Security
Proof of Reserves Explained: Merkle Trees, Verification, and Blind Spots
Proof of reserves can show point-in-time assets and account inclusion, but it does not automatically prove full liabilities, solvency, or future custody safety.
Proof of reserves (PoR) tries to connect two questions: which assets does a custodian control, and were customer balances included in the liability total? A stronger design combines wallet ownership, an account-balance tree, and a reserve ratio.
Checked on 2026-07-12 (UTC+8). PoR is a transparency tool, not a promise that an exchange cannot fail.
What a Merkle Tree Shows
Customer balances become leaves that are hashed upward into a Merkle root. A user can verify inclusion without seeing everyone else balances.
Inclusion means the user balance was part of that snapshot. It does not by itself explain negative balances, lending, derivatives, excluded assets, or liabilities outside the system.
Verify the Asset Side
Public wallet balances show assets at addresses. The platform should also prove control through signed messages and align the asset snapshot with the liability snapshot. Assets held by third-party custodians require separate evidence.
Four Conclusions PoR Cannot Automatically Support
- A ratio above 100% does not prove no off-chain liabilities.
- A point-in-time snapshot does not show every later movement.
- Account inclusion does not mean every product and asset is covered.
- Cryptographic verification is not automatically a full financial-statement audit or regulatory guarantee.
User Verification Checklist
- Read the report date, covered assets, and legal entity.
- Verify personal balance inclusion in the Merkle or zero-knowledge proof.
- Check wallet ownership evidence and on-chain balances.
- Read treatment of liabilities, lending, third-party custody, and audit scope.
- Compare several reports over time instead of one headline ratio.
PoR should be assessed alongside operating history, asset segregation, withdrawal availability, legal risk, and personal custody strategy. See the exchange security guide and wallet comparison.
Official References
⚠️ This article does not endorse an exchange. Centralized custody retains operational, legal, cybersecurity, and liquidity risk even when a proof can be verified.