Attestation

What Is an Attestation?

An attestation is a formal declaration by a trusted party that a specific claim is true. In traditional finance, this typically means an independent accounting firm confirming that a company's reported figures match reality. In blockchain and cryptocurrency, the concept extends further: an attestation can be a digitally signed statement recorded on-chain, a third-party reserve verification for a stablecoin issuer, or a cryptographic proof that a verifiable credential is legitimate.

The common thread across all forms of attestation is verifiability without full disclosure. A reserve attestation confirms that backing assets meet or exceed outstanding tokens without requiring the issuer to expose every transaction. An identity attestation proves a user meets a requirement (age, residency, accreditation) without revealing the underlying personal data. This selective verification makes attestations a critical building block for trust in decentralized systems.

How It Works

Attestation mechanisms vary significantly depending on context, but they share a common structure: an issuer makes a claim, a verifier examines it, and the result is published in a format others can independently check.

Stablecoin Reserve Attestations

For fiat-backed stablecoins, reserve attestations are the primary transparency mechanism. An independent accounting firm examines whether the issuer holds sufficient assets to back all outstanding tokens. The process follows these steps:

1. The stablecoin issuer engages an independent public accounting firm
2. The firm examines reserve holdings at a specific point in time, applying AICPA attestation standards (AT-C sections)
3. The firm issues an examination report confirming whether reserves meet or exceed the total supply of tokens outstanding
4. The report is published publicly, typically on the issuer's website

Circle, the issuer of USDC, publishes monthly attestation reports. Deloitte & Touche LLP has served as Circle's independent auditor since fiscal year 2022, following Grant Thornton LLP which held the role from 2015 through 2022. Tether, the issuer of USDT, has used BDO Italia for quarterly attestation reports under an "agreed-upon procedures" format. In March 2026, Tether announced the engagement of a Big Four accounting firm to conduct its first full financial statement audit.

Attestation vs. Audit

These terms are often confused, but they differ in scope, methodology, and the assurance they provide:

An attestation can confirm that reserves exist on a given date, but it does not evaluate whether those reserves could be mismanaged between reporting periods. A full audit examines the systems and controls that govern how reserves are managed over time. For a deeper analysis of how these mechanisms have evolved, see the evolution of stablecoin proof of reserves.

On-Chain Attestations

On-chain attestation protocols allow anyone to create, publish, and verify signed claims directly on a blockchain. The Ethereum Attestation Service (EAS) is the most widely adopted example. It consists of two core smart contracts:

• SchemaRegistry: defines the structure of attestation data (what fields are included, what types they use)
• EAS: creates and stores attestations against registered schemas

The workflow for creating an on-chain attestation follows this pattern:

// Simplified EAS attestation flow
// 1. Register a schema (one-time)
schemaRegistry.register(
  "address wallet, bool isVerified, uint256 timestamp",
  resolverAddress,
  revocable
);

// 2. Create an attestation against that schema
eas.attest({
  schema: schemaUID,
  data: {
    recipient: walletAddress,
    data: encodedData,     // ABI-encoded schema fields
    revocable: true,
    expirationTime: 0      // 0 = no expiration
  }
});

// 3. Anyone can verify by reading the attestation
const attestation = eas.getAttestation(attestationUID);
// Returns: attester, recipient, schema, data, timestamp

EAS supports both on-chain storage (permanent, gas cost per attestation) and off-chain storage (signed but not stored on-chain, verifiable via signature). Optional resolver contracts can add custom verification logic, such as requiring a payment or checking conditions before an attestation is accepted.

Cryptographic Proof of Reserves

Exchanges use cryptographic techniques to prove they hold sufficient assets to cover all customer balances. The standard approach combines Merkle trees with public address verification:

1. Each customer account becomes a leaf node containing a hashed identifier and balance
2. Leaf nodes are paired and hashed upward through the tree until a single Merkle root is produced
3. The exchange publishes the Merkle root and provides individual users with their Merkle proof for verification
4. Any change to a single balance alters the root hash, making tampering detectable

Some exchanges enhance this with zero-knowledge proofs. Binance uses zk-SNARKs to verify that no account has a negative balance without revealing individual holdings. OKX combines zk-STARKs with Merkle trees, audited by third-party security firms. These approaches follow a framework proposed by Vitalik Buterin for using zero-knowledge proofs to strengthen solvency verification while preserving user privacy.

Use Cases

Stablecoin Transparency

Reserve attestations are the most visible application. Monthly or quarterly reports from independent firms give holders confidence that tokens are fully backed. Circle's USDC reserves, for example, are primarily composed of short-dated US Treasury bills held in a SEC-registered money market fund managed by BlackRock, with the remainder in cash at regulated US banks. These details are disclosed through attestation reports. For more on how reserve composition affects stability, see treasury bill reserve mechanics.

Decentralized Identity

Identity attestations enable self-sovereign identity systems where users control their own credentials. A KYC provider can issue an attestation that a user has passed identity verification. The user can then present this attestation to any service that requires KYC compliance without repeating the full verification process or sharing raw personal data with each service.

Decentralized identifiers (DIDs) anchor these credentials on-chain. Each credential holder controls a private key associated with their DID, and verification requires only checking the attestation signature against the issuer's public key: no centralized authority needs to be contacted.

Oracle-Verified Reserves

Oracle networks like Chainlink offer Proof of Reserve feeds that bridge off-chain attestation data to on-chain applications. Oracle nodes pull reserve figures from custodian APIs and third-party attestation reports, with multiple independent operators verifying the data before publishing it on-chain. DeFi protocols can use these feeds to automatically pause minting or trading if an asset becomes undercollateralized. For a detailed look at this approach, see real-time attestation with Chainlink.

Exchange Solvency

After high-profile exchange failures, cryptographic proof of reserves became an industry expectation. Exchanges publish regular attestations showing total assets exceed total liabilities, often combining Merkle tree proofs with independent auditor verification. Users can independently verify their account is included in the reported totals using their personalized Merkle proof. For a broader comparison of reserve transparency approaches, see reserve transparency and audit standards.

Regulatory Landscape

Attestation requirements are moving from voluntary best practice to regulatory mandate across major jurisdictions.

United States: GENIUS Act

The GENIUS Act (S.1582, 119th Congress) requires permitted payment stablecoin issuers to publish monthly reserve reports disclosing total outstanding tokens, the amount and composition of reserve assets, and any material changes. These reports must be examined by an independent public accounting firm within the following month. CEOs and CFOs must personally attest to report accuracy in regulatory submissions.

In March 2025, the AICPA released Part I of its Criteria for Stablecoin Reporting, establishing a common framework for presenting reserve information. Part II, released in January 2026, added criteria for controls over stablecoin operations including token lifecycle management, reserve asset handling, and IT controls. These criteria are designed to meet the "suitable criteria" requirement for examination engagements under the GENIUS Act. For a complete breakdown, see the GENIUS Act explained.

European Union: MiCA

The Markets in Crypto-Assets Regulation (MiCA) requires quarterly attestation reports for e-money token issuers. Reserve composition rules mandate that at least 30% of reserves for non-significant tokens (and 60% for significant tokens) be held in bank deposits. Full enforcement reached its final deadline in mid-2026, with ESMA technical standards covering reserve segregation, custody requirements, and redemption-at-par rules now in effect.

Risks and Considerations

Point-in-Time Limitations

Most attestations capture a snapshot: reserves may be fully backed at the moment of examination but could be redeployed or drawn down between reporting periods. This gap creates a window where the published attestation no longer reflects reality. Real-time or continuous attestation mechanisms (like oracle-based reserve feeds) address this limitation but introduce their own trust assumptions around oracle reliability.

Scope Constraints

An attestation only covers what it claims to examine. A reserve attestation confirms asset quantities but does not evaluate counterparty risk, liquidity of reserve assets, legal encumbrances, or the issuer's operational controls. Users who treat attestations as equivalent to full audits may overestimate the assurance they provide.

Attestor Independence and Quality

The value of an attestation depends entirely on the credibility and independence of the attesting firm. Engagement type matters: an examination-level attestation under AICPA standards provides stronger assurance than an "agreed-upon procedures" report, which only confirms that specific predefined steps were performed without rendering an opinion.

On-Chain Attestation Trust

On-chain attestations are only as trustworthy as the attester. Anyone can create an attestation on EAS or similar protocols: the cryptographic signature proves who made the claim, not whether the claim is true. Verifiers must evaluate whether they trust the issuing entity, just as they would with any off-chain credential.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.