Crypto Exchange Proof of Reserves Tracker

Exchange Proof of Reserves: Status Overview

After FTX collapsed in November 2022 with an $8 billion shortfall in customer funds, crypto exchanges rushed to prove they actually hold the assets they claim to hold. Proof of reserves (PoR) has since become a baseline transparency metric for evaluating exchange trustworthiness. But the quality of PoR programs varies enormously: some exchanges publish cryptographically verifiable Merkle tree proofs monthly, while others offer nothing more than a quarterly letter from an auditor.

This tracker covers PoR status across major exchanges, including attestation frequency, asset coverage, auditor identity, methodology, and whether liabilities are included. As of August 2026, CoinMarketCap tracks approximately $192.6 billion in exchange PoR reserves, with Binance alone accounting for roughly 68% of that total.

For a focused comparison of how individual exchanges handle Bitcoin reserves specifically, see the Bitcoin proof of reserves comparison.

Merkle Tree Proofs vs. Attestation Letters

Not all proof of reserves programs are created equal. The methodology an exchange uses determines whether users can independently verify their inclusion or must simply trust a third party's word.

Cryptographic Merkle Tree Proofs

A Merkle tree is a cryptographic data structure where every user's balance is hashed into a leaf node. Pairs of hashes are combined upward until a single root hash is produced. Users can verify their own balance is included by tracing their leaf to the published root: an O(log n) operation that requires no trust in the exchange. Changing any single balance changes the root hash, making tampering detectable.

The strongest implementations layer zero-knowledge proofs on top of the Merkle tree. Binance uses zk-SNARKs to prove that all account balances are non-negative and that the aggregate total matches the published figure, without exposing any individual account data. OKX uses zk-STARKs and has open-sourced its zk-STARK Validator tool on GitHub. These additions address a key limitation of basic Merkle trees: without ZK proofs, an exchange could include negative balances in the tree to make its reserves appear sufficient.

Attestation Letters

An attestation letter is a formal statement from an auditor confirming that they examined the exchange's assets at a specific point in time. These are typically performed under "Agreed Upon Procedures" rather than a full audit opinion. When Mazars Group published PoR reports for Binance and others in late 2022, it explicitly stated that its reports "do not constitute either an assurance or an audit opinion." Users cannot independently verify anything: they must trust the auditor's word.

Attestation letters are also vulnerable to window-dressing. An exchange could borrow assets for the snapshot date and return them afterward. Cryptographic proofs do not fully solve this problem either, but they at least allow users to verify their own balances are included in the reported total.

PoR Quality Rating by Exchange

A meaningful PoR program should combine four elements: cryptographic user verification, inclusion of liabilities, independent third-party auditing, and frequent publication. The following table rates exchanges on these dimensions.

Exchanges rated "Regulatory proxy" substitute traditional financial auditing for cryptographic PoR. Coinbase, as a NASDAQ-listed company audited by Deloitte, publishes SEC-compliant financial statements that include custody disclosures. Gemini operates as a New York Trust Company under NYDFS oversight. Both provide strong transparency, but users cannot perform the kind of cryptographic self-verification that Merkle tree-based systems enable.

Timeline of PoR Adoption

The push for proof of reserves accelerated rapidly after the FTX collapse exposed how an exchange's reported assets could diverge from reality. The following timeline tracks key milestones.

• November 2022: FTX files for bankruptcy. Binance CEO challenges all exchanges to publish PoR. Nine exchanges commit to Merkle tree reserve certificates within weeks.
• December 2022: Mazars Group publishes PoR reports for Binance, Crypto.com, and KuCoin, then abruptly suspends all crypto PoR work, citing concerns over public perception. Armanino also exits crypto auditing.
• Early 2023: Kraken and Gate.io become among the first exchanges to include proof of liabilities alongside asset attestations. BitMEX launches biweekly PoR with open-source verification code.
• 2023: Hacken emerges as the leading PoR auditor, filling the vacuum left by traditional firms. OKX begins publishing monthly reports with zk-STARK proofs.
• June 2024: Bybit begins monthly Hacken-audited PoR, expanding the standard for third-party verification.
• February 2025: Bybit suffers a $1.5 billion hack. Its existing PoR program proves critical for maintaining user confidence during the crisis, demonstrating the practical value of reserve transparency.
• July 2025: The GENIUS Act is signed into law, requiring permitted stablecoin issuers to publish monthly reserve reports examined by a registered public accounting firm.
• Late 2025: MEXC partners with Hacken for monthly PoR audits. Deribit announces it will discontinue its daily PoR page in September 2026 after migrating 90% of client assets to Coinbase custody following acquisition.
• 2026: CoinMarketCap tracks ~$192.6 billion in PoR reserves across exchanges. Backpack Exchange introduces daily disclosures with 10-minute internal checks, the highest frequency in the industry.

Exchanges With No Transparency

Several exchanges with meaningful trading volume publish no cryptographic proof of reserves and no publicly accessible reserve data. The absence of PoR does not automatically indicate insolvency, but it does mean users are relying entirely on the exchange's reputation and any applicable regulatory oversight rather than verifiable evidence.

Bitstamp, acquired by Robinhood in June 2025, publishes no PoR despite being one of the longest-running exchanges. It uses approximately 95% cold storage and undergoes annual Big Four audits, but individual users cannot verify their balance inclusion. Similarly, many smaller and regional exchanges publish no reserve data at all.

The distinction matters for assessing counterparty risk. FTX published no PoR and actively resisted transparency requests before its collapse. While regulatory oversight (as with Coinbase and Gemini) provides an alternative accountability mechanism, cryptographic PoR gives users a verification path that does not depend on trusting any single institution.

Limitations of Proof of Reserves

Even the best PoR programs have significant limitations that users should understand:

• Point-in-time snapshots: PoR reports reflect a specific moment, not continuous solvency. An exchange could borrow assets for the snapshot date.
• Off-chain liabilities are invisible: no cryptographic proof can detect off-balance-sheet obligations, side agreements, or encumbered assets held through third parties.
• Assets without liabilities are meaningless: proving an exchange holds $10 billion in assets says nothing if it owes $12 billion. Exchanges that exclude liabilities from their PoR reports provide incomplete assurance.
• Self-verification is not auditing: exchanges like Binance and HTX that self-publish Merkle trees without independent auditors are essentially grading their own homework.
• No standard framework exists: different exchanges use different methodologies, making direct comparison difficult. The GENIUS Act standardizes requirements for stablecoin issuers but not for exchanges.

For a deeper analysis of how stablecoin attestation practices compare to exchange PoR, see our research on stablecoin proof of reserves evolution.

The Auditor Problem

One of the most underappreciated aspects of exchange PoR is the auditor landscape. When the crypto industry needed independent verification most urgently, the two firms doing the work both left. Mazars Group suspended all crypto PoR engagements in December 2022. Armanino exited crypto auditing the same month. Their departures left a gap that has been only partially filled.

Hacken, a blockchain security firm, has become the de facto standard PoR auditor for non-US exchanges. OKX, Bybit, MEXC, Crypto.com, and others now use Hacken for monthly or regular verification. The Network Firm, formed by former Armanino team members, continues crypto audit work independently. But no Big Four accounting firm currently performs cryptographic PoR attestations for exchanges: Deloitte audits Coinbase's financials, not its Merkle tree reserves.

This matters because custodial risk assessment depends partly on auditor credibility. A PoR report from a well-established accounting firm carries different weight than one from a blockchain security startup, even if the underlying cryptographic methodology is identical. For institutional investors evaluating custody options, auditor identity is a material consideration.

Self-Custody as the Alternative

Proof of reserves exists because centralized exchanges hold customer funds. The alternative is self-custody: holding your own private keys so that no exchange solvency question applies to your assets. Decentralized exchanges like dYdX operate with on-chain self-custody by design, making traditional PoR unnecessary.

For users who want to hold stablecoins without exchange counterparty risk, protocols like Spark enable self-custodial dollar-denominated holdings on Bitcoin through USDB, eliminating the need to trust an exchange's PoR report entirely.

Frequently Asked Questions

What is proof of reserves in crypto?

Proof of reserves is a transparency practice where a crypto exchange demonstrates that it holds sufficient assets to cover all customer deposits. The strongest implementations use Merkle tree cryptography so individual users can verify their balance is included in the exchange's reported total. Weaker implementations rely on periodic attestation letters from accounting firms.

Which crypto exchanges have proof of reserves?

As of August 2026, exchanges with active PoR programs include Binance, OKX, Kraken, Bybit, Bitget, Gate.io, HTX, KuCoin, MEXC, Crypto.com, BitMEX, and Backpack. Coinbase and Gemini do not publish cryptographic PoR but provide equivalent transparency through SEC-audited financial statements and NYDFS regulatory oversight, respectively.

Does proof of reserves include liabilities?

Not always, and this is a critical gap. Proving assets without proving liabilities is like showing someone your bank balance without mentioning your mortgage. Exchanges that include liabilities in their PoR programs (Kraken, Bybit, BitMEX, Gate.io) provide meaningfully stronger assurance than those that only show asset totals. Binance and HTX notably do not include liabilities in their PoR reports.

Can proof of reserves prevent another FTX?

Not on its own. FTX's fraud involved fabricated balance sheets, commingled customer funds with Alameda Research, and off-chain liabilities that no on-chain proof could detect. PoR addresses the "do you have the assets?" question but cannot reveal secret loans, undisclosed related-party transactions, or corporate governance failures. It is a necessary transparency tool but not a sufficient one.

What is the difference between a PoR audit and a financial audit?

A PoR attestation typically follows Agreed Upon Procedures: the auditor checks specific things the exchange asks them to check and reports findings. A financial audit under US GAAP or IFRS is broader: it examines the entire financial position, including liabilities, revenue recognition, related-party transactions, and internal controls. Coinbase's Deloitte audit provides more comprehensive assurance than most exchange PoR reports, even though it lacks cryptographic user verification.

How often should exchanges publish proof of reserves?

Most exchanges with PoR programs publish monthly. BitMEX publishes biweekly, and Backpack Exchange publishes daily with internal checks every 10 minutes. Higher frequency is generally better because it reduces the window during which an exchange could temporarily borrow assets. The GENIUS Act requires monthly attestations for stablecoin issuers, which may become a de facto standard for exchanges as well.

Why did Mazars and Armanino stop doing crypto audits?

Both firms exited crypto PoR work in December 2022, weeks after the FTX collapse. Mazars cited "concerns over the way these reports are understood by the public" and noted that its reports did not constitute audit opinions. Armanino faced similar reputational pressure. Their departure left a significant credibility gap: the firms most trusted by traditional finance refused to associate with crypto reserve attestations, forcing the industry toward blockchain security firms like Hacken.

This tool is for informational purposes only and does not constitute financial advice. Proof of reserves data is based on publicly available exchange disclosures and may change without notice. Reserve ratios are point-in-time snapshots. The absence or presence of a PoR program does not guarantee the safety or insolvency of any exchange. Always verify current attestation reports directly on the exchange's website before making custody decisions.