What a Merkle proof really verifies, what remains off-chain and why a 102% reserve ratio is not an insurance policy. Research cutoff: October 13, 2026.
An exchange can show on-chain wallets containing more cryptocurrency than its published customer balances and still leave unanswered the most important customer-protection question: what happens if the company becomes insolvent tomorrow? Proof of reserves is a valuable transparency technique, but it answers a narrower question than advertising sometimes implies. It can establish that selected assets exist and, where the process is properly designed, that an individual account was included in a particular liability snapshot. It cannot by itself establish clean ownership, absence of hidden creditors, adequate internal controls or continued access to the assets. [1][2]
This distinction is not academic. Kraken’s public proof-of-reserves dashboard lists, for its June 30, 2026 snapshot, ratios including 102.9% for BTC, 100.5% for ETH and 100.3% for ADA. Binance publishes a separate system for users to inspect reserve coverage and inclusion. Both efforts convey information that an opaque custodian does not provide. Yet the PCAOB and SEC have specifically cautioned against treating PoR as the equivalent of financial-statement audits. The right analysis is not to dismiss verification or to confuse it with comprehensive protection. [3][4][1]
Three Different Claims Often Masquerade as One
A reserve statement can refer to three distinct claims. First, an exchange proves control of wallet addresses with tokens at a fixed block height. Second, it demonstrates a calculation of in-scope customer balances or liabilities. Third, it asserts that customer claims are legally backed and can be satisfied even in a crisis. Evidence for the first two does not establish the third. Control of private keys is not necessarily unencumbered legal title; total account balances are not necessarily total corporate debt.
The common arithmetic is reserve coverage = eligible reserve assets divided by measured customer liabilities. If an exchange reports $10.2 billion of included assets and $10 billion of customer liabilities, the disclosed coverage is 102%. This figure is meaningful only after asking what assets and liabilities are inside the perimeter and at what time. It also gives no direct answer on operational availability: coins in a controlled wallet may be locked, pledged, subject to competing claims or difficult to transfer under crisis conditions.
FIGURE 1 | Original visualization; sources and scenario assumptions in article and methodology.
A complete customer-protection assessment needs at least five layers: cryptographic verification of assets, a complete and correctly signed customer ledger, identification of corporate and off-balance-sheet obligations, legal segregation and beneficial ownership, and governance that prevents asset misuse between checks. Treat PoR as one diagnostic inside this broader system. Calling it insurance exaggerates the role of cryptography; assuming an external accounting label proves the financial condition of the entire enterprise exaggerates the role of an attestation.
What a Merkle Tree Can—and Cannot—Prove
A Merkle tree converts account-level records into cryptographic hashes and a single root commitment. A customer can use a provided proof path to verify that an account entry was included in the published dataset without viewing other customers’ information. Proper construction makes post-publication alteration detectable. Kraken describes individual inclusion verification and third-party accounting review, while Binance describes its own methods, including zero-knowledge elements designed to strengthen privacy and liability checks. Procedures and assurance levels differ. [3][5]
Inclusion verification is not the same as completeness. A proof that your $5,000 balance exists among a set of entries does not show that every other customer’s balance was included, or that the exchange did not omit certain obligations. More sophisticated cryptographic techniques can help prevent negative balance manipulation and support consistent liability totals, but the construction and input data remain crucial. If the ledger misstates customer rights before hashing, cryptography can faithfully commit to the wrong record.
Proof of wallet control has similar limits. An address signed at a snapshot may demonstrate access to the relevant keys, but it does not conclusively establish the exchange is the beneficial owner, that assets are not pledged or borrowed, or that another party has no claim. A report needs scope, independent procedures, exclusions and evidence of legal interests to avoid creating an unjustified sense of certainty. The PCAOB expressly warns that borrowed assets might temporarily make the firm appear solvent in some designs. [2]
The Hidden-Liability Problem: A Coverage Ratio Can Collapse Without Any Coins Moving
Suppose reported reserves are $10.2 billion and reported customer claims are $10 billion, a 102% ratio. Now assume—purely as a diagnostic scenario—an additional $1 billion of customer-equivalent obligations were omitted. True coverage against $11 billion would be 92.7%. At $2 billion omitted, the ratio would be 85%. The same assets remain visibly on-chain; the customer outcome changes because the denominator changes. None of these numbers is an allegation about Kraken, Binance or another named platform.
FIGURE 2 | Original visualization; sources and scenario assumptions in article and methodology.
The missing liabilities need not be ordinary exchange account balances. They might include unsettled withdrawals, margin obligations, collateral re-use, affiliate commitments, customer fiat liabilities, derivative payables or claims arising from litigation. Some are genuine customer-asset obligations; others are corporate liabilities that matter primarily in insolvency. They should not all be added mechanically into a single token coverage calculation, but a complete financial analysis must identify them and test their priority. The asset proof has to be interpreted alongside balance sheets, capital adequacy and enforceable customer rights.
One of the most frequent errors is to read a ratio above 100% as a shareholder-equity buffer. Customer assets held in custody may not be company assets available to pay corporate creditors, and a narrow token reserve excess may not absorb operational losses. The converse matters too: ordinary corporate debt does not automatically reduce a legally segregated trust asset pool if the structure works as intended. Legal rights decide what belongs in each recovery waterfall. Cryptographic evidence cannot settle that property-law question by itself.
Snapshot Risk: Today Is Not the Same as Every Day
A PoR is usually stamped at a particular block height and reporting date. If an exchange lends, transfers or pledges assets later, the original snapshot may remain mathematically true while ceasing to describe current liquidity. The SEC and PCAOB both warn that the procedures may say little about transfers after the review or the ability to satisfy demands when customers request withdrawals simultaneously. [1][2]
Continuous on-chain monitoring improves visibility, but it still cannot see every bank account, off-chain loan, sub-custodian balance, derivative netting agreement or legal lien. A real-time wallet dashboard plus an outdated or incomplete liability denominator is not a real-time solvency audit. Proof systems are strongest when the exchange reconciles on-chain and off-chain records, explains material reserve movements, and subjects related controls to independent examination between snapshots.
The relevant retail question is how quickly cash or coins can actually be paid out. If 20% of clients request withdrawals within a week, a platform’s matched customer assets may be sufficient in principle, yet access can be hampered by concentrated custodians, key controls, network congestion or asset conversion. Availability is a separate variable from accounting coverage. The problem becomes more severe for lending or earn programs that permit customer assets to be used rather than strictly safeguarded.
Liquidity Stress Test: Fully Backed but Slow to Pay
Consider a hypothetical exchange with $10 billion of customer claims and $10.2 billion in verified included assets. Assume the firm can mobilize only 15%, 35%, 60% or 100% of those assets quickly, depending on wallet architecture, security processes, contract restrictions and liquidity. A simultaneous 20% withdrawal demand means $2 billion must be delivered. Available immediate resources under those scenarios would be $1.53 billion, $3.57 billion, $6.12 billion and $10.2 billion respectively. The first case misses the immediate liquidity demand by $470 million despite having 102% reported coverage. This is a hypothetical mobilization model, not an observed exchange stress test.
FIGURE 3 | Original visualization; sources and scenario assumptions in article and methodology.
A shortfall against immediate requests is not necessarily proof of insolvency. Some assets may be available after a delay without losing value. But a delay can trigger further withdrawals, price discounts, emergency financing and confidence shocks. A useful transparency regime would therefore address liquid unencumbered reserves and delivery time, not just a balance matching a selected point in history. Customers should look for published withdrawal-performance data and incident disclosures rather than mistaking a static ratio for a guarantee of operational continuity.
Segregation and Bankruptcy Rights Change the Result
Regulators increasingly focus on what the customer legally owns. The European Union’s MiCA Article 75 requires in-scope crypto custodians to maintain client position registers, segregate clients’ crypto from corporate holdings and establish procedures for return. It also addresses liability for losses attributable to the service provider, subject to the article’s terms. New York’s Department of Financial Services updated its custodial guidance in September 2025, emphasizing clear customer beneficial interests, separation of client assets, and careful treatment of sub-custodians. Those safeguards are distinct from on-chain proof. [6][7]
For an individual holding $20,000 on an exchange, two economically similar balances may carry different claims. In a pure custodial relationship with enforceable segregation, the client may have a property-based claim to specific or pooled client assets subject to local law. In an earn/lending arrangement, the customer may have transferred title or accepted an unsecured debtor claim. Yield adds a different recovery waterfall, even if the mobile app displays exactly the same $20,000. The decisive documents are the signed product agreement, jurisdiction and asset-use clauses—not the green tick next to ‘Reserves.’
This is closely related to the distinction in Dave Finances’ analysis of stablecoin depegs and redemption rights: a displayed token price, disclosed reserves and an individual’s actual enforceable redemption right are separate questions. Similarly, Dave Finances’ wallet scam and authorization checklist addresses another protection layer PoR cannot supply—whether a customer has independently signed away control of coins to a malicious contract.
What a Real Audit Adds—and What It Still Cannot Guarantee
A financial-statement audit is not a magic protection against fraud or future failure. It nevertheless tests a broader accounting perimeter under established standards, including financial statements, accounting policies, material disclosures, going-concern considerations and selected evidence. A proof-of-reserves attestation can have a more restricted scope, use agreed-upon procedures rather than an assurance opinion and may not address corporate liabilities or controls. The SEC’s investor bulletin and PCAOB’s advisory explicitly explain that difference. [1][2]
Some firms have improved PoR by adding client-liability reconciliation, independent verification, proof of asset control and user self-service checks. Kraken’s public June 2026 ratios are not merely an unsupported marketing claim; users can examine inclusion details for covered assets and the methodology. Binance similarly publishes an explanation of its reserve machinery. But a consumer should still ask how the audit firm was engaged, whether it expresses an opinion, which entities and assets were excluded, and how it handles borrowed balances. [3][4][5]
There are also conflicts of interest within vertically integrated exchanges. A platform may simultaneously custody crypto, list products, finance trades, provide liquidity and operate its own token or affiliated entities. IOSCO’s recommendations call attention to conflicts, segregation, independent reconciliation and safeguarding. Separate governance over customer assets matters more than the aesthetic sophistication of a dashboard. Dave Finances’ analysis of behavioral fraud monitoring at exchanges illustrates why a strong internal control environment spans trading, security and account governance rather than merely an on-chain balance. [8]
A Practical Proof-of-Reserves Scorecard
| Control dimension | Strong evidence to look for | Not proved by wallet balance |
| On-chain assets | Control signatures, chain scan, in-scope list | Unencumbered title |
| Customer obligations | Merkle inclusion, full liabilities and exclusions | Corporate debt completeness |
| Corporate solvency | Audited statements and debt detail | Ability to survive all shocks |
| Asset rights | Clear segregation and enforceable custody terms | How court will apply law |
| Withdrawal readiness | Operational metrics and stress procedures | Future uninterrupted liquidity |
| Oversight | Independent controls, audits and governance | Protection against every fraud |
TABLE 1 | Analytical framework compiled for this article.
The scorecard should not be turned into a simplistic numeric exchange ranking. A venue can pass a strong cryptographic check while failing on legal disclosure, and another can have excellent audited accounting but weak asset-by-asset transparency. Verify each dimension using current documentation, not a badge from a previous year. Ask particularly whether fiat balances, derivatives, loans, pending withdrawals and assets held by sub-custodians were excluded from the snapshot. A report that explains its limitations candidly can be more useful than a glossy claim of perfection.
What Would Falsify the Claim That PoR Builds Trust?
If regular reports reveal unexplained declines in asset coverage, changing methodology, unmatched customer liabilities or large delays to withdrawals, public transparency is no longer doing its intended job. Likewise, if customers cannot independently verify their records, if the reporting entity changes repeatedly, or if an exchange uses PoR to discourage examination of its financial statements, the report should carry less weight. The PCAOB specifically warns against equating non-audit procedures with comprehensive audit assurance. [2]
The converse is observable too. An exchange that publishes consistent third-party procedures, reconciles customer liabilities, discloses asset reuse and entity boundaries, subjects corporate accounts and controls to established audits, and actually processes withdrawals through market stress provides multiple mutually reinforcing forms of evidence. None guarantees asset safety. Together they reduce important information asymmetries more meaningfully than any single ratio.
Bottom Line: Verification Is Evidence, Not Compensation
Proof of reserves is neither useless nor sufficient. It can reveal whether stated on-chain collateral matches a defined customer-balance snapshot and can give a customer a cryptographic inclusion check. That is genuine progress compared with complete opacity. It cannot guarantee that an exchange is solvent across every entity, that legal segregation will survive bankruptcy, that every liability is disclosed or that funds remain available tomorrow. Investors should treat the report as one layer in an evidence stack: independently checked assets, complete obligations, audited controls, legal asset rights and tested withdrawal capacity.
A reader deciding where to hold $1,000 or $100,000 should be less impressed by a single 102% graphic than by clear answers about ownership, exclusions, loan programs, sub-custodians and access in a crisis. The central falsifiable proposition is whether the exchange can turn its transparent snapshot into actual asset delivery when everyone asks for their coins at the same time.
Methodology
Figures are sourced from exchange reserve pages as publicly available during research and regulators’ published guidance. The $10.2 billion asset/$10 billion reported liability example is hypothetical; hidden-liability scenarios vary denominator only. The liquidity illustration assumes 20% simultaneous withdrawal requests and a separate immediately mobilizable fraction of reserves; it is not a probability estimate or allegation about a named platform. No PoR coverage statistic is presented as insurance or audited net worth. Regulatory analysis describes product-specific and jurisdiction-specific provisions, not legal advice. Research checked October 13, 2026.
Sources & primary documentation
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574