How to check an exchange is really holding your money
Proof of reserves is the only tool a customer has for verifying a balance exists. Most published proofs do not survive a careful read — here is what separates the real ones.
A real proof of reserves shows three things: the assets an exchange holds, the total it owes customers, and a way for you to confirm your own balance is counted in that total. A proof missing any one of those is not evidence — and by that standard, most of what the industry publishes does not qualify.
We researched the custody position of 29 exchanges for our exchange rating. What follows is the checklist that came out of it, in the order the questions actually matter.
Does it include liabilities?
This is the question that eliminates most published proofs. A list of wallet addresses shows that a company controls some coins. It says nothing about how many coins it owes you and every other customer — and an exchange with $1bn of visible assets and $2bn of liabilities is insolvent while looking perfectly healthy on a block explorer.
Bitfinex publishes exactly that: a text file of wallet addresses on GitHub, assets only, no liabilities, last updated in 2022. Kraken, by contrast, states its own position plainly — that anything less than a liability-inclusive proof is not a full proof of reserves — and publishes one accordingly.
Who signs it?
A proof the company computed itself is a claim, not an audit. The distinction matters more than it sounds, because the entire point of the exercise is to remove the need to take the company's word.
The technically strongest proof we found belongs to OKX: monthly, liability-inclusive, using zero-knowledge proofs over a Merkle commitment, with open-source verification code. No independent auditor is named anywhere in it. It is cryptographically excellent and institutionally self-attested — OKX checks OKX.
How old is it?
A dated snapshot is the difference between evidence and decoration. Crypto.com still directs customers to a proof-of-reserves page naming Mazars as attestor and citing 7 December 2022 — an auditor that publicly withdrew from all crypto proof-of-reserves work that same month, more than three years ago. The methodology underneath is decent. The date is not.
Can you find your own balance in it?
The best proofs give each customer a personal cryptographic receipt — a Merkle proof — showing their balance was included in the total the auditor signed off. Without it you are trusting that the company put your account in the calculation.
If your exchange offers this, use it. It takes a few minutes, it works, and almost nobody does it.
The four ways a proof fails
- Assets only. Wallet addresses with no liability total — the most common failure, and the least useful document in the category.
- Self-attested. Real machinery, no independent signature. Better than nothing, and not what an audit means.
- Stale. A proof whose last dated snapshot is years old, often with an attestor who has since left the business.
- Claimed only. A page that exists and contains no data. When we opened one venue's reserve-ratio table, it rendered “No data” and invited us to stay tuned.
What a proof of reserves still cannot tell you
Even a perfect proof is a photograph. It shows the position at one moment, and says nothing about what happens the next day. It also says nothing about whether the assets are encumbered — pledged, lent out, or subject to a claim you cannot see.
That is why our rating weights custody at 40% but does not stop at the proof: we also record what each venue holds in a protection fund, whether that fund has ever paid out, and — after every incident on record — whether users actually got their money back rather than being promised it.
A pledge to compensate users is the cheapest sentence in this industry. Confirmation that it happened is one of the rarest.
The short version
Ask four questions: does it include liabilities, who signed it, when, and can you check your own balance. Two minutes on an exchange's transparency page answers all four. If the answers are no, nobody, years ago and no — that is your answer about where to keep the money.
Frequently asked questions
What is proof of reserves?+
A published demonstration that an exchange holds the assets it owes customers. A complete one contains three parts: the assets held, the total liabilities to customers, and a way for individual customers to verify their own balance was included in that total. Proofs missing the liability side are common and tell you very little.
Which exchanges have the best proof of reserves?+
In our research, Kraken has the strongest overall position: liability-inclusive, attested quarterly by a named accounting firm, with a personal Merkle proof for every client. OKX publishes the most cryptographically advanced version — monthly, zero-knowledge, open-source verification — but with no independent auditor named, so it is self-attested.
Can a proof of reserves be faked?+
It can be constructed to look meaningful while proving nothing. The common patterns are publishing wallet addresses with no liability figure, self-computing the numbers with no outside signature, leaving a years-old snapshot in place, or publishing a page with no data in it at all. Each of those appears in the venues we researched.
Does a proof of reserves mean my money is safe?+
No. It is a snapshot at a point in time. It does not show whether assets are pledged or lent out, and it does not prevent a company failing the day after it publishes. It is one piece of evidence — the best one available to a customer — rather than a guarantee.
How this was reported
ChainWatch Daily is independent and reader-funded. Stories are written by named journalists and checked against primary sources before publishing. We disclose holdings, correct errors in the open, and never accept payment for coverage.