Proof of Reserves: What an Exchange Actually Proves

iEXExchanger
Proof of Reserves: What an Exchange Actually Proves

Proof of Reserves only shows an exchange held certain assets at one moment — not its solvency or liabilities. Here is what PoR really proves and what it quietly skips.

Proof of Reserves is the phrase every exchange started repeating after FTX collapsed. The implied promise: don't worry, your money's still there. In reality, it's a much narrower thing — a cryptographic proof that certain assets sat in certain wallets at one particular moment. Here's what Proof of Reserves actually shows, what it quietly skips, and why the idea matters even if you run a small exchanger rather than a billion-dollar exchange.

What Proof of Reserves Actually Is

Proof of Reserves (PoR) is a way to mathematically show that a platform holds the client funds it claims to hold, without exposing anyone else's account balance. Under the hood it's a Merkle-tree proof plus a signature proving control of a wallet.

Think of a cashier closing out a till at the end of a shift — counting the cash and matching it against the receipt log. PoR does the same thing, except the cashier is code and the auditor is anyone online with a calculator and some patience.

How a Merkle Tree Works, Without the Math Degree

A Merkle tree compresses millions of customer balances into one short hash that the exchange publishes for anyone to see. Each balance becomes a "leaf", leaves get hashed together in pairs, and the process repeats until a single root hash remains.

You never need to see anyone else's balance. The exchange hands you a personal "proof path" — a short chain of hashes — and you can independently confirm your own balance is baked into that published root. If the numbers don't line up with your account statement, that's a red flag worth chasing.

What PoR Doesn't Prove — and Why That Matters

This is where it gets interesting. PoR confirms assets on one date — it says nothing about how much the platform actually owes its customers. Without an independent check on liabilities, "100% reserves" can mean almost anything if nobody verified the other side of the equation.

  • It's a single snapshot — an asset can be borrowed for a day specifically to pass the check and returned the next morning.
  • PoR usually ignores offsetting liabilities, like loans collateralized by those same coins.
  • Publishing a root hash says nothing about the platform's legal right to actually control those funds.

Since 2022, the industry has learned more than once that a headline claim of full reserves and actual financial health are two different stories. That doesn't make PoR useless — it means you shouldn't read it as a guarantee.

PoR vs. a Big Four Audit: The Real Difference

PoR and a full financial audit solve different problems, and mixing them up is a common mistake.

  • PoR is a self-service cryptographic check of assets that can run weekly, or even more often, for almost no cost.
  • A Big Four audit examines both sides of the balance sheet, internal controls and legal structure — but takes months and real money.
  • PoR is usually published by the exchange itself or a contractor it hired; an audit opinion is signed by an independent firm with its own reputation on the line.

Real transparency uses both: frequent PoR as a quick pulse check, plus a rarer but serious audit as the deep dive.

Does a Small Exchanger Even Need This?

A small exchanger doesn't sit on client funds for months the way an exchange does — most trades settle in minutes. Does that mean Proof of Reserves is irrelevant here? Not entirely.

A customer comparing listings on BestChange is still choosing between a black box and a platform that shows at least some operational transparency — public hot-wallet addresses, regular volume reports, that sort of thing. That builds trust even without a full exchange-grade PoR setup.

Running your own wallet, like iEXWallet, where the exchanger controls its own keys instead of parking funds with a third-party custodian, is a simpler and more relatable step toward transparency than building PoR infrastructure from scratch.

Common Mistakes When Reading a PoR Report

  • Reading "100% reserves" as "audited and legally confirmed" — those are two entirely different documents.
  • Ignoring the snapshot date: a report from last month says nothing about today's balance.
  • Not distinguishing a platform's self-published report from a check by an independent third party.
  • Forgetting to ask about liabilities — the one section PoR almost never covers.

Conclusion

Proof of Reserves is a useful but partial tool: it honestly shows assets as of the check date and says nothing about liabilities, legal structure, or intent. Treat it as one signal among several, not a seal of approval. If you're building your own exchange business and want reserves and wallets handled transparently from day one, rather than patching trust together after the fact, it's worth looking at ready-made infrastructure like iEXExchanger.

Questions and answers

Frequently asked questions about this article

What is Proof of Reserves in plain terms?

It's a cryptographic proof that an exchange or custodian holds the claimed client reserves on its wallets at a given moment. It's built on a Merkle tree and doesn't reveal other users' balances, but it only confirms assets — not the platform's liabilities.

How is Proof of Reserves different from a full audit?

PoR is a quick self-service check of assets that a platform can repeat weekly. A full audit by an independent firm also examines liabilities, internal controls and legal structure, but takes months and costs considerably more.

Can a Proof of Reserves report be gamed?

Technically, yes: assets can be borrowed briefly just to pass the check, and PoR usually doesn't reveal liabilities at all. A single PoR report should be treated as one signal among several, not final proof of reliability.

Does a small exchanger need Proof of Reserves?

Not strictly, in its classic form, since an exchanger doesn't hold client funds for long. But transparency elements — public wallet addresses, regular reports, controlling your own keys instead of a third-party custodian — build customer trust in a similar way.