Exchange Proof of Reserves in 2026: How to Verify Your Balance and What the Report Cannot Prove

By CoinX Editorial (gspteck) · Published 2026-10-08 · Last verified 2026-10-08

Many large exchanges now publish "proof of reserves" (PoR) reports, usually with a headline reserve ratio above 100% and a button that lets you check your own account. Few users press that button, and fewer still know what the report leaves out. This guide explains how a PoR review works, how to verify that your own balance was included, and what regulators and cryptographers say a PoR report cannot prove. It is educational account hygiene, not financial, legal, or investment advice, and it does not rate or recommend any exchange. It fits alongside our guides to withdrawal allowlists and 2FA and exchange risk and position sizing.

What a proof-of-reserves review actually does

A PoR review answers a narrow question: at one moment, did the exchange control enough of a specific asset on-chain to cover the client balances it recorded for that asset? Kraken's Proof of Reserves page describes the steps in plain terms:

An independent accountant takes an anonymized snapshot of all client balances.
The balances are aggregated into a Merkle tree, and the tree produces a Merkle root, which Kraken calls "a cryptographic fingerprint that uniquely identifies the combination of these balances."
The exchange produces digital signatures proving ownership of on-chain addresses with publicly verifiable balances.
The accountant checks that those on-chain balances meet or exceed the client balances in the tree.

Other exchanges use variations. OKX's Proof of Reserves page says it uses a zero-knowledge proof system, zk-STARK, to show that the claimed total equals the sum of account balances, that no account has a negative net balance, and that every account is included. Both pages stress the same caveat: the report is a snapshot, and later transactions and out-of-scope assets are not included.

Four-step flow of a proof-of-reserves review: snapshot every client balance at one time, hash the balances into a Merkle tree with one root, use signatures to show the exchange controls specific wallet addresses, then compare on-chain assets with in-scope client balances — A PoR review compares two numbers at one moment: recorded client balances and on-chain assets the exchange can prove it controls.

Why your own check matters

The Merkle approach has a weakness that only users can close. Vitalik Buterin's essay "Having a safe CEX: proof of solvency and beyond" walks through it. An exchange that wanted to understate its liabilities could leave some users out of the tree. A well-built Merkle sum tree catches fake negative balances, but it cannot catch a user who was never included. As the essay puts it, an exchange could get away with that if it identifies users it is "confident will either not bother to check the proof, or will not be believed when they complain."

So the proof is only as strong as the number of people who check it. If your balance is missing or wrong, that is meaningful information, and it is worth raising with support through the app.

How to verify your balance was included

The exact menus differ by exchange, but the process is similar. Using Kraken's published steps as an example:

Find the report in your account. Kraken shows recent reviews that included your account, with the report date, the provider, and the assessment scope.
Check the balances shown. They should match what you held at the snapshot time in the in-scope assets. Kraken notes that staking balances are combined with spot, and that margin positions add a positive adjustment, so read the methodology before you assume a mismatch.
Use your leaf ID. Kraken lets you copy the first 16 characters of your Merkle Leaf ID into the third-party accountant's tool, or recreate your record ID and leaf ID yourself.
Confirm the path to the root. The tool hashes your leaf with its sibling hashes up the tree. The result must equal the root published for that review, the same root every client checks against.

Four steps to check your own leaf: find the report and snapshot date in your account, copy the leaf ID and check the balances match, hash up the path using sibling hashes, and confirm the result matches the root the reviewer published — Your check succeeds only if the recomputed path ends at the same published root every other client sees.

Technically minded users can rebuild the leaf hash in code from the published inputs. Most retail users only need to confirm three things: the balances match, the leaf verifies, and the root matches the one in the public report.

One safety note: only reach the verification page by opening the exchange app or your own bookmark. "Verify your reserves" emails are an easy phishing lure. Our anti-phishing code and bookmark-only login guide covers the habit.

What a PoR report cannot tell you

Regulators have been direct about the limits. The PCAOB's Office of the Investor Advocate published an investor advisory on proof-of-reserve reports. It says PoR engagements "are not audits" and the reports "do not provide any meaningful assurance to investors or the public." It lists specific gaps:

The procedures likely do not address the entity's liabilities, or the rights and obligations of asset holders.
They may not reveal whether assets were borrowed to look like sufficient reserves at snapshot time.
Because they cover one point in time, they give no assurance about whether assets were used, lent, or became unavailable afterward.
They provide no assurance about the effectiveness of internal controls.

The SEC's Office of Investor Education makes a similar point in an investor bulletin on alternatives to financial statement audits. It calls it a red flag when an entity presents a proof-of-reserves report as equivalent or superior to an audit under PCAOB standards.

Comparison: a proof-of-reserves report can show that your balance was in the tree, that in-scope assets existed at the snapshot, that the exchange controlled the listed wallets, and a ratio for each listed asset; it cannot show debts outside the tree, whether assets were borrowed, what happened after the snapshot, or internal controls, overall solvency, and fiat holdings — PoR is a useful asset check, not a solvency guarantee. The right-hand column is where past exchange failures happened.

The cryptography has its own limits. Buterin's essay names "collateral dual-use," where exchanges could pass funds back and forth to look solvent at review time. It suggests real-time proofs, or at least a coordinated schedule across exchanges, as the remedy. It also notes that any proof covering fiat held in banks falls back on "fiat" trust models such as bank attestations and auditors.

How to read the reserve ratio

The headline number is a ratio for each asset: on-chain holdings the exchange proved it controls, divided by the client balances for that asset in the tree. When we checked Kraken's page on 2026-10-08, it listed ratios such as 102.9% for BTC and 100.5% for ETH, with "105%+" for some stablecoins, all as of the 2026-06-30 snapshot. Three points help you read numbers like these:

Ratios are per asset. A strong BTC ratio says nothing about a token you hold that is outside the scope.
The denominator is what the exchange counted. If some obligations were never put in the tree, the ratio looks better than reality. That is why your own inclusion check matters.
A ratio near 100% is the design goal, not a warning. Full reserves means roughly one unit held per unit owed. A figure clearly below 100% for an asset you hold is worth asking about.

A five-minute PoR checklist for retail users

Before you lean on a reserve ratio, check these points:

Six-item checklist: recency of the snapshot date, whether your assets are in scope, verifying your own leaf, who performed the review given it is not an audit, whether liabilities were included, and keeping exposure limited to what you actively use — Six questions turn a headline ratio into something you can actually judge.

Recency. When was the snapshot? Kraken's latest was 2026-06-30 when we checked. OKX describes monthly reports. An old snapshot tells you less.
Scope. Are the assets you hold covered? Kraken lists a specific set of in-scope assets. A coin outside the scope is simply not part of the proof.
Your leaf. Did your balance verify? If not, ask support through the app and keep a record.
Who reviewed it. Is the reviewer named, and is the methodology public? Keep the PCAOB's point in mind: it is still not an audit.
Liabilities. Does the report explain how client liabilities were measured, including margin and negative balances?
Exposure. Even a clean report is a snapshot. Many retail users keep only what they actively trade on an exchange and withdraw the rest to self-custody, using the network checks in our deposit address and network selection guide.

Key takeaways

A PoR review shows that recorded client balances in specific assets were matched by on-chain assets at one moment.
The Merkle proof only works if users check it. Verifying your own leaf takes minutes and is the part only you can do.
US regulators warn that PoR reports are not audits and may miss liabilities, borrowed assets, later movements, and weak controls.
Treat a high reserve ratio as one input, check recency and scope, and limit how much you leave on any single platform.

Educational security and risk hygiene only, not financial, legal, or investment advice. Exchange procedures are summarized from Kraken's and OKX's own public proof-of-reserves pages, and regulatory caveats from the PCAOB and SEC investor resources, as of 2026-10-08. Exchange features, scopes, and snapshot dates change, so check your exchange's official pages for current details. Mentioning an exchange is not an endorsement. No affiliate links. Last verified 2026-10-08.