How to Check an Exchange’s Proof of Reserves (and What It Misses)

You can check whether an exchange really holds the crypto it claims in about 15 minutes, using a browser and your account’s published verification ID, a Merkle leaf or record ID. This guide shows what proof of reserves (PoR) actually proves, how to verify your own balance on Binance, Kraken, OKX and Bybit, and the liabilities gap PoR still leaves open. You need an account on the exchange, the snapshot date it published, and for some exchanges a free open-source verifier tool.

Proof of reserves became standard practice after FTX collapsed in November 2022 and customers found its balance sheet was largely fictional. The idea is simple: an exchange publishes cryptographic evidence that it controls enough on-chain assets to cover customer balances, and each user can check that their own balance was included. See our FTX collapse explainer for that story, and our exchanges hub for how to choose a platform. Crypto assets are volatile, and this is not financial advice.

What does a proof of reserves actually prove?

A proof of reserves shows, at a single snapshot moment, that an exchange controls on-chain assets at least equal to the customer balances it reports, and that your specific balance was included in that snapshot. It does not prove the exchange has no other debts, that its assets are not borrowed, or that it will remain solvent tomorrow.

Think of PoR as an asset check, not a solvency check. It answers two questions: does the exchange hold enough of the assets it says it holds, and was my balance part of the count. Most systems also try to prove ownership of the listed addresses, not just balances: an exchange signs a message from each address, or its accountant watches a small directed transfer, so the coins shown are actually under its control rather than borrowed for the snapshot. OKX, for example, publishes a signed ‘I am an OKX address’ message for each listed wallet, which users can check against the block-height snapshot.

How does a Merkle tree prove your balance is included?

A Merkle tree hashes every account balance into a ‘leaf’, then pairs and re-hashes those leaves upward until one ‘root’ hash remains. Your Merkle path, your leaf plus a few sibling hashes on the way up, proves your balance is inside the tree without revealing any other customer’s balance. If a single balance changes, the root changes, so a published root commits the exchange to its snapshot.

In practice the exchange computes a root from all account balances, publishes the root, and hands each user a proof showing how their leaf connects to that root. You then re-run the hashes yourself and confirm the result. Kraken documents this precisely: its record ID is a SHA-256 hash of the account code, an internal identifier and the review ID, and the leaf is the first 16 hex characters of a further hash of the record ID plus a comma-separated list of asset balances. Binance and OKX publish similar data you can check with their own tools.

How do you verify your own balance, step by step?

Log in, open the exchange’s Proof of Reserves or Verification menu, copy your record ID or Merkle leaf, and check it against the published root using the exchange’s verifier or a third-party tool. For Binance and OKX you download a free verifier and run it against your downloaded proof files, while Kraken lets you check a leaf through its accountant’s tool. The whole check takes a few minutes.

1. Note the snapshot date and your record ID or Merkle leaf for the asset you hold. The report reflects a snapshot, not your live balance.
2. Binance: go to Profile, then Wallet, then Verification. Confirm the type reads ‘Merkle Tree + Zksnarks’, download your proof package, and run the verifier tool from Binance’s GitHub repository to check the root hash and your inclusion.
3. Kraken: in Kraken Pro open the Proof of Reserves tab, pick the report date, and copy the first 16 characters of your Merkle leaf ID into the external accountant’s tool to retrieve your balance and path.
4. OKX: download your personal inclusion proof file and run OKX’s open-source zk-STARK validator to confirm your balance is covered by the published total.
5. Compare the result: your balance should match the snapshot amount, and the root you compute should match the exchange’s published root.
6. Repeat for each asset or wallet you hold, and remember the snapshot only reflects the moment it was taken.

Which exchanges publish proof of reserves, and how often?

As of November 2026, Binance, OKX and Bybit publish monthly snapshots, Kraken publishes recurring accountant-reviewed snapshots (the latest dated 30 June 2026), and Coinbase publishes none because its Deloitte-audited financial statements serve a different purpose. Crypto.com’s last published verification dates to December 2022. Methods span plain Merkle trees, zk-SNARKs and zk-STARKs.

Method and frequency differ more than the marketing suggests. Binance’s monthly cycle snapshots balances at 00:00:00 UTC on the 1st and publishes by the 7th. OKX’s page, as of November 2026, shows a 49th report covering $33.87 billion across 21 assets, with per-asset ratios of 108% for BTC, 101% for ETH, 106% for USDT and 100% for USDC. Kraken’s 30 June 2026 snapshot lists BTC at 102.9%, ETH at 100.5% and USDC/USDT at 105% or higher. Bybit’s 41st report, verified by Hacken from a 27 October 2026 snapshot, shows BTC at 102% across 50 assets, according to Bybit’s announcement.

What does a proof of reserves miss?

Proof of reserves shows assets but not liabilities, so it cannot rule out that an exchange owes more than it holds, that reserves are borrowed, or that the snapshot was gamed. It is also a single point in time, and there is no common standard, so reports from different exchanges are hard to compare. Confirming solvency requires an audit of liabilities too.

The missing half is a ‘proof of liabilities’, a commitment to the total amount owed to every customer, which almost no exchange publishes. The limits surfaced publicly in December 2022, when the accounting firm Mazars paused its crypto proof-of-reserves work for Binance, Crypto.com and KuCoin on 16 December 2022. Mazars stressed that its reports were ‘Agreed Upon Procedures’, not audits or assurance opinions, and reflected only limited findings at a single historical point in time, as CoinDesk reported. Around the same period, The Block reported that Armanino had ended its crypto audit business and that the Big Four firms were unwilling to run a proof of reserves for a private crypto company.

A snapshot is also not a promise. Bybit’s $1.5 billion hack on 21 February 2025 is a reminder that a report taken one day says nothing about the next day’s event. PoR reduces one specific risk, that an exchange is quietly running a fractional reserve, but it does not remove hacking, custody or bank-run risk. For more on custody risk, see whether it is safe to keep crypto on an exchange.

What are the common mistakes when reading a proof of reserves?

The most common mistakes are treating a snapshot as real-time, assuming a ‘1:1’ or over-100% ratio means all liabilities are covered, trusting a report with no way to check your own balance, and confusing proof of reserves with a financial audit. Also beware any ‘verification’ page that asks for your seed phrase or password.

• Snapshot vs real-time. A report reflects one moment. Check the snapshot date and re-check periodically rather than once.
• Reserve ratio vs solvency. A 105% ratio on listed assets says nothing about off-chain debt, borrowed coins or other liabilities.
• No self-verification. A report you cannot check against your own balance is weaker evidence. Prefer exchanges that let you verify inclusion, like the four above.
• Agreed Upon Procedures vs audit. A PoR engagement is narrower than a financial-statement audit. Read what the report actually claims.
• Phishing. Only verify through the official app or site menu. No legitimate check ever requires your seed phrase; never share it, and follow our guide on storing a seed phrase.

Is proof of reserves the same as an audit?

No. A proof of reserves confirms specific on-chain assets against customer balances at one moment, while a financial audit examines a company’s full statements, including liabilities and internal controls, against accounting standards. Mazars described its crypto reports as ‘Agreed Upon Procedures’, explicitly not an audit or assurance opinion.

Coinbase is the clearest contrast. As a US-listed public company it publishes no Merkle-tree proof of reserves and instead relies on audited financial statements. Its 10-K filed for 2025 carries an unqualified opinion from Deloitte & Touche LLP dated 12 February 2026, covering assets, liabilities and internal controls, a far broader scope than any asset-only snapshot, as shown in the SEC filing exhibit. Neither tool is a guarantee: an audit checks whether statements are fairly presented, not whether the business can survive a future run.