Proof-of-reserves, three years on
The Merkle-tree attestations exchanges adopted after 2022 are now routine. A look at what they actually demonstrate — and the three things most of them still leave out.
Three years after the 2022 collapses made “where are the coins” the only question that mattered, proof-of-reserves has settled into furniture. Most major venues now publish some version of it: a snapshot of on-chain wallets, a Merkle tree of customer balances, sometimes a third-party attestation stapled on top. Routine is progress. It is not the same thing as proof.
What a typical publication shows
Done properly, a proof-of-reserves exercise demonstrates two things. First, that the exchange controlled certain addresses holding certain assets at a moment in time. Second — where a Merkle tree of liabilities is included and users actually check their inclusion — that customer balances summing to a stated total existed at that same moment. Several large venues publish this monthly, and a snapshot ratio at or above 1:1 for major assets, per the venue’s own publication, is now the expected furniture.
That is genuinely more than the industry offered before November 2022. It is also where most publications stop.
The three standing omissions
Liabilities beyond the tree. The Merkle tree covers customer balances the exchange chooses to enumerate. It says nothing about off-chain obligations — loans, corporate debt, claims from a sister company — that could rank against those same assets in an insolvency. Assets without a full liability picture is half a balance sheet, and it is the half that has historically been fine.
Timing. A snapshot proves a moment. Assets can be borrowed for the photograph and returned after; only repeated, frequent snapshots — and attestation procedures that test for exactly this — narrow the window. Most published schedules are monthly at best, as of this writing.
Scope. Which legal entity? Which chains? Which tokens? Publications routinely cover the flagship exchange entity and the major assets, while customers face a group structure spanning multiple jurisdictions. An attestation is also not an audit: the accounting firms involved perform agreed-upon procedures on management’s data at a point in time, and their reports say so — the major firms have been careful on this distinction ever since one of them publicly paused crypto attestation work in late 2022.
Where this settles
Regulation is slowly overtaking voluntary disclosure — custody and segregation rules in the EU and now the UK ask harder versions of the same questions, with supervisors rather than marketing departments setting the scope. Until then, our reading of any proof-of-reserves page is the mechanic’s reading: note what is demonstrated, list what is omitted, and treat the gap as the risk. A reserve snapshot is a reason to keep asking questions, not a reason to stop — none of it is investment advice, and the checking remains yours to do.