Proof of Reserves After FTX: How Bitcoin Exchanges Prove Solvency and Why It Still Falls Short

When FTX filed for Chapter 11 bankruptcy on November 11, 2022, the exchange owed customers roughly $8 billion it could not account for. The fallout was immediate: within days, nine major exchanges announced plans to publish proof of reserves (PoR) attestations. Binance posted its first provisional report the same day FTX collapsed. What followed was a rapid, industry-wide scramble to prove solvency using cryptographic techniques that range from basic wallet disclosures to zero-knowledge proofs. Nearly four years later, PoR has become table stakes for any credible crypto exchange, yet the fundamental problem remains: proving you hold assets is not the same as proving you are solvent.

Why Proof of Reserves Exists

A centralized exchange operates as a custodian. Users deposit Bitcoin, and the exchange records a balance in its internal ledger. The user no longer controls the private keys. This creates custodial risk: the exchange could lend out deposits, pledge them as collateral, or simply lose them through mismanagement. FTX did all three simultaneously, funneling customer deposits to its trading arm Alameda Research while reporting healthy balances on its interface.

Proof of reserves is an attempt to close this information gap. At its core, PoR answers one question: does the exchange hold at least as many assets as it owes to customers? The answer requires two components: proof of assets (demonstrating control of on-chain funds) and proof of liabilities (demonstrating the total owed to all users). Most implementations today only address the first half convincingly.

The Three Main PoR Approaches

Exchange PoR implementations fall into three broad categories, each with different trust assumptions, privacy guarantees, and verification properties. Understanding the distinctions is critical for evaluating whether any given attestation is meaningful.

Merkle Tree Attestations

The most widely adopted approach uses a Merkle tree (or its extended form, a Merkle sum tree) to represent customer liabilities. Greg Maxwell first proposed this scheme on Bitcointalk in 2013, and he and Zak Wilcox published the formal construction in February 2014. Every customer account is assigned a leaf node containing a hash of their account identifier and their balance. Leaf nodes are hashed pairwise to produce parent nodes, recursing upward until a single Merkle root is produced.

A Merkle sum tree extends this by including running balance totals at each node, so the root commits to both the inclusion of every account and the aggregate sum of all liabilities. Individual users can verify their own balance is included by requesting a Merkle proof: a branch of hashes from their leaf to the root. If even one digit in any balance changes, the hashes cascade upward and invalidate the root.

On the asset side, the exchange signs a message from each wallet address it controls, proving ownership of the corresponding private keys. The attestation passes if total assets across all proven wallets equal or exceed the liability total committed in the Merkle root.

The privacy tradeoff: Basic Merkle tree attestations can leak information. Each user who verifies their proof sees the sibling hashes and partial balance sums along their branch. With enough colluding verifiers, it becomes possible to reconstruct significant portions of the liability distribution. This is one motivation for ZK-based enhancements.

Zero-Knowledge Proof Enhancements

In November 2022, Vitalik Buterin published “Having a safe CEX: proof of solvency and beyond”, proposing that exchanges wrap their Merkle sum tree inside a zero-knowledge proof. The ZK circuit proves that all balances in the tree are non-negative and sum to the claimed total, without revealing any individual account data. This eliminates the privacy leakage of standard Merkle proofs while maintaining the same cryptographic guarantees.

Vitalik's proposal outlined a complete proof-of-solvency formula: proof of liabilities (customer deposits equal X) plus proof of assets (the exchange controls private keys for at least X coins) equals proof of solvency. He also sketched a more advanced “Validium model” where exchanges operate like ZK-rollups with off-chain data availability, preventing theft while accepting some risk of temporary fund inaccessibility.

Two months later, Binance became the first major exchange to deploy zk-SNARKs in its PoR system, adding zero-knowledge constraints on top of its existing Merkle tree construction. OKX took a different path, implementing zk-STARKs with signature validation, which reduced its proof file size from 2.55 GB to 598 KB.

Third-Party Audit Reports

Some exchanges have opted for traditional accounting firm attestations rather than (or in addition to) cryptographic proofs. This approach relies on the auditor independently verifying wallet balances and matching them against internal records.

The track record here is poor. Mazars Group, which performed Binance's initial PoR report in December 2022 (confirming 575,742 BTC worth roughly $9.7 billion), abruptly suspended all crypto PoR work on December 16, 2022, citing “concerns regarding the way these reports are understood by the public.” The firm dropped Binance, KuCoin, and Crypto.com simultaneously and removed all published reports from its website. Armanino LLP, which had audited FTX.US and Kraken, exited its digital assets practice entirely by January 2023 and was later named in a class-action lawsuit for failing to detect irregularities at FTX.US.

The vacuum left by these departures has been filled primarily by Hacken, which now audits OKX, Bybit, Binance, MEXC, and others. Hacken's process includes Merkle tree code verification, liabilities report reconciliation, root hash validation, and ownership verification through monitored outgoing transactions from reserve addresses.

How Major Exchanges Implement PoR

No two exchange PoR systems are identical. The differences in cryptographic approach, update frequency, asset coverage, and liability treatment are significant enough to matter.

Binance

Binance published its first PoR on November 11, 2022, starting with BTC only. In February 2023, it added zk-SNARK constraints to prevent negative balance manipulation. Coverage has expanded steadily, reaching 37 crypto assets by mid-2025. Monthly snapshots consistently show reserve ratios above 100% (for example, 102.06% for BTC and 100.25% for ETH as of recent reports). The primary criticism: Binance's initial Mazars report was called “worthless” by accounting academics because it did not constitute a full audit, and the scope remains limited to on-chain crypto assets with no coverage of fiat obligations, derivatives exposure, or corporate liabilities.

Kraken

Kraken holds the distinction of being the first major exchange to pass a cryptographic proof-of-reserves audit, conducted by Stefan Thomas in March 2014. Its current system engages an independent accounting firm under AICPA standards and goes further than most competitors by covering not just reserves but liabilities: spot positions, open margin positions, futures balances, and on-chain staked amounts. Reports are published quarterly and users can independently verify their balance inclusion via Merkle proofs.

BitMEX

BitMEX takes a distinctive self-attestation approach, publishing proof-of-reserves and proof-of-liabilities data twice per week using the Greg Maxwell Merkle sum tree scheme. This makes it the highest-frequency major PoR publisher and one of the few exchanges that cryptographically proves both sides of the solvency equation. BitMEX open-sourced its implementation on GitHub. The tradeoff is the absence of an independent auditor: users must trust that the self-generated proofs are computed honestly over the correct dataset.

The Summa Experiment

In March 2023, the Ethereum Foundation's Privacy and Scaling Explorations (PSE) team began building Summa, a ZK-native proof-of-reserves tool designed specifically for centralized exchanges. Summa uses zk-SNARKs to constrain the Merkle tree and balance aggregation within a single ZK circuit, ensuring the tree is built using the same user balances that produced the aggregate liability total. Version 3 introduced Hyperplonk with the sumcheck protocol, avoiding Discrete Fourier Transforms for improved performance on large account sets.

Despite technical promise, Summa saw limited production adoption. The repository remains open source but no further development is planned. The project is characterized as “a valuable starting point for future innovations” rather than an actively maintained tool. Its significance is primarily academic: Summa demonstrated that ZK-constrained PoR is feasible at exchange scale, influencing the design choices of Binance, OKX, and Backpack.

Why Proof of Reserves Falls Short

The core limitation of every PoR system deployed today is the same one identified in Maxwell's original 2013 proposal: proving assets without proving liabilities is an incomplete picture. An exchange can pass a PoR attestation while being deeply insolvent if its total obligations exceed its visible on-chain holdings.

The Proof-of-Liabilities Gap

A PoR snapshot proves the exchange controls certain wallet addresses. It does not reveal hidden loans, off-balance-sheet obligations, fiat currency debts, derivatives exposure, margin shortfalls, intercompany transfers, or legal liabilities. FTX would have passed a naive PoR check on many days: it held significant crypto assets in its wallets while simultaneously owing billions more than it held through off-chain arrangements with Alameda.

Proving liabilities cryptographically introduces additional challenges. Negative balances from margin and lending must be handled carefully to prevent them from canceling out other users' deposits. Off-chain obligations (fiat debts, legal settlements, intercompany loans) cannot be captured in a Merkle tree. Most critically, an exchange can simply omit accounts from its liability tree, and excluded users have no way to detect their omission unless they independently verify their own inclusion.

The omission problem: If an exchange excludes 10,000 accounts from its liability tree, the Merkle root is still cryptographically valid. Only users who actively check their inclusion would notice. Exchanges with millions of users and single-digit verification rates could understate liabilities substantially without detection.

Snapshot-Time Manipulation

Since most PoR attestations are point-in-time snapshots, exchanges face a well-known gaming vector: borrow assets just before the snapshot, pass the attestation, then return them afterward. Monthly snapshots leave 30-day windows where the reported reserve ratio may not hold. Assets displayed in a snapshot could simultaneously be pledged as collateral elsewhere or encumbered by undisclosed agreements.

This is not theoretical. In April 2026, on-chain forensics firm Recoveris revealed that Polish exchange Zondacrypto's Bitcoin hot wallet balance had dropped from 55.7 BTC to 0.086 BTC (a 99.7% decline) while the platform continued claiming solvency, potentially affecting 30,000 users. Higher-frequency attestations reduce the manipulation window: BitMEX publishes twice weekly, and Backpack runs internal checks every 10 minutes with daily public disclosures.

What PoR Does and Does Not Prove

Chainlink Proof of Reserve: Continuous Monitoring

Chainlink Proof of Reserve takes a different architectural approach by using decentralized oracle networks to continuously monitor on-chain and off-chain assets. Rather than periodic snapshots, Chainlink's system publishes cryptographic proofs to blockchains whenever reserve balances change, reporting on assets worth approximately $8.5 billion. Smart contracts can consume this data in real time: if reserves fall below required levels, downstream contracts can automatically halt minting or trigger other protective actions.

Chainlink PoR is primarily used by stablecoin and wrapped asset issuers rather than exchanges. TrueUSD (TUSD) was the first USD-backed stablecoin to integrate it, and BitGo uses it to verify 1:1 backing between minted WBTC tokens and custodied Bitcoin. The model works well for assets with clear on-chain backing requirements but does not address the broader solvency question facing exchanges with complex balance sheets.

The Nic Carter Framework

Nic Carter, general partner at Castle Island Ventures and co-founder of Coin Metrics, has been the most prominent advocate for rigorous PoR standards. His framework for evaluating exchange attestations ranks implementations across five dimensions: attestation to assets held, disclosure of liabilities, involvement of a third-party auditor, credibility of covering all assets, and commitment to ongoing reporting. By this framework, most exchange PoR implementations fail on at least two dimensions. Carter ranked OKX's implementation as the highest quality among major exchanges, citing its combination of zk-STARKs, monthly cadence, and third-party auditing by Hacken.

Carter co-authored the Chamber of Digital Commerce's practitioner guide for proof of reserves, which outlines minimum standards for meaningful attestations. The guide emphasizes that any PoR without a corresponding proof-of-liabilities component should be understood as a partial disclosure rather than proof of solvency.

Regulatory Momentum

The EU's Markets in Crypto-Assets (MiCA) regulation, fully enforced from July 1, 2026, requires crypto asset service providers operating in Europe to meet reserve, audit, and consumer protection standards. While MiCA does not mandate a specific PoR technology, it establishes a regulatory baseline that makes some form of reserve verification obligatory rather than voluntary. In the United States, the GENIUS Act focuses primarily on stablecoin reserve requirements, but its disclosure framework signals growing legislative interest in exchange-level reserve transparency.

The shift from voluntary to mandatory reporting changes the incentive structure. Exchanges that previously published PoR for marketing purposes will face standardized requirements for what counts as adequate disclosure. This could accelerate the adoption of ZK-based approaches and higher-frequency attestations as the regulatory floor rises.

The Current State of Exchange PoR

As of 2026, proof of reserves has matured from a post-FTX panic response into a baseline expectation. Most top exchanges publish PoR attestations regularly, with monthly cadence being the industry norm. Reserve ratios consistently sit above 100%: Binance reports roughly 102% for BTC, MEXC showed 135% BTC and 130% USDT in its December 2025 Hacken audit, and Phemex reported 131% overcollateralization in April 2026.

The technology frontier has moved toward higher frequency and stronger cryptographic guarantees. Backpack Exchange now publishes daily PoR disclosures using Plonky2 zero-knowledge proofs verified by OtterSec, with internal checks running every 10 minutes. This represents a significant improvement over monthly snapshots, though even 10-minute intervals cannot prevent all forms of collateral manipulation.

The open question is whether the industry will converge on a standard. Today, every exchange uses different cryptographic methods, different asset coverage, different audit firms, and different update frequencies. Users cannot easily compare one exchange's attestation to another's. A PoR from Binance and a PoR from BitMEX are fundamentally different claims despite sharing the same name.

Self-Custody: Eliminating the Problem Entirely

Every proof-of-reserves scheme, from basic Merkle trees to ZK-enhanced attestations, exists because users surrendered control of their private keys to a third party. The entire category of exchange solvency risk disappears when users hold their own keys. Self-custodial protocols like Spark are designed around this principle: users maintain control of their Bitcoin throughout the transaction lifecycle, eliminating the need to trust an exchange's reserve attestations. There is no custodial balance to prove because there is no custodian.

This does not mean self-custody is a universal solution. Exchanges serve legitimate functions: price discovery, fiat on-ramps, derivatives trading, and regulatory compliance for institutional participants. Self-custodial protocols and exchanges will coexist. But for users whose primary need is holding and transferring Bitcoin, the existence of PoR should be understood as evidence of a problem rather than a solution. The safest reserve attestation is the one you never need.

Wallets built on self-custodial infrastructure like General Bread demonstrate what this looks like in practice: users hold Bitcoin and stablecoins in a Spark-powered wallet where the keys never leave their device. For developers building similar applications, the Spark SDK provides the primitives for self-custodial Bitcoin management without the operational overhead of running Lightning infrastructure.

What Comes Next

The trajectory of proof of reserves points toward three developments. First, frequency will continue increasing as ZK proof generation becomes cheaper and faster. Daily attestations will likely become the norm within two years, with real-time monitoring approaching feasibility for exchanges willing to invest in the infrastructure.

Second, proof of liabilities will receive more attention. Kraken and BitMEX already publish liability data alongside reserves. As regulatory frameworks mature, partial PoR (assets only) may become insufficient for compliance. Vitalik's 2022 proposal for ZK-constrained liability proofs provides a technical blueprint; the challenge is operational adoption.

Third, the distinction between custodial and self-custodial architecture will sharpen. Users who remain on exchanges will demand better PoR. Users who value sovereignty will move to protocols where PoR is unnecessary. The evolution of reserve transparency is not just a technical question: it reflects a fundamental choice about who holds the keys and who bears the risk.

This article is for educational purposes only. It does not constitute financial or investment advice. Bitcoin and Layer 2 protocols involve technical and financial risk. Always do your own research and understand the tradeoffs before using any protocol.