Crypto exchange proof of reserves: how to verify it yourself

Crypto exchange proof of reserves (PoR) is a public check that an exchange holds at least as many coins as it owes its customers. A sound report has two halves: the exchange shows the wallet addresses it controls, and separately commits to the total of customer balances in a Merkle tree, where every customer can find their own account. You can check it yourself in a few minutes, but the method has hard limits: PoR is a snapshot on one date, not an audit.

What proof of reserves is and where it came from

The idea is older than most exchanges. As Vitalik Buterin recalls in his essay "Having a safe CEX: proof of solvency and beyond" (Nov. 19, 2022), Mt. Gox proved it had funds back in 2011 by moving 424,242 BTC to a pre-announced address. In 2013 a technique appeared for the other half: proving the total size of customer deposits without revealing everyone's balance. Together the two parts are called proof of solvency:

• proof of assets: the exchange controls addresses holding a given amount of coins;
• proof of liabilities: the exchange owes customers a given amount, and no customer has been left out.

PoR went mainstream after FTX collapsed in November 2022. According to the bankruptcy team's report, the exchange owed customers about $8.7 billion, and their assets had been commingled with company money (FXStreet). Large venues then began publishing reserve reports on a regular schedule. PoR is not the same thing as the on-chain metric "exchange reserves", which we cover in a separate guide: there, analysts count coins on known addresses; here, the exchange itself reports to its customers.

How the Merkle tree in a reserve report works

A list of funded addresses is only half the job. Kraken, in a post on its approach, calls proving the assets "only half the battle": without the liabilities total, nobody knows how many coins should be there in the first place.

Liabilities are proven with a Merkle sum tree. It works like this (following Buterin's description):

1. For each customer the exchange creates a "leaf": the balance plus a hash of the customer's ID mixed with a random salt. An outsider cannot tell who the leaf belongs to.
2. Leaves are combined in pairs. Each parent node stores the sum of its two children's balances and a hash of both.
3. This repeats up to a single node at the top, the root. It holds the sum of all customer balances.
4. The exchange publishes the root. Each customer receives their branch: the sibling nodes from their leaf up to the root.
5. The customer recomputes the hashes along the branch. If the result matches the published root, their balance is counted in the total.

No balance can be changed quietly, because the root would change. Buterin illustrates the weak spot of a plain tree with an example: an exchange with 1,390 ETH of liabilities and 890 ETH of reserves needs to hide 500 ETH, so it inserts a made-up account with a balance of -500 ETH. In a sum tree this surfaces for customers in the same branch, but only if they actually check their proofs. That is the defining property of the method: it gets stronger with every customer who opens the report.

Why exchanges added zk-SNARKs and zk-STARKs

A plain tree leaks information (a neighbor in your branch sees someone else's sums) and depends on customers doing the checking. Buterin therefore proposed zero-knowledge proofs: the exchange proves mathematically that every balance in the tree is non-negative and that they add up to the declared total, without revealing a single balance.

The largest venues did exactly that. Binance, according to its reserves page, uses a zk-SNARK: the circuit checks that each account is included in the sum and that a user's net balance is not below zero; the code is in a public repository. OKX uses zk-STARKs and publishes its own verification tools. The cost is time: per a Binance announcement dated Nov. 12, 2026, generating the full proof for a fresh snapshot takes roughly 40 to 50 hours of computation.

How to verify an exchange's proof of reserves, step by step

Interfaces differ, the logic does not. This is the general order; the exact menu names are on your exchange's PoR page.

1. Find the report page. On Binance it is Wallet → Verification, on Kraken the account icon → Proof of Reserves, on OKX the PoR reports section.
2. Check the snapshot date. A three-month-old report says little about today.
3. Make sure both halves are there: funded addresses and liabilities (a Merkle tree), not just a wallet list.
4. Read the reserve ratio for each asset separately. 100% or more means customers' BTC is backed by BTC, and USDT by USDT.
5. Find your leaf. The exchange shows a record identifier (Record ID, Merkle Leaf) and your balances at the snapshot. Compare them with your own history.
6. Verify the path to the root. At Kraken, the first 16 characters of your Merkle Leaf ID go into the external accountant's tool; at OKX, you save the proof data to a file and run it through an open-source validator.
7. Spot-check the addresses in a block explorer: do they hold what the report claims?

Steps 1 to 5 take a few minutes and no technical skill. Steps 6 and 7 are harder, but they are what turns "the exchange said so" into "I checked".

What it looks like in numbers: Binance, OKX and Kraken in November 2026

The freshest example is Binance after the Oct. 29 hack. The exchange said it put more than $6.34 billion of its own funds toward covering the losses and took a new reserve snapshot at 00:00 UTC on Nov. 12 covering 198 tokens (details in our news report).

What sits behind the percentages. Per Crypto News Flash, Binance's snapshot shows 688,284 BTC against 687,912 BTC of net customer balances, a cushion of about 372 BTC. As of Nov. 13, 2026, 1:00 PM ET, bitcoin traded at $68,938 (our data, see the dashboard); at that price the cushion is roughly $25.6 million against liabilities of about $47.4 billion. We have not independently verified these Binance figures. At OKX, with 156,609 BTC of customer balances and a 108% ratio, the cushion works out to about 12,500 BTC by our calculation, or roughly $0.86 billion at the same price.

Two observations. First, the ratio is counted in coins, not dollars. Bitcoin was down 4.1% over 24 hours and 9.1% over the week by the afternoon of Nov. 13, but that does not change BTC-for-BTC coverage. Second, 100.05% and 108% are both "above one hundred", yet the cushions differ more than thirtyfold. A thin cushion does not signal trouble; it only shows how much the exchange keeps on top of customer funds.

Limitations: what proof of reserves does not prove

On March 8, 2023, the US audit regulator PCAOB issued an investor advisory. As reported by Accounting Today, it said that "PoR engagements are not audits and, consequently, the related reports do not provide any meaningful assurance". Even earlier, on Dec. 16, 2022, audit firm Mazars paused its proof-of-reserves work for crypto exchanges (clients included Binance, KuCoin and Crypto.com), citing "concerns regarding the way these reports are understood by the public" (CNBC).

Kraken lists several of these points itself on its report page: the procedure does not confirm exclusive possession of private keys, cannot detect hidden liabilities and does not prove that funds were not borrowed to pass the review. The PCAOB adds, in the same advisory: "if the assets were borrowed by the crypto entity at the time of the PoR engagement, investors would not know".

The Binance episode shows one more thing: PoR does not protect against a hack. Reserve reports were being published before the breach, and the hot wallets were drained anyway. Reserves answer "is there enough to pay", not "is it well guarded".

Common mistakes when reading reserve reports

• Treating a wallet list as proof. Addresses without liabilities show assets only. A billion in wallets means nothing if three billion is owed to customers.
• Looking at one overall percentage. A surplus in one token does not fill a hole in another. Read BTC, ETH and stablecoins separately.
• Overlooking the exchange's own token in reserves. It is liquid only as long as the exchange itself is alive.
• Confusing PoR with a financial statement audit. An audit examines the whole balance sheet, including debts and controls; PoR is a narrow procedure on one date.
• Never checking your own leaf. The method relies on customers: if nobody compares balances, nobody notices invented entries.
• Taking PoR as a reason to keep everything on an exchange. For long-term storage there is still the cold wallet; other criteria for a venue are in "How to choose a crypto exchange" and our exchange ranking.

FAQ

Is proof of reserves an audit? No. According to the PCAOB advisory of March 8, 2023, these engagements are not audits and are not subject to audit standards. A PoR report is a snapshot of assets and customer balances on one date.

What does a 100% reserve ratio mean? At the snapshot, the exchange held exactly as many coins of that asset as its customer accounts show. Anything above 100% is the venue's own money in that asset.

How often do exchanges publish reports? It varies. OKX released its 49th monthly report in November 2026; the latest snapshot on Kraken's page is dated Sept. 30, 2026. The more frequent the snapshots, the harder it is to "borrow" coins for the check.

Could an exchange borrow coins for snapshot day? In theory yes, and the report itself would not reveal it. Frequent snapshots, an independent reviewer and disclosed liabilities reduce the risk; in his essay Buterin suggests eventually updating the proof after every block.

This is not investment advice.