What is Proof of Reserves? Verifying whether your exchange is solvent

3. How does it work technically?

The basic flow:

1. Snapshot of all client balances (per asset)
2. Merkle tree construction — each client gets a hash
3. Wallet addresses are shared publicly
4. Independent verification — anyone can check the wallet balances against the Merkle root

An individual client can verify their own balance without other balances becoming visible. That is the strength of this approach.

4. The different technologies

There are three generations of Proof of Reserves technology:

1. Merkle Tree (basic)

• Client balances are hashed into a tree structure
• Public wallet addresses are shown
• Every client can verify whether their balance is included
• Criticism: an exchange can "hide" negative balances (previously done at FTX)

2. zk-SNARKs / zk-STARKs

• Cryptographic proof that all balances are positive
• Impossible to hide negative balances
• Requires more computing power
• Advantage: higher assurance, harder to manipulate

3. Plonky2 / recursive ZK proofs

• Newest generation
• Faster verification, smaller proof size
• Supports higher frequencies (daily instead of monthly)
• Advantage: privacy-preserving and verifiable in real time

5. What is proven (and what is not)?

An important nuance: Proof of Reserves does not prove everything.

Proven:

• Total asset holdings greater than or equal to total liabilities per asset
• Individual client balances included in the proof
• Public wallet addresses contain the reported balances

Not proven (often):

• What happens between two snapshots (with monthly PoR = 30 blind days)
• Margin positions (with spot-only PoR)
• Unrealized PnL (losses on open positions)
• Off-chain assets (institutional deals, other parties)
• Obligations to third parties outside of clients

These points make frequency, coverage and scope crucial. A 30-day-old snapshot of only BTC and ETH proves little if an exchange supports 100+ coins.

6. Frequency: daily vs monthly vs quarterly

The frequency at which an exchange publishes PoR determines how up to date the proof is:

• Daily — the newest standard, possible since recursive ZK proofs
• Monthly — the current industry norm since FTX
• Quarterly — accepted at traditionally regulated platforms with external audits
• Never — a major red flag

The difference in practice: with a daily PoR, the chance that an exchange commits fraud between two proofs is minimal. With quarterly you have a 90-day "black box" between verifications.

7. Comparison of major exchanges

Notable observations:

• Only one exchange publishes daily public ZK proofs
• Only one exchange covers all assets in the proof (not just majors)
• Only one exchange also proves margin + unrealized PnL, not just spot balances
• Kraken and Bitvavo use external audits, but quarterly = 90 blind days
• OKX has the most mature monthly cadence (42 reports)

8. What does this mean for you?

For most retail users, Proof of Reserves is not a top-of-mind topic. But if you hold balances above €10,000 or have significant open positions, it matters.

Questions to ask:

1. How often does the exchange publish PoR? (daily > monthly > quarterly)
2. Which assets are covered? (all > majors > a few)
3. Are margin and unrealized PnL included? (important for perpetuals traders)
4. Is the code independently monitored? (e.g. OtterSec, The Network Firm)
5. Is the PoR code open-source verifiable?

Red flags: no PoR on the website; only a monthly Merkle Tree without ZK proof; limited asset coverage; external audits without cryptographic proof.

Green flags: daily public ZK proofs; full asset coverage; inclusion of margin and unrealized PnL; independent security monitoring; open-source code.