Proof of Reserves (PoR)

Proof of Reserves (PoR) is a way for a centralized exchange or other custodian to show that the crypto it holds covers what it owes to customers. It has two halves: proof of the assets the exchange controls on-chain, and proof of the liabilities, meaning the total of all customer balances. If assets are equal to or greater than liabilities for each coin, the platform is said to be fully backed, often shown as a reserve ratio such as 100% or higher.

PoR became common after the FTX collapse in November 2022, when customer deposits had been used for other purposes. Many large exchanges started publishing reserve reports soon after, and some now update them monthly.

How it works

Liabilities. The exchange takes a snapshot of every customer balance at a set time. Each balance is hashed with an anonymized account ID and placed as a leaf in a Merkle tree. The leaves are hashed together in pairs until one value is left, the Merkle root, which is published. A customer can download their own leaf and the path of hashes to the root and check that their balance is included. Changing any balance would change the root.

Assets. The exchange lists the on-chain addresses it controls and proves ownership, usually by signing a message with the private keys of those wallets or by moving funds in a way that an auditor watches. Anyone can then read the balances of those addresses on a block explorer.

Comparison. Assets per coin are compared with liabilities per coin. The result is a reserve ratio per asset, for example BTC 102%, USDT 108%.

Some exchanges add zero-knowledge proofs (zk-SNARKs). These prove that the sum of all balances is correct and that no account has a negative balance, without revealing individual balances. This closes a gap in plain Merkle trees, where an exchange could hide liabilities by inserting fake negative accounts.

Variants

Why it matters

When you leave funds on an exchange, you are an unsecured creditor. PoR is one of the few public signals that the platform is not running a fractional reserve, lending out customer coins, or hiding a shortfall. It is most relevant if you keep sizable balances on a platform for spot trading, futures trading or staking products.

Limits and risks

• It is a snapshot. Funds can be borrowed just before the snapshot and returned after. Frequent reports reduce, but do not remove, this risk.
• Liabilities are incomplete. PoR covers customer balances in the tree. It usually does not include loans, debts to other firms, legal claims or other obligations, so it is not proof of solvency.
• Ownership is not the same as free use. Coins in a wallet may be pledged as collateral elsewhere.
• The exchange's own token. Reserves held largely in a token the exchange issued can look large but may not be sellable at that value.
• Attestations are limited. An auditor's attestation confirms specific data at one date. It is not a full audit of the company's finances, and some audit firms stopped doing PoR work for crypto clients after 2022.
• Only users who check gain much. Merkle verification depends on customers actually checking their leaf.

PoR lowers custody risk but does not remove it. Moving long-term holdings to a self-custody Web3 wallet is the only way to avoid exchange insolvency risk completely.

What to check when comparing exchanges

• Frequency: monthly or more often is better than one-off reports.
• Method: Merkle tree alone, or with zk-SNARK proofs of no negative balances.
• Self-verification: can you check your own balance in the tree from your account?
• Coverage: which assets are included, and is the ratio shown per asset rather than as one total?
• Asset quality: how much of the reserves are in BTC, ETH and major stablecoins versus the exchange's own token.
• Independent review: whether a named third party attests to the data, and what exactly they checked.
• Extra protections: insurance funds or user protection funds that sit on top of reserves.

Related terms

Proof of Reserves vs proof of solvency: PoR shows assets cover customer balances. Proof of solvency would also need all other liabilities, which PoR does not show. PoR vs audit: an audit reviews full financial statements, while PoR checks crypto holdings against customer balances at one moment.