Proof of Reserves Is Not Proof of Safety

Proof of reserves can help users see whether a crypto exchange controls certain on-chain assets. However, proof of reserves does not prove that the exchange is solvent, secure, well governed, properly regulated, or able to process every withdrawal. It also does not prove that customers legally own the assets displayed in their account balances.

That distinction matters because exchange users rarely interact with blockchain wallets directly. Instead, they see numbers inside an app. Those numbers may represent a valid claim against the platform. Yet access still depends on the exchange’s custody arrangements, liabilities, internal controls, legal structure, liquidity, and willingness to honor withdrawals.

Therefore, proof of reserves provides useful evidence. Still, it represents only one part of a much larger exchange safety test.

Key Takeaways About Proof of Reserves

Question	What proof of reserves may show	What it usually does not prove
Does the exchange control crypto assets?	It may verify selected wallet balances at a specific time.	It may not show every wallet, asset, or encumbrance.
Can the exchange repay all customers?	It may compare some assets with customer balances.	It does not necessarily prove full solvency or complete liabilities.
Are customer assets legally protected?	Usually not.	Legal ownership and bankruptcy treatment depend on contracts and applicable law.
Can users withdraw during financial stress?	Usually not.	Liquidity, wallet operations, banking access, and platform controls determine access.
Is the platform secure?	Usually not.	Cybersecurity, governance, fraud controls, and operational resilience require separate evidence.

In every case, proof of reserves answers a narrower question than the one users often think it answers.

What Proof of Reserves Actually Means

Proof of reserves is a method that attempts to show that a custodian controls assets corresponding to customer balances. A crypto exchange may publish wallet addresses, use a third-party verification firm, or offer a cryptographic system that lets customers confirm that their balances appear in a liability dataset.

In plain English, proof of reserves tries to answer one question:

Does this platform appear to hold the assets it says it holds?

That question matters. Nevertheless, it remains much narrower than a complete safety assessment.

This distinction has also been highlighted in the PCAOB investor advisory on proof-of-reserve reports, which explains that these engagements should not be viewed as equivalent to a full financial statement audit.

Consequently, users should read proof of reserves as a snapshot. They should not treat it as a full examination of an exchange’s finances, governance, systems, and legal obligations.

Why Proof of Reserves Is Not Proof of Solvency

Solvency means an organization’s total assets exceed its total liabilities. An exchange can hold billions of dollars in visible wallets and still owe more than it owns.

For example, suppose an exchange shows $1 billion in Bitcoin and stablecoins. At first, that figure appears reassuring. However, the platform may also owe:

• $900 million to customers
• $300 million to lenders
• $200 million to trading counterparties

In that example, the company has $1 billion in visible assets but $1.4 billion in obligations. Therefore, it remains insolvent despite showing substantial reserves.

This is why proof of reserves cannot establish solvency unless users can also examine a complete and reliable picture of liabilities.

A typical reserve disclosure may exclude or fail to explain:

• Loans and secured debts
• Outstanding legal claims
• Derivatives exposure
• Guarantees issued to related companies
• Customer balances omitted from the calculation
• Assets pledged as collateral
• Fiat obligations outside blockchain networks
• Debts owed by affiliated legal entities

As a result, proof of reserves without proof of liabilities gives users only one side of the balance sheet.

Even when a platform publishes liabilities, the method still matters. For instance, users need to know whether the dataset includes every customer, every subsidiary, every token, and every off-chain obligation.

Otherwise, proof of reserves may look complete while excluding important financial risks.

Proof of Reserves Does Not Prove Asset Ownership

A blockchain address can show that an exchange controls a private key. However, control does not always equal unrestricted legal ownership.

The exchange may have borrowed the assets temporarily. Alternatively, it may have pledged them to secure a loan. Another creditor may also hold a legal claim over them. In addition, related companies may move assets between wallets before a scheduled snapshot.

Therefore, proof of reserves can sometimes confirm possession without proving that the exchange owns the assets free from competing claims.

The SEC guidance on crypto asset custody also reminds investors that using a third-party custodian means relying on that platform to safeguard private keys and provide continued access to customer assets.

This distinction becomes especially important during insolvency.

Customers often assume that the coins shown in their exchange account belong directly to them. Yet the legal answer can depend on several factors:

• The exchange’s customer agreement
• Local insolvency law
• The legal entity serving the customer
• Whether the platform segregates customer assets
• Whether the company lends or pledges deposited assets
• Whether customers hold ownership rights or contractual claims

The SEC’s investor education staff explains that third-party custodians, including exchanges, manage and control access to customers’ private keys. It also warns that customers may lose access if a custodian suffers a hack, shuts down, or enters bankruptcy. Furthermore, the bulletin advises users to investigate whether custodians commingle assets or use them as collateral.

Accordingly, proof of reserves does not answer the legal ownership question by itself.

An exchange account balance should generally be understood as a platform-dependent claim until the assets reach a wallet that the user independently controls.

How Exchange Custody Changes Who Controls Your Crypto

Custody refers to control over the private keys that authorize blockchain transactions.

When users keep crypto on a centralized exchange, the exchange generally controls those keys. Customers may log in with an email address, password, and security code. However, they do not usually sign the outgoing blockchain transaction themselves.

Instead, the platform decides:

• When a withdrawal can occur
• Which wallets process it
• Whether additional checks apply
• How much a user may withdraw
• Whether the transaction should be delayed
• Whether withdrawals should stop entirely

That structure offers convenience. At the same time, it creates dependency.

Proof of reserves does not remove that dependency. Even a fully backed exchange may freeze withdrawals because of a cyberattack, compliance investigation, banking disruption, software failure, court order, internal risk limit, or liquidity problem.

Therefore, users should separate two questions:

1. Does the exchange appear to hold sufficient assets?
2. Can I access my assets when I need them?

Proof of reserves may help answer the first question. Usually, it cannot answer the second.

Exchange custody is only one part of the bigger picture. Understanding the broader security of cryptocurrencies can help users recognize risks that extend beyond wallet balances and proof of reserves.

Why Proof of Reserves Cannot Measure Withdrawal Risk

An exchange may have enough total assets but still lack the right assets in the right place at the right time.

Consider a platform that owes customers 10,000 units of Token A. Instead of holding all 10,000 units, it may hold an equal dollar value in Bitcoin.

On paper, the platform could appear adequately backed. However, if thousands of customers request Token A at once, the exchange must buy or source that token before completing the withdrawals.

Several problems may follow:

• Token A’s price may rise
• Market liquidity may disappear
• Network congestion may delay transfers
• Market makers may stop providing liquidity
• Trading counterparties may demand more collateral
• The exchange may lack enough operational funds

Meanwhile, customers may remain unable to access their balances.

Therefore, users should examine proof of reserves on an asset-by-asset basis. Total dollar-value coverage can conceal a serious liquidity mismatch.

Cold storage creates another complication.

Keeping most funds offline can reduce exposure to online attacks. Yet moving assets from cold storage may require multiple approvals, hardware access, manual reviews, and additional time.

Consequently, the safest storage arrangement from a cybersecurity perspective may not provide immediate liquidity during a sudden withdrawal surge.

Real Exchange Failure Shows Why Platform Controls Matter

The collapse of FTX showed how customer account balances could remain visible even while the assets supporting those balances had been misused.

In March 2024, the US Department of Justice announced that FTX founder Sam Bankman-Fried had received a 25-year prison sentence after his conviction on fraud and conspiracy charges. The department said he misappropriated billions of dollars in customer funds and directed changes to FTX’s computer code that allowed Alameda Research to withdraw effectively unlimited amounts from the exchange.

The case exposed a risk that proof of reserves cannot fully address: management override.

A reserve snapshot may fail to reveal:

• Privileged account access
• Hidden transfers to related companies
• Fraudulent internal ledger entries
• False financial reporting
• Undisclosed loans
• Management instructions that override controls
• Backdated contracts
• Conflicts between customer interests and company insiders

Therefore, exchange safety requires more than visible wallet balances.

A stronger control environment also needs:

• Segregation of customer and corporate assets
• Independent directors and oversight
• Restricted related-party transfers
• Reconciled internal and blockchain records
• Effective cybersecurity controls
• Controlled administrative access
• Clear withdrawal procedures
• Reliable financial reporting
• Legal protection during insolvency
• Independent audits

Proof of reserves may support transparency. Nevertheless, governance determines whether insiders can bypass the rules.

Regulation Goes Beyond Proof of Reserves

Regulation can impose custody, asset-segregation, capital, governance, disclosure, recordkeeping, and operational requirements. These protections extend well beyond proof of reserves.

For example, the European Union’s Markets in Crypto-Assets Regulation requires covered crypto-asset service providers to safeguard client ownership rights. It also requires providers to prevent the use of client crypto assets for their own account and make arrangements intended to protect customers during insolvency.

In addition, MiCA requires certain client funds to remain in separately identifiable accounts. It also includes governance, recordkeeping, continuity, complaint-handling, and conflict-of-interest requirements.

These rules address risks that proof of reserves alone cannot resolve.

However, regulated does not mean risk-free.

Regulatory standards differ between jurisdictions. Moreover, a company may hold several licenses or registrations, but those permissions may cover only certain services, countries, or legal entities.

For example, a global exchange brand may operate through:

• A regulated European subsidiary
• An offshore trading company
• A separate custody company
• A local payments provider
• An independent banking partner

A customer may believe the entire brand falls under one regulator. In practice, the customer agreement may connect that person to an offshore affiliate with different protections.

Therefore, users should verify the exact legal entity serving their account. They should also identify the regulator overseeing that entity and the protections that apply in their country.

How to Evaluate Proof of Reserves Properly

Users should not ignore proof of reserves. Instead, they should place it inside a broader custody and platform review.

1. Check the Scope of Proof of Reserves

A strong disclosure should identify the assets, legal entities, wallets, and liabilities included.

If the report covers only selected tokens or one subsidiary, users should not apply its conclusion to the entire company group.

2. Check the Date and Reporting Frequency

Proof of reserves can become outdated quickly.

A platform’s financial position may change immediately after a snapshot. Therefore, frequent or continuous reporting provides more information than a single annual check.

Even so, constant wallet visibility still cannot prove complete safety.

3. Look for Complete Liabilities

Assets alone provide limited insight.

Users should look for:

• Customer liabilities
• Loans
• Fiat obligations
• Derivatives positions
• Related-party debts
• Legal claims
• Off-chain commitments
• Asset-by-asset matching

Without that information, proof of reserves cannot show whether the exchange can meet all its obligations.

4. Understand the Verification Method

Different verification methods provide different levels of assurance.

For example, the following are not equivalent:

• A wallet-address publication
• A signed wallet message
• A cryptographic Merkle-tree check
• An agreed-upon procedures engagement
• An assurance report
• A complete financial-statement audit

Therefore, customers should read the methodology. They should also examine the verifier’s independence, scope, assumptions, and limitations.

5. Check Whether Assets Are Encumbered

An exchange may hold an asset while another creditor holds a stronger legal claim over it.

Users should therefore ask whether the platform has:

• Pledged the asset
• Lent it
• Rehypothecated it
• Used it as collateral
• Transferred ownership rights
• Committed it to another obligation

Proof of reserves becomes much less useful when assets are encumbered.

6. Review Custody and Withdrawal Terms

Customer agreements often give exchanges broad powers during unusual conditions.

Therefore, users should examine:

• Withdrawal limits
• Processing delays
• Compliance-review clauses
• Account-freeze provisions
• Insolvency language
• Asset-ownership language
• Dispute procedures
• Jurisdiction clauses

A wallet balance may appear fully backed. Still, contractual terms may let the platform delay access.

7. Test Small Withdrawals

A successful small withdrawal does not prove long-term safety. However, it can confirm that account controls, wallet addresses, and network procedures work before a larger transfer becomes urgent.

Furthermore, testing withdrawals can help users identify:

• Unexpected fees
• Address restrictions
• Withdrawal waiting periods
• Network limitations
• Identity-verification problems
• Minimum transfer amounts

8. Limit Unnecessary Exchange Exposure

An exchange can function as a trading venue without becoming a permanent savings account.

Users may choose to keep only active trading funds on the platform. Meanwhile, they can hold longer-term assets through a custody method they understand and can manage safely.

However, moving crypto away from an exchange does not eliminate risk. It transfers responsibility from the platform to the user.

Proof of Reserves and Self-Custody Address Different Risks

Self-custody removes reliance on an exchange’s withdrawal approval because the user controls the private keys.

However, self-custody introduces different dangers.

A user may lose crypto through:

• A stolen seed phrase
• A compromised device
• A fake wallet application
• A malicious smart-contract approval
• Physical damage to a hardware wallet
• An incorrect blockchain transfer
• An insecure backup
• A phishing attack
• Loss of the recovery phrase

The SEC’s crypto custody bulletin explains that self-custody gives users sole control while also making them responsible for key and seed-phrase security. If those credentials are lost or stolen, the user may permanently lose access.

Therefore, proof of reserves should not become an argument that every person must self-custody every asset.

The right approach depends on:

• Technical ability
• Transaction frequency
• Risk tolerance
• Backup practices
• Asset value
• Personal security
• Access needs

A balanced strategy may involve keeping active trading funds on an exchange while storing longer-term holdings through a custody arrangement the user can operate responsibly.

Questions Users Should Ask an Exchange

Before relying on proof of reserves, users should ask the following:

Area	Question to ask
Liabilities	Does the calculation include every customer and creditor obligation?
Legal entity	Which company legally holds my account?
Ownership	Do the terms say I own the crypto, or do I hold a claim against the exchange?
Segregation	Are customer assets kept separate from corporate assets?
Encumbrance	Can the company lend, pledge, or reuse customer assets?
Liquidity	Does the platform hold each asset it owes, rather than an equivalent dollar value?
Withdrawals	When can the exchange suspend or delay access?
Verification	Is the report a full audit, limited assurance report, or agreed-upon procedures engagement?
Regulation	Which regulator oversees the entity serving me?
Insolvency	What happens to customer assets if the company fails?
Security	Who controls private keys and administrative access?
Insurance	Which losses are covered, and what exclusions apply?

Clear answers do not guarantee safety. Nevertheless, vague or incomplete answers should increase caution.

Conclusion: Proof of Reserves Is One Signal, Not a Safety Guarantee

Proof of reserves can improve transparency because it may show that an exchange controls specific assets at a particular time.

Even so, proof of reserves cannot establish complete liabilities, legal ownership, asset segregation, liquidity, cybersecurity, effective regulation, honest management, or uninterrupted withdrawal access.

Therefore, users should treat proof of reserves as one checkpoint within a wider custody review. They should also examine solvency, legal entities, liability coverage, asset encumbrance, governance, security systems, withdrawal terms, and insolvency protections.

Exchange safety is only one factor affecting crypto investors. It’s equally important to understand why Bitcoin still reacts to broader financial conditions, even though the network itself operates independently.

Ultimately, an exchange balance shows what the platform says it owes you. Actual control depends on whether the platform can and will honor that claim when conditions become difficult.

Frequently Asked Questions

What is proof of reserves?

Proof of reserves is a process through which a custodian attempts to show that it controls certain assets associated with customer balances. The method may involve wallet addresses, cryptographic verification, or third-party procedures.

Why is proof of reserves not a full audit?

A full financial audit examines broader financial statements, liabilities, accounting records, controls, and supporting evidence. Proof of reserves usually focuses on selected assets and customer-balance information at a particular time.

Can an exchange pass proof of reserves and still fail?

Yes. An exchange may have hidden liabilities, pledged assets, insufficient liquidity, weak cybersecurity, fraud, legal problems, or poor internal controls. Proof of reserves does not eliminate these risks.

Does proof of reserves guarantee withdrawals?

No. Withdrawals depend on available liquidity, wallet operations, compliance controls, banking access, network conditions, and platform decisions.

Is self-custody always safer than an exchange?

No custody model removes every risk. Self-custody reduces reliance on an exchange, but users can lose assets through stolen keys, compromised devices, scams, damaged backups, or operational mistakes.

What should users check besides proof of reserves?

Users should examine liabilities, asset segregation, legal ownership, regulatory status, withdrawal terms, insurance coverage, audit quality, asset encumbrance, governance, and the exact legal entity holding their account.

---

Disclaimer

This article is for informational and educational purposes only. It does not provide financial, investment, legal, tax, or accounting advice. Cryptocurrency and digital asset markets involve risk, including possible loss of capital. Readers should conduct their own research before making any financial decision.