Proof-of-reserves methods converge on liability trees and third-party review

Exchange proof-of-reserves programmes have converged on a similar structure: a cryptographic commitment to customer liabilities, published wallet attestations, and review by an independent firm.

The liability side is where the technique earns its value. Committing balances to a Merkle tree lets each customer verify their own inclusion without revealing other users' balances, and makes silent understatement detectable in aggregate.

What the technique cannot show is what an exchange owes outside the tree. Borrowings, undisclosed affiliate obligations and encumbered collateral sit beyond its scope, and every serious methodology says so explicitly.

Point-in-time snapshots are a second limitation. Assets borrowed for the attestation window and returned afterwards would satisfy a naive check, which is why more frequent and unannounced snapshots have become the norm.

Reviewers have pushed for signed messages proving control of the wallets involved rather than accepting address lists, closing a gap exploited in earlier attestations.

The consensus among the auditors we spoke to is that proof of reserves is a useful negative test. It can disprove solvency claims quickly; it cannot establish solvency on its own.