Crypto Exchange Insolvency Risk: A Practical Guide to Auditing Proof-of-Reserves

Proof-of-Reserves (PoR) can answer an important question: does a crypto custodian appear to control enough specified assets to cover specified customer balances at a particular snapshot? It cannot, by itself, answer the bigger question: is the exchange solvent, liquid, legally able to return your assets, and safe from undisclosed obligations?

That distinction is the foundation of a useful PoR audit. The Public Company Accounting Oversight Board’s investor advisory warns that PoR reports are not financial-statement audits and may not address liabilities, customer legal rights, borrowed assets, or future adequacy of reserves. A strong review therefore treats PoR as one layer of evidence—not a certificate of solvency.

What exactly should a good Proof-of-Reserves prove?

At minimum, a useful PoR system should let you evaluate both sides of a simple relationship:

Verified in-scope reserves ≥ verified in-scope customer liabilities.

“In-scope” matters. If an exchange proves BTC and ETH reserves but excludes fiat, derivatives collateral, certain tokens or particular subsidiaries, the resulting ratio does not describe the entire business. Likewise, showing a list of wallet addresses proves little about what the company owes customers unless liabilities are measured with comparable rigor.

A Merkle tree is commonly used to commit to customer balances without publishing every customer’s identity and balance. Each account becomes a leaf in a cryptographic tree; users can verify that their leaf contributes to the published root. Some systems add zero-knowledge proofs. Binance, for example, says its current PoR uses Merkle trees and zk-SNARKs to prove that user balance sets contribute to aggregate net account balances. Its August 5, 2026 verification guide says snapshots are taken on the first day of each month and results are released by the seventh.

Kraken uses a different implementation: its PoR page describes an independent third-party accountant taking an anonymized balance snapshot, constructing a Merkle tree, verifying signatures proving control of on-chain addresses, and comparing reserves with client balances. Its displayed June 30, 2026 snapshot reports reserve ratios above 100% for the listed in-scope assets. These examples show why you must read each exchange’s methodology rather than assuming “PoR” means one standardized procedure.

Quick audit table: what each check can and cannot tell you

Step 1: Start on the exchange’s official PoR page

Never begin from a social-media screenshot, influencer spreadsheet or copied wallet list. Open the exchange’s official domain and locate its reserve or transparency page. Record the snapshot date, publication date, assets covered, legal entity or entities covered, verification mechanism, reserve addresses, liability methodology and any third-party report.

For a concrete example, Binance’s official PoR page publishes its mechanism, Merkle root information and reserve-address download. Kraken’s official PoR page publishes snapshot ratios, covered assets and its verification process.

Red flag: a page that advertises “100% reserves” without clearly defining the numerator, denominator, snapshot time and included products.

Step 2: Verify that your own balance is in the liability set

This is the part an individual customer can often verify most directly. Obtain the exchange-provided Record ID, Merkle Leaf ID or equivalent proof for the chosen snapshot. Confirm that the displayed balance matches what your account held at the snapshot time, then use the official verifier or documented open-source tool to validate the path from your leaf to the published Merkle root.

Binance’s updated August 2026 guide identifies verifier version 1.2.1 for the August 1, 2026 cycle onward and explains how users can retrieve their Merkle Leaf and Record ID. Kraken likewise lets clients verify a Merkle Leaf ID and its path to the root for supported reviews.

If your proof validates, you have evidence that your balance was included. You have not independently established that all other customers were included, that no non-customer liabilities exist, or that the liability accounting rules are economically complete.

Step 3: Check reserve assets on-chain

Download or copy the officially published reserve addresses. For each major blockchain, inspect the address using a reputable block explorer or, if you operate one, your own node. Match balances near the stated snapshot block or time rather than blindly comparing today’s balance with an older report.

Then ask three separate questions: Does the asset exist? Does the exchange demonstrate control? Is it available to satisfy customer claims? The first can often be checked on-chain. The second may be demonstrated through signed messages or other ownership procedures. The third is harder: a blockchain balance alone generally cannot tell you whether the asset is pledged, borrowed, subject to a lien, owed to another counterparty or legally outside the customer pool.

The PCAOB specifically warns that a PoR procedure may not reveal whether assets were borrowed temporarily to make reserves appear sufficient. This is why an unexplained large inflow shortly before a snapshot—and reversal shortly afterward—deserves investigation, although movement alone is not proof of misconduct.

Step 4: Recalculate coverage asset by asset

Do not rely solely on a green “fully backed” badge. If the report supplies reserve and customer-balance totals, recompute:

Reserve ratio = eligible reserve assets ÷ corresponding customer liabilities × 100%.

A 101% ratio means little if the methodology excludes material obligations. Also examine asset quality. A reserve consisting of the same asset owed to customers is easier to interpret than one relying heavily on an exchange-issued token, thinly traded collateral or assets requiring aggressive valuation haircuts.

Check whether customer borrowing or margin debt is netted against balances and how collateral is valued. Binance added collateral information to its PoR system in 2024 and says it applies haircuts to collateralized assets to reflect liquidity. In January 2026 it also changed the scope of net account balances after saying the previous presentation included platform-owned assets in a way that inflated displayed reserve ratios. Methodology changes like this are exactly why historical ratios should not be compared without reading the definitions.

Step 5: Audit the liabilities methodology, not just the Merkle math

A cryptographically valid Merkle tree can faithfully commit to an incomplete dataset. The crucial questions are accounting questions:

• Which customer accounts, products and subsidiaries are included?
• Are spot, margin, futures, earn/lending and institutional balances treated consistently?
• Are negative balances allowed, and can they reduce aggregate liabilities?
• How are unrealized derivatives gains and losses handled?
• Are fiat claims included?
• Are loans, vendor obligations, bonds, taxes, legal claims and affiliate liabilities outside the PoR?
• Can management alter the population or procedures without independent challenge?

Kraken, for example, explicitly describes how futures balances are treated and notes that the review covers specified in-scope assets. That is useful disclosure because it lets a user identify the boundary of the proof. The right reaction to exclusions is not automatically “unsafe”; it is to avoid extrapolating a limited proof into a company-wide solvency conclusion.

Step 6: Read the third-party report like an auditor

Look at the engagement type and the exact language of the practitioner’s conclusion. “Agreed-upon procedures,” “attestation,” “review,” and “audit” are not interchangeable. Under agreed-upon procedures, management can specify the procedures and the practitioner reports findings; that is fundamentally different from an independent financial-statement audit opinion.

The PCAOB investor advisory on PoR reports emphasizes that PoR engagements are not audits and warns against placing undue reliance on them. Check the practitioner’s identity, professional licensing, independence, reporting standard, period covered, exceptions found and whether the report is addressed to the public or restricted users.

Step 7: Go beyond PoR and test actual insolvency risk

Solvency means more than having enough crypto at one timestamp. An exchange can have fully backed customer wallets and still face losses or liquidity pressure elsewhere in its corporate group. Examine audited financial statements when available, regulatory filings, debt, related-party transactions, proprietary trading, lending, collateral practices, legal contingencies and customer-asset segregation.

A useful benchmark for the difference is a public company with audited reporting. Coinbase’s 2025 Form 10-K, filed February 12, 2026, includes an independent registered public accounting firm’s audit opinion and extensive financial statements and risk disclosures. The filing says Coinbase separately ledgers corporate and customer crypto assets, describes custody arrangements, and states that annual audits and quarterly reviews cover internal controls and reconciliation processes. This is much broader evidence than a reserve snapshot, although it still does not eliminate custody, cyber, market or legal risk.

Legal segregation matters because the central insolvency question is not merely “where are the coins?” but “whose property are they in bankruptcy?” The Financial Stability Board’s global framework stresses effective segregation of client assets from a service provider’s own assets. The SEC staff also noted in 2026 that non-security crypto assets generally are not protected by SIPA and customers can face loss in insolvency, while certain Article 8 arrangements may help keep customer assets outside a broker-dealer estate.

Step 8: Look for liquidity and concentration problems

PoR commonly compares nominal assets with liabilities. A run, however, is a liquidity event. Ask how quickly the reserves could satisfy withdrawals without severe price impact or operational bottlenecks.

Concentrated reserves deserve a haircut in your own risk assessment when they contain illiquid tokens, affiliated assets or assets whose market value could collapse at the same time confidence in the exchange falls. Also inspect whether the exchange combines custody, lending, market making, token issuance and proprietary trading. The Financial Stability Board’s analysis of multifunction crypto intermediaries warns that combinations of these functions can amplify leverage, liquidity mismatch, conflicts and interconnected risks.

A 10-minute PoR audit checklist

What should make you reduce exchange exposure?

No single signal proves impending insolvency, but multiple transparency failures should change your risk posture. Examples include unexplained withdrawal restrictions, repeated methodology changes without reconciliations, missing reserve addresses, inability to verify your liability inclusion, heavy dependence on an affiliated token, unclear asset segregation, opaque related-party lending, or management describing a limited PoR as a complete audit.

Risk management does not require predicting an exchange failure. If you do not need assets on an exchange for active trading, consider whether the counterparty exposure is necessary. Self-custody removes exchange insolvency risk but introduces private-key, operational and inheritance risks of its own. Diversifying custodians can reduce single-counterparty concentration but does not turn weak custodians into safe ones.

What PoR can legitimately tell you

A well-designed Proof-of-Reserves system is valuable. It can make it harder for a custodian to claim reserves that do not exist, let customers test whether their balances were included, and create recurring public checkpoints. Cryptographic verification is a meaningful improvement over an unsupported promise.

But the correct conclusion after a successful PoR audit is modest: the evidence supports the stated reserve coverage for the defined assets and liabilities at the stated snapshot. It is not “this exchange cannot fail.” Insolvency analysis requires the rest of the balance sheet, legal rights over customer property, liquidity, leverage, affiliates, operational controls and the quality of independent assurance.

Information checked September 15, 2026. This guide is educational and does not provide financial or legal advice. Rules governing custody and insolvency vary by jurisdiction.