Four years after FTX, crypto exchanges still prove assets without proving solvency

A customer opens an exchange account, copies a string of numbers and follows a path through a Merkle tree. The page processes the request and returns a reassuring result: the customer's balance was included in the exchange's proof of reserves.

The verification is most likely technically sound, establishing that the account appeared in a dataset and that the exchange controlled wallets that contained enough of a particular asset to cover the balances represented there.

However, it can easily leave out whether every customer appears in that dataset, how much the exchange owes to lenders, whether the displayed coins have been pledged as collateral, and whether the company actually controlling the wallet is the same company that's legally required to repay the customer.

The interface on most exchanges makes this reserve verification process feel pretty comprehensive and final because people tend to give more authority to cryptographic evidence than to corporate promises.

But what many miss is the fact that the result only establishes that an exchange demonstrated control over specified assets at a specified moment. A determination of solvency, on the other hand, requires both a deeper and a wider view of the company's obligations, ownership structure, and access to funds.

What proof of reserves actually proves for exchanges

Proof of reserves became an industry priority after FTX collapsed in November 2022, when Binance founder Changpeng Zhao urged exchanges to publish wallet evidence and major platforms began releasing dashboards, Merkle-tree tools, and reserve ratios.

CryptoSlate documented that initial rush as exchanges tried to contain a crisis of trust, then followed the industry's attempt to develop more advanced forms of cryptographic verification.

An exchange can publish wallet addresses and sign a message using the private keys attached to those wallets, demonstrating control without moving the assets, while a Merkle tree converts each customer balance into a cryptographic hash and combines those hashes into a single root.

A customer can use that structure to verify that their balance contributed to the root without gaining access to anyone else's account. Newer systems add zero-knowledge proofs, which can confirm that calculations followed a stated set of rules while keeping individual balances private; Binance, for example, incorporated zk-SNARK verification into its reserve system after the first post-FTX disclosures.

Major platforms now publish different versions of this process. Binance provides a reserve dashboard and customer verification, OKX publishes wallet information and downloadable proof files, Kraken offers account-level verification for covered balances, and Crypto.com provides a Merkle-based verification interface.

These systems improve on a model that required users to trust claims. They can expose false claims about asset holdings, make large withdrawals more visible, and allow customers to confirm that their balances appeared in the published dataset.

But these systems have limits, and most of them come from the dataset itself. A Merkle tree can authenticate the records placed inside it, but it can't identify accounts omitted before the tree was built. It also can't identify a bank loan, tax bill, legal judgment, or guarantee made to an affiliated company, leaving a rigorous mathematical process tied to a financial perimeter chosen by the exchange.

Most reserve reports also measure assets at a particular time and may be published after an accountant, security firm, or internal team has completed its work. A snapshot can accurately represent just one moment without reflecting the company's normal position, because assets move before or after the measurement. The resulting total then reveals little about the origin of the funds or their availability during the next withdrawal surge.

Historical reporting, frequent snapshots, and permanent wallet archives help outsiders place each measurement in context. They increase the amount of evidence available across time, but the resulting record remains focused on assets rather than the full financial condition of the company responsible for returning them.

Beyond the wallets, a maze of liabilities

Crypto exchanges have an unusual advantage over banks and brokerages because much of what they hold can be observed on public blockchains. However, liabilities are recorded across internal databases, bank accounts, contracts, and corporate ledgers, so public blockchain analysis provides little visibility.

Customer claims are recorded in an exchange database, fiat balances depend on banks and payment companies, and derivatives produce gains and losses that change rapidly. Lending products, institutional loans, vendor bills, taxes, and legal claims can also easily belong to several companies operating across multiple jurisdictions.

A dashboard showing $10 billion in crypto provides no comprehensive account of whether the exchange owes $8 billion, $10 billion, or $15 billion, whether another creditor holds a claim over the same assets, or how readily those assets could meet a wave of withdrawals.

The Public Company Accounting Oversight Board has warned investors that proof-of-reserve reports vary widely because they fall outside its audit oversight, and may provide an inadequate basis for deciding whether a company has enough assets to meet its obligations.

The SEC chief accountant's warning addresses a related source of confusion: reviews, attestations, and agreed-upon-procedures engagements usually examine a narrower body of evidence than a financial-statement audit, even when an accounting firm performs the work.

An exchange may advertise the involvement of an outside accounting or security firm, though that firm may have been hired only to compare selected wallet balances with selected customer liabilities. An engagement like that can exclude corporate debt, internal controls, related parties, litigation, and the company's ability to remain in business, so its value depends on readers understanding exactly what the firm examined.

There's also the problem of the exchanges' corporate structure. A global exchange brand can operate through numerous companies, with one serving European retail customers, another contracting with institutions, another controlling wallet keys, and another employing staff. Lending, derivatives, and custody services can each operate under separate terms.

A reserve page may refer to assets held across a global group without identifying which company owns each wallet, while the customer agreement may assign repayment responsibility to a particular subsidiary. During insolvency, those distinctions help determine which law applies and how to prioritize creditors.

The most valuable disclosures identify the legal entities, products, and jurisdictions included in the review. They also explain what exactly is covered (fiat, derivatives, institutional accounts, margin balances, third-party custodians, etc.), and disclose what affiliates can do with customer assets.

There's currently no unified way to provide these results, so they vary across exchanges, producing public records that range from account-level cryptographic checks to broader statements about global holdings.

As a listed company, Coinbase publishes audited consolidated financial statements. Its annual filing covers debt, collateral, derivatives, commitments, subsidiaries, and related-party transactions alongside crypto holdings. Deloitte addresses the financial statements and internal control over financial reporting in its audit reports.

None of that can, of course, guarantee that Coinbase will avoid a withdrawal surge, management failures, or technical failures. Nonetheless, it shows how much broader the available evidence becomes when reviewers examine the company as an economic whole rather than evaluating a collection of wallets.

The public approaches summarized below come from the exchanges' reserve pages and Coinbase's audited filing, and they should be read as different disclosure models rather than a ranking of financial strength.

Strong disclosure can't guarantee survival, while limited public disclosure doesn't establish insolvency. The comparison shows what an outsider can establish from each platform's published evidence and how much interpretation remains once the reader moves beyond wallet balances.

The industry often presents proof of reserves as a tool available to every customer. However, the process can require locating an account code, downloading a file, running software, and understanding how a hash connects to a Merkle root. Even after a successful verification, the customer must understand that the result covers one account's inclusion rather than the completeness of the exchange's accounting records.

A user can confirm that their own balance appeared, but they can't inspect every other customer account, reconcile the liability total with the company's general ledger, or identify an undisclosed corporate loan from a cryptographic branch. For many users, the verification badge becomes the practical endpoint, with phrases such as "verified," "fully backed," or a reserve ratio above 100% carrying a broader financial meaning than the published work supports.

CryptoSlate's analysis of Binance reserve movements illustrated how these dashboards can provide valuable information during periods of heavy withdrawals while also showing how dollar-denominated reserve totals can move. Reserve data can inform an assessment of an exchange, though the assessment becomes credible only when the asset record is joined to information about liabilities and corporate responsibility.

What full financial accountability would require

A credible solvency framework would bring blockchain verification and conventional financial reporting into one continuous system, requiring exchanges to prove control over on-chain assets, reconcile every customer balance with the general ledger, identify the legal entities responsible for repayment, disclose assets pledged to other creditors, and explain how fiat, derivatives, lending products and institutional accounts are treated.

Historical reports would remain publicly accessible, while external firms would state the exact scope, methodology and limits of their work. Large custodial platforms would also publish audited consolidated financial statements or equivalent regulatory disclosures covering debt, liquidity, collateral, related-party exposure and customer-asset segregation.

Within that framework, cryptographic proofs would serve as clear and precise evidence about assets and customer balances, while financial audits and legal disclosures would establish how those assets relate to the obligations of the wider company. Each layer would address a different part of the same financial picture, allowing customers, auditors and regulators to evaluate custody, accounting completeness and corporate responsibility together.

FTX made visible reserves a basic expectation for any exchange holding customer funds. The next standard must connect those visible assets to every material liability and legal entity behind them, giving customers evidence that extends from the wallet address to the company responsible for returning their money.