A crypto exchange’s proof of reserves (PoR) is meaningful only within the limits of what it actually checks. Treat it as dated, scoped evidence—not a guarantee that the exchange is solvent or can repay every customer. To evaluate it, check the snapshot time, which assets and liabilities are covered, how wallet control was demonstrated, whether you can verify your own balance, who performed the work, and what the report excludes.
What a proof of reserves can—and cannot—show
A PoR report may provide evidence that specified wallets held specified assets at a particular time, and that customer balances were included in a particular liability commitment. Those are useful checks, but they do not by themselves establish that all obligations were counted, that the assets were unencumbered, or that the exchange can pay customers later.
- It is time-bound. A snapshot describes a point in time. It does not establish what happened after that snapshot or guarantee future access to assets. The PCAOB Office of the Investor Advocate describes PoR reports as point-in-time asset verification with significant limitations.
- Assets alone do not establish coverage. A reserve figure is meaningful only in relation to a sufficiently complete set of liabilities, measured on comparable terms. The SEC has cautioned that PoR may not tell the whole story about liabilities.
- Control is not the same as availability. Evidence that an exchange controlled an address at the snapshot does not necessarily show that the assets were not borrowed, pledged, lent, or otherwise unavailable.
- A customer proof is not a solvency test. A Merkle proof can show that a particular record is included under a published commitment. It cannot, by itself, prove that the commitment includes every customer balance or other relevant obligation.
The PCAOB Office of the Investor Advocate, in an advisory dated March 8, 2023, put the limitation plainly: “Proof of reserve reports are inherently limited, and customers should exercise extreme caution when relying on them to conclude that there are sufficient assets to meet customer liabilities.” This is investor-advocacy guidance, not a financial-statement audit opinion.
Check the disclosure in this order
- Find the underlying report or dashboard. Record its title, the exchange or legal entity it covers, the verifier, the snapshot date and time, and the publication date. A marketing page is the exchange’s claim unless it is corroborated by the underlying report or other evidence.
- Map the scope. Note the covered entities, products, customer account types, assets, networks, and wallet addresses. Look for exclusions and whether the liabilities include only customer crypto balances or also other obligations. The SEC notes that management may influence how often an assessment occurs, which wallets and accounts are selected, the provider and assurance level, and which results are made public.
- Test your own account’s inclusion, if possible. If the exchange provides a customer-specific Merkle proof, use its stated verification method and confirm that the balance and asset set correspond to the report’s snapshot. Save the verification record and the relevant date and time. This checks your record against the supplied commitment; it does not show that every liability was included in that commitment.
- Inspect the asset evidence. Check whether the report identifies wallet addresses and explains how control was demonstrated, for example through signed messages or controlled transactions. Where possible, compare the reported amounts with on-chain balances at the stated snapshot. A list of addresses without an explanation of how control was established leaves an important gap.
- Compare assets and liabilities on matching terms. Confirm that they use the same snapshot, units, and entity scope. Check whether the report addresses borrowed, pledged, lent, or otherwise unavailable assets, and whether non-crypto obligations are excluded. A stated 1:1 or higher ratio is not proof of complete coverage if the liability population or asset availability is unclear.
- Read the verifier’s procedures and conclusion. Identify the provider’s role and independence, the criteria used, the procedures performed, the assurance level, any exceptions, and whether the work is an audit, agreed-upon procedures, or another kind of engagement. Do not infer the scope from the provider’s name or from the word “audit” in promotional material.
- Check how fresh and repeatable the evidence is. Look for a clear publication cadence and evidence that can be independently checked again. A recurring snapshot can help show changes over time, but frequency does not repair missing entities, liabilities, or asset-control evidence.
- State only what the evidence supports. A bounded conclusion might be: “At the report’s stated date, the disclosed wallets held these assets, and this account appeared in the disclosed liability commitment.” Do not translate that into “the exchange is solvent” based only on a snapshot or customer inclusion proof.
Use these criteria to compare disclosures
There is no universal PoR score in the cited SEC or PCAOB guidance. These criteria are a practical comparison framework, not a formally adopted rating standard.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| Area | Stronger evidence | Gap to flag |
|---|---|---|
| Snapshot | Exact timestamp and a stated publication cadence | Undated or stale snapshot |
| Asset scope | Named entities, assets, networks, and addresses | Unspecified entities or selective, unexplained wallets |
| Asset control | A described, reproducible control procedure at the snapshot | Address list with no evidence of control |
| Liability scope | Explanation of the population and how totals are reconciled | A user inclusion proof without an account of how the full liability population was assembled |
| Customer verification | A customer can validate their own record against the stated commitment | Reliance on a screenshot or balance page alone |
| Asset availability | Explicit treatment of borrowed, pledged, lent, or otherwise restricted assets | No explanation of encumbrances or availability |
| Verifier and procedures | Independence, criteria, procedures, assurance level, and exceptions are disclosed | “Audit” used as a label without a clear scope or applicable standards |
| Continuity | Repeated evidence and an explanation of movements between snapshots | A single point-in-time claim presented as enduring solvency |
What a Merkle proof verifies
A Merkle tree combines individual records into a root commitment. A customer’s proof shows that a record and its balance path lead to that root. This can let a customer check inclusion without exposing every other customer’s information.
The key distinction is inclusion versus completeness. A valid path shows that the supplied record belongs under the supplied root. It does not show that the exchange put every relevant balance and obligation into the tree. To assess completeness, look for an explanation of how the records were assembled, which accounts and entities were included, how negative balances or other obligations were handled, and how the committed population was reconciled to the reported liability total.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Binance describes a user-verification process using Merkle structures and zk-SNARK validation, with individual verification records. That is an example of an exchange-provided method for checking a customer record; it remains the exchange’s own description and does not independently establish complete liabilities or solvency. The same distinction applies to any exchange’s proof interface.
Read assurance language carefully
“Proof of reserves,” “verification,” “attestation,” “agreed-upon procedures,” and “audit” are not interchangeable. The SEC’s Investor Bulletin warns that PoR and similar reports may lack specific engagement requirements, omit complete financial statements and liabilities, and provide no assurance. The bulletin is investor information, not a rule or regulation.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
The PCAOB Investor Advocate says PoR engagements are not audits, do not follow PCAOB auditing standards, and are not subject to PCAOB inspection. An accounting firm’s name alone does not turn a limited PoR engagement into a regulated financial-statement audit. Read the actual engagement description to see what work was done and what conclusion, if any, the provider offers.
Keep regulatory reserve rules in their proper scope
Some official reserve requirements concern specific token issuers or qualifying cryptoassets; they are not a universal PoR standard for centralized exchanges. The cited Basel framework text describes public reserve mandates and disclosures, operational resilience, and external audits at least annually for in-scope qualifying cryptoassets. MiCA Article 36 addresses issuers of asset-referenced tokens: it requires reserve assets to be maintained and segregated and provides for independent reserve audits every six months. Whether either framework applies depends on the entity, product, jurisdiction, and current law.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Examples are specific to their issuer, report, and date
- Binance: Its PoR materials describe Merkle-tree and zk-SNARK validation and customer-specific verification records. These features illustrate one user-check flow, not proof that all liabilities are complete.
- Bybit: A Bybit/Hacken report dated March 18, 2026 describes a particular reserve snapshot, address-control checks, and a liabilities Merkle root. Its procedures and conclusion apply to that engagement and date; they should not be generalized to another date, entity, or exchange.
- CoinGecko: A guide updated September 2, 2026 explains exchange-reserve checks and customer Merkle inclusion as a secondary explainer. It is not the primary authority on assurance limitations.
If an exchange publishes no PoR, that means this particular evidence is unavailable; it does not, by itself, prove insolvency. If it does publish one, evaluate the evidence within its stated boundaries rather than treating publication as a safety rating.
Quick Recap
Best Value
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
