How to Check a Crypto Exchange's Proof of Reserves
Proof of reserves (PoR) is a cryptographic auditing process by which a cryptocurrency exchange publicly demonstrates it holds sufficient assets to cover all customer deposits, enabling users to independently verify their funds are fully backed without relying solely on the exchange’s own claims. The collapse of FTX in November 2022 (which held a fraction of the customer funds it was supposed to hold) triggered widespread demand for exchanges to provide verifiable evidence of solvency rather than unaudited statements. A proof of reserves audit uses cryptographic Merkle tree proofs to enable individual users to verify their specific account balance is included in the total assets the exchange claims to hold, without revealing any other customer’s data. Understanding how to check an exchange’s proof of reserves is one of the most important components of exchange due diligence for anyone holding significant balances on a centralised exchange. The exchange custody risk guide and the exchange bankruptcy risk guide provide the broader framework for understanding what is at stake when funds are held on a platform.
What Is Proof of Reserves and Why It Matters
A traditional financial audit requires a third party to review an institution’s balance sheets and attest to their accuracy, but these audits are not individually verifiable by customers. Proof of reserves in crypto uses a different approach: the exchange publishes a cryptographic hash (a unique fingerprint) of all customer balances at a specific snapshot date, along with on-chain evidence it controls wallet addresses holding at least that total amount in each cryptocurrency. Each individual customer can then use a Merkle proof checker (typically provided by the exchange or available as open-source code) to verify their specific balance is included in the published snapshot total. If a balance is correctly included and the on-chain wallet balances meet or exceed the total claimed, there is cryptographic evidence the exchange held sufficient funds to cover that balance at the time of the audit. This is meaningfully stronger verification than “our auditors say we’re solvent,” though it still has important limitations that every investor should understand clearly before treating PoR as a complete solvency guarantee.
The limitations of proof of reserves are as important as the verification itself. PoR audits are point-in-time snapshots, not continuous monitoring: an exchange could borrow assets to appear fully reserved at the snapshot date and return them immediately after. The audit also does not directly verify that the exchange has no outstanding liabilities: an exchange could hold exactly as many assets as user deposits while simultaneously owing large amounts to creditors, meaning the net position is negative even though the PoR numerically checks out. A more complete solvency verification requires both proof of reserves (assets) and proof of liabilities (all outstanding debts), which very few exchanges have published as of 2026. The DYOR methodology applied to exchange selection uses PoR as one factor among several, alongside regulatory licensing, withdrawal track record, management transparency, and security practices. The exchange bankruptcy risk guide covers how exchange insolvency plays out for depositors and what the realistic recovery prospects are.
The cryptographic tool used in most proof of reserves implementations is the Merkle tree, where each customer’s account balance (identified by a hashed user ID) is a “leaf node.” Each leaf’s hash is combined mathematically with its neighbour to create a “branch” hash, and these branches are combined upward until a single “root hash” at the top represents the entire set of balances. The exchange publishes this Merkle root and the on-chain total. Each user receives a “Merkle path” (the specific set of hashes needed to verify their leaf is included) and can independently confirm their balance is part of the committed total without any other customer’s data being revealed. The on-chain component of the audit then verifies the wallet addresses the exchange claims to control actually hold the stated balances, using publicly accessible blockchain explorer data for Bitcoin, Ethereum, and other supported assets. Combining both the Merkle liability verification and the on-chain asset verification provides the strongest currently available evidence of exchange solvency.
Exchanges That Publish Regular Proof
The exchanges that publish regular proof of reserves include Binance, Kraken, OKX, and Crypto.com internationally, with audit frequency ranging from monthly to quarterly. The named third-party auditor conducting the PoR engagement matters significantly: independent audit firms with established crypto custody verification practices provide meaningfully more assurance than an exchange conducting and publishing its own internal PoR calculation. Checking the audit date (how recent the most recent PoR is) and the coverage (which assets are included) are two additional data points in a thorough exchange evaluation. For the best Australian exchanges including CoinSpot, Swyftx, and BTC Markets, the regulatory oversight by AUSTRAC and ASIC provides a different type of assurance from blockchain-based PoR, relying instead on compliance reporting obligations and financial account auditing under Australian law.
The broader context of proof of reserves is the fundamental tension between the convenience of centralised exchange custody and the security of self-custody. Even a perfect real-time proof of reserves cannot protect against exchange hacks where funds are stolen rather than simply misrepresented, exchange insolvency driven by off-chain liabilities, regulatory freezes of withdrawal access, or exchange decisions to restrict specific accounts. The not your keys, not your crypto principle is the foundational answer to exchange custody risk: assets held in a personal cold wallet or Ledger hardware wallet are not subject to any exchange’s financial health regardless of what PoR audits show, because the investor directly controls the private keys. For long-term holdings that do not need to be actively traded, moving assets to self-custody eliminates this entire category of risk.
How to Verify a Crypto Exchange's Proof of Reserves
Verifying a balance’s inclusion in an exchange’s PoR is straightforward for most major exchanges. Navigate to the exchange’s security or proof of reserves page (typically under Settings or Security), download the personal Merkle proof for the account, and enter it into the exchange’s verification tool (or an open-source verification script the exchange provides). The verification confirms the balance hash is included in the Merkle tree and that the root hash matches the published root, confirming the balance was counted in the total at the snapshot date. On-chain verification of the claimed wallet balances uses a blockchain explorer: for Bitcoin reserves, the Bitcoin blockchain via any Bitcoin explorer; for Ethereum reserves, Etherscan. Looking up the wallet addresses published by the exchange and confirming the balances shown on-chain match or exceed the amounts claimed provides the asset-side verification to complement the liability-side Merkle proof.
Third-party PoR auditors add an important layer of independence: rather than trusting the exchange to run its own Merkle tree calculation honestly, an independent firm re-runs the calculation using data provided directly by the exchange and publishes an attestation confirming the methodology and results. The audit report typically specifies which assets were covered, the snapshot date and time, the methodology used, and any exceptions or qualifications. Reading the audit report itself (not just the exchange’s summary of it) gives investors a more complete picture. Not all audit firms have equivalent expertise in crypto custody verification: the identity, qualifications, and track record of the named auditor should be verified independently through the auditing firm’s own website and published work. A reputable accounting firm publishing a properly scoped PoR attestation carries substantially more weight than an obscure or anonymous “audit.” The frequency of audits also matters: a monthly independently-attested PoR across major assets, covering both Bitcoin and Ethereum reserves with on-chain evidence, is meaningfully stronger reassurance than a single historical audit published once with no subsequent updates. Investors evaluating multiple exchanges for longer-term holdings should use the recency and completeness of PoR disclosures as one of several inputs, alongside the exchange’s regulatory standing under AUSTRAC and withdrawal track record.
Exchange Custody Risk
For investors who hold significant balances on exchanges that do not publish any proof of reserves, the exchange custody risk is elevated: the absence of PoR does not prove insolvency, but it means there is no independent verification of solvency at all. The practical risk management response is to limit balances on such exchanges to amounts that could be lost without catastrophic personal financial impact (treating them as counterparty risk that may not be recoverable), and to move longer-term holdings to self-custody cold storage. The guide to choosing a hardware wallet provides the practical steps for setting up self-custody for Bitcoin and Ethereum holdings, and the self-custody guide covers the broader security framework for managing private keys safely over time.
The timing of PoR verification relative to depositing or withdrawing funds matters: checking PoR before depositing a large amount, and checking again periodically thereafter, provides ongoing assurance that the exchange continues to meet the reserves standard. A PoR audit from six months ago provides less comfort than one from the current month, and an exchange that published regular PoR audits and then quietly stopped provides a different signal than one that has never published one. Incorporating PoR status into the regular review of where funds are held (alongside other indicators like regulatory standing, management transparency, and community reputation) makes exchange evaluation an ongoing practice rather than a one-time decision. Setting a calendar reminder to check the PoR status of any exchange holding more than a defined threshold (for example, any exchange holding more than $10,000 AUD) every quarter is a simple workflow that reduces the risk of being caught by deteriorating reserves that were not checked since the original deposit. The security guide for avoiding exchange hacks covers the complete exchange safety evaluation framework.
Proof of Reserves and the Self-Custody Decision
Understanding proof of reserves helps investors make more informed decisions about how much to hold on exchange versus in self-custody. The practical approach for most investors is to keep on exchange only what is actively needed for trading (protected by strong two-factor authentication and withdrawal address whitelisting), verify PoR status before selecting any exchange for a significant balance, and move long-term holdings to a Ledger or Trezor where exchange insolvency cannot affect access to funds. This split-custody approach means the trading portion of the portfolio is subject to exchange risk but actively managed, while the long-term holding portion is held securely outside any exchange’s control. The guide to choosing a hardware wallet covers which device is appropriate for different holding sizes and technical comfort levels.
The ATO compliance obligations for crypto investors are not affected by proof of reserves or exchange custody arrangements. The capital gains tax obligations on crypto gains are identical whether assets are held on exchange or in self-custody, and whether the exchange publishes PoR or not. Maintaining a crypto portfolio tracker that records all purchases, sales, and transfers regardless of where assets are held is the foundation of ATO-compliant record-keeping. The ATO tracks transactions through exchange data matching, meaning all activity on regulated Australian exchanges is reportable. Transfers from an exchange to a personal hardware wallet are not taxable disposal events under ATO rules, confirming that moving assets to self-custody for security reasons does not create an unexpected tax liability at the time of transfer.
Cold Storage
The decision of how to balance exchange convenience against self-custody security is ultimately a personal one based on trading frequency, portfolio size, technical comfort with managing private keys, and risk tolerance. For investors making occasional purchases and rarely trading, moving the majority of holdings to self-custody after purchase is a straightforward security improvement. For active traders who need immediate access to funds for frequent transactions, maintaining a working balance on a reputable, PoR-verified exchange while keeping the bulk of long-term holdings in cold storage is a reasonable middle ground. The seed phrase storage guide and wallet backup guide are the most important guides for any investor transitioning from full exchange custody to a split-custody or full self-custody approach.
Frequently Asked Questions
How do you check a crypto exchange's proof of reserves?
Proof of reserves (PoR) is a cryptographic auditing process by which a cryptocurrency exchange publicly demonstrates it holds sufficient assets to cover all customer deposits, enabling users to independently verify their funds are fully backed without relying solely on the exchange's own claims. The collapse of FTX in November 2022 (which held a fraction of the customer funds it was supposed to hold) triggered widespread demand for exchanges to provide verifiable evidence of solvency rather than unaudited statements. A proof of reserves audit uses cryptographic Merkle tree proofs to enable individual users to verify their specific account balance is included in the total assets the exchange claims to hold, without revealing any other customer's data.
What Is Proof of Reserves and Why It Matters?
A traditional financial audit requires a third party to review an institution's balance sheets and attest to their accuracy, but these audits are not individually verifiable by customers. Proof of reserves in crypto uses a different approach: the exchange publishes a cryptographic hash (a unique fingerprint) of all customer balances at a specific snapshot date, along with on-chain evidence it controls wallet addresses holding at least that total amount in each cryptocurrency. Each individual customer can then use a Merkle proof checker (typically provided by the exchange or available as open-source code) to verify their specific balance is included in the published snapshot total.
Which exchanges publish regular proof of reserves?
The exchanges that publish regular proof of reserves include Binance, Kraken, OKX, and Crypto.com internationally, with audit frequency ranging from monthly to quarterly. The named third-party auditor conducting the PoR engagement matters significantly: independent audit firms with established crypto custody verification practices provide meaningfully more assurance than an exchange conducting and publishing its own internal PoR calculation. Checking the audit date (how recent the most recent PoR is) and the coverage (which assets are included) are two additional data points in a thorough exchange evaluation.
How to Verify a Crypto Exchange's Proof of Reserves?
Verifying a balance's inclusion in an exchange's PoR is straightforward for most major exchanges. Navigate to the exchange's security or proof of reserves page (typically under Settings or Security), download the personal Merkle proof for the account, and enter it into the exchange's verification tool (or an open-source verification script the exchange provides). The verification confirms the balance hash is included in the Merkle tree and that the root hash matches the published root, confirming the balance was counted in the total at the snapshot date.
What does it mean if an exchange publishes no proof of reserves?
For investors who hold significant balances on exchanges that do not publish any proof of reserves, the exchange custody risk is elevated: the absence of PoR does not prove insolvency, but it means there is no independent verification of solvency at all. The practical risk management response is to limit balances on such exchanges to amounts that could be lost without catastrophic personal financial impact (treating them as counterparty risk that may not be recoverable), and to move longer-term holdings to self-custody cold storage. The guide to choosing a hardware wallet provides the practical steps for setting up self-custody for Bitcoin and Ethereum holdings, and the self-custody guide covers the broader security framework for managing private keys safely over time.
How does proof of reserves inform the self-custody decision?
Understanding proof of reserves helps investors make more informed decisions about how much to hold on exchange versus in self-custody. The practical approach for most investors is to keep on exchange only what is actively needed for trading (protected by strong two-factor authentication and withdrawal address whitelisting), verify PoR status before selecting any exchange for a significant balance, and move long-term holdings to a Ledger or Trezor where exchange insolvency cannot affect access to funds. This split-custody approach means the trading portion of the portfolio is subject to exchange risk but actively managed, while the long-term holding portion is held securely outside any exchange's control.
How much should you keep on an exchange versus in cold storage?
The decision of how to balance exchange convenience against self-custody security is ultimately a personal one based on trading frequency, portfolio size, technical comfort with managing private keys, and risk tolerance. For investors making occasional purchases and rarely trading, moving the majority of holdings to self-custody after purchase is a straightforward security improvement. For active traders who need immediate access to funds for frequent transactions, maintaining a working balance on a reputable, PoR-verified exchange while keeping the bulk of long-term holdings in cold storage is a reasonable middle ground.
What are the limits of proof of reserves?
Proof of reserves shows assets at a point in time and generally says nothing about liabilities, so an exchange can pass while still being balance-sheet insolvent. The snapshot can also be timed, and assets borrowed shortly before an attestation have been presented as reserves before. The quality of the engagement varies widely, and a named independent auditor carries more weight than a self-published report. It is a useful negative signal when absent, rather than a guarantee of solvency when present.
Choose your next topic from our Cryptopedia
