KoinlyticsAfter FTX, every major exchange scrambled to publish proof of reserves (PoR). Most PoRs are weaker than the marketing implies. Understanding what a good PoR actually looks like matters if you leave funds on an exchange.
What PoR is supposed to prove
That the exchange holds enough crypto reserves to cover user balances. Two components:
- Proof of reserves. Cryptographic proof that exchange controls specific wallets holding X crypto.
- Proof of liabilities. Cryptographic proof of what customers are owed.
Only when both are proven do you know reserves >= liabilities.
Merkle-tree PoR
- Exchange builds a Merkle tree of all user balances (each leaf = one user's balance).
- Publishes the Merkle root.
- Each user can query their own balance and receive a proof it was included at the snapshot.
- Aggregate sum of all leaves = total liabilities.
- Exchange proves it controls wallets summing >= that.
Where most PoRs fall short
- Snapshot only. Exchange could borrow funds day-of, return next day.
- Liabilities proven only for users who check. Massive user base = few actually check.
- Off-balance-sheet debts not counted.
- Exchange still can commingle funds between snapshots.
What real-time PoR would look like
Zero-knowledge proofs of continuous solvency. Signal continuously to a smart contract that reserves >= liabilities. No snapshot game-play possible. Coming but not standard yet.
Who does PoR well
- Kraken: audited by Armanino, Merkle-tree with third-party verification.
- Coinbase: SOC 1 Type 2 + regular attestations, but no on-chain Merkle-tree.
- Binance: publishes Merkle-tree PoR, but auditor withdrew in 2023 citing complexity.
- Bitstamp: quarterly reserve reports.
The takeaway
PoR is progress but not proof of solvency. It is one data point. Combine with: exchange's regulatory jurisdiction, insurance funds, and (most importantly) how much of your holdings you actually leave there.