
How to read “audit,” “attestation,” and “verification”
Do not assume that a report is a financial-statement audit because it uses words such as “audit,” “attestation,” “verification,” or “agreed-upon procedures.” Read the engagement itself to determine what work was done and what conclusion, if any, the provider offers.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
The SEC warns that PoR and similar reports may have no specific engagement requirements, may omit complete financial statements and liabilities, and may provide no assurance. The PCAOB Investor Advocate says PoR engagements are not conducted under PCAOB auditing standards and are not subject to PCAOB inspection. An accounting firm’s name alone does not make the work a regulated financial-statement audit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Exchange examples: useful methods, bounded conclusions
Binance
Binance’s PoR materials describe a Merkle-tree and zk-SNARK process and user-specific verification records. Those features illustrate how an exchange may let a customer check inclusion; they do not, on their own, independently establish that every liability is included or that assets remain available after the snapshot.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Bybit
A Bybit/Hacken report dated March 18, 2026 describes a specific reserve snapshot and says it checked outgoing transactions for address control and recorded a liabilities Merkle root. Those are claims about that engagement and date only; they should not be generalized to other snapshots, entities, or exchanges.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →CoinGecko
CoinGecko published an explanatory guide updated September 2, 2026 on assessing exchange reserve disclosures and customer Merkle inclusion. It can help explain the concepts, but it is secondary guidance rather than the primary basis for interpreting assurance limits.
Do reserve rules for tokens set a universal exchange standard?
No. Regulatory requirements can apply to particular asset types and issuers rather than to every centralized exchange. The cited Basel framework provisions concern qualifying cryptoassets and describe public reserve mandates and disclosures, operational resilience, and an external audit at least annually for in-scope reserve assets. MiCA Article 36 concerns issuers of asset-referenced tokens: it requires reserve assets to be maintained and segregated and provides for independent reserve audits every six months. Applicability depends on the entity, product, jurisdiction, and current law; neither provision should be presented as a universal exchange PoR standard.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
