What can a customer verify, and what not?
According to a CryptoSlate analysis, a typical verification works like this: a customer copies a string of numbers, walks a path through what is called a Merkle tree (a cryptographic structure that makes it possible to prove that a specific record is part of a larger dataset without revealing the entire dataset), and the page confirms that their balance was included in the exchange's proof of reserves.
Such a proof is most likely technically sound. It demonstrates two things:
- the customer's account appeared in the data file,
- the exchange controlled wallets that held enough of the given asset to cover the balances included in that file.
But that is all. According to CryptoSlate, proof of reserves does not say whether really all customers appeared in the dataset, how much the exchange owes its creditors, and what other off-chain liabilities it has.
Why is the difference between assets and solvency crucial?
Solvency means that assets exceed liabilities. Proof of reserves shows only one side of the equation: the assets. The other side is missing, meaning the liabilities.
It was precisely this invisible liability side that was at the heart of the FTX collapse. The exchange could, in theory, prove that it held crypto assets in wallets while being deeply insolvent because of liabilities that appear in no on-chain proof. Proof of assets on its own does not protect against this scenario.
What proof of reserves typically fails to capture
| Question | Does proof of reserves answer it? |
|---|---|
| Does the exchange hold the given asset in wallets? | Yes (at the moment of the snapshot) |
| Is my balance in the dataset? | Yes, if I verify it |
| Are absolutely all balances in the dataset? | No, not without trusting the completeness of the data |
| How much does the exchange owe its creditors and lenders? | No |
| What off-chain liabilities does it have? | No |
Important: the proof is usually a snapshot at a single moment. It says nothing about what the balance sheet looks like the day after.
So how does oversight actually happen?
If cryptographic proof does not cover solvency, then in practice control comes from elsewhere, typically through regulation and law enforcement. Recent reports show the routes it takes.
According to CoinDesk, Brazil's central bank ordered exchanges to hold back large transfers of crypto assets abroad. The rule applies to transfers above 10,000 dollars and to smaller transactions that exchanges assess as risky. That is a form of oversight over flows, not over the balance sheet.
According to Decrypt and Cointelegraph, the U.S. Treasury, through the OFAC office, imposed sanctions on two crypto exchanges that were said to be laundering money for Iran's Revolutionary Guard. According to Cointelegraph, this involved individuals and two exchanges linked to laundering funds in digital assets worth around 5 million dollars tied to Iran. Decrypt states that among those named were an operator based in Georgia and the United Arab Emirates and a platform based in Iran.
Both cases have one thing in common: oversight targets the behavior of the exchanges (flows, money laundering, sanctions), not whether an exchange can actually pay out all its customers. That is a different type of risk from the one that brought down FTX.
What to watch out for with this type of proof
This is not advice on what to do with your money. It is a list of questions that, based on the sources above, can be asked about a proof of reserves:
- Does the proof also cover liabilities, or only assets?
- Does anyone verify the completeness of the dataset, that is, whether everyone is really in it?
- To what moment does the snapshot apply, and how often is it repeated?
- Who assembled the proof, and who independently reviewed it?
What remains uncertain
Cross-checking the sources has its limits. CryptoSlate describes the general mechanism and its gaps, but it does not provide a complete overview of which specific exchanges today also prove their liabilities. Whether and how the practice has statistically changed across the market since the fall of FTX does not clearly follow from the available sources. We are leaving that as an open question that we will keep tracking.

