MSTR Cat

Crypto Law/Level IV · Holders' traps/4.1 Custody/Lesson 6

Proof of reserves and its limits

After FTX, many exchanges began publishing proof that they hold customers’ coins, but these reports show only part of the picture and are not audits.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Free self-check: use the platform’s Merkle-tree tool to confirm your balance was counted in the latest proof-of-reserves snapshot, noting its date; the PCAOB’s 8 March 2023 advisory says these engagements are not audits.
  2. Prefer, at no extra cost, custodians under legal segregation duties (NYDFS guidance of 30 September 2025; MiCA Article 75(7), creditors have no recourse) over voluntary reports, which miss liabilities and off-tree debts.
  3. The cheapest way to remove proof-of-reserves risk is self-custody; US transfers between your own wallets are not taxable, but keep the basis records and report every later sale.
  4. Check that every asset you hold is covered and that reports recur; a one-off report, or one covering only large coins, leaves your other balances on trust alone.

MaterialsThe PCAOB investor advisory on third-party verification and proof-of-reserve reports (8 March 2023)Any proof-of-reserves page or report published by a platform you use, with its date and the name of whoever prepared itVitalik Buterin, ‘Having a safe CEX: proof of solvency and beyond’ (19 November 2022), for how the liabilities check works

Wonder

  1. What exactly does a proof-of-reserves report prove?
  2. Can an exchange pass a proof of reserves and still be insolvent?
  3. Who checks the people who prepare these reports?

Explore

  1. Proof of reserves is a public demonstration by a custodial platform that it controls enough crypto to cover what it owes customers. The idea is old: Mt. Gox moved 424,242 bitcoins to a pre-announced address in 2011 to show it held them. After FTX failed in November 2022 (lesson 4.1.3), many exchanges published such reports. A full version has two halves. On the asset side, the platform shows it controls certain blockchain addresses, for example by signing messages with their keys. On the liabilities side, it shows the total it owes customers in a way each customer can check.
  2. The liabilities side often uses a Merkle tree. This is a structure that combines many records into a single short code, called a root, so that changing any record changes the root. In a ‘Merkle sum tree’, each branch also carries the sum of the balances below it. Each customer receives a path from their own balance up to the published total, and can confirm that their balance was counted. As Buterin explained in November 2022, the design makes it hard to hide a shortfall with fake accounts with negative balances, but only if enough customers actually check.
  3. The limits are large. A report is a snapshot of one moment; coins can be borrowed for the day and returned after. Showing control of addresses does not show whether those coins are pledged to a lender or owed to someone else. Debts outside the customer tree, such as loans to the platform, may be missing. Customer cash in banks cannot be proved by cryptography. And customers who never check their path do not help catch errors. A platform can show reserves equal to customer balances and still be insolvent if its other debts exceed its other assets.
  4. The PCAOB, the US body that oversees auditors of public companies, issued an investor advisory on 8 March 2023. It said proof-of-reserve engagements ‘are not audits’ and that the reports ‘do not provide any meaningful assurance’. It added that the engagements are not subject to PCAOB auditing standards or inspection, and typically do not address the entity’s liabilities or the rights of digital asset holders. The audit firm Mazars, which prepared a proof-of-reserves report for Binance after FTX’s collapse, suspended its work with crypto clients in December 2022. That pause showed how fragile this kind of assurance can be.
  5. Proof of reserves is voluntary and differs from the legal duties some custodians carry. New York’s Department of Financial Services, in guidance updated on 30 September 2025, expects the virtual currency custodians it licenses to segregate customer assets, keep records clear enough to identify each customer’s holdings, and not use customer assets as collateral or to extend credit except to that customer. In the EU, Article 75(7) of MiCA requires custodians to keep clients’ crypto legally segregated so their creditors ‘have no recourse’ to it, ‘in particular in the event of insolvency’ (lesson 4.1.7). Those are rules backed by supervisors; a published report is not.
  6. A practical check if your platform publishes proof of reserves: find the date of the latest report, who prepared it and under what kind of engagement, and whether it covers liabilities or only assets. Use the tool to check that your own balance appears in the tree. See whether every asset you hold is covered, or only a few large coins, and whether reports come regularly or appeared once. A clean report is one piece of information, not a guarantee; this lesson explains how to read one and does not endorse any platform.

Key facts

  • Mt. Gox moved 424,242 bitcoins to a pre-announced address in 2011 to demonstrate its holdings.
  • A Merkle sum tree lets each customer verify that their balance is included in a platform’s published total of customer liabilities.
  • The PCAOB’s investor advisory of 8 March 2023 states that proof-of-reserve engagements are not audits.
  • According to the PCAOB, proof-of-reserve engagements are not subject to PCAOB auditing standards or inspection and typically do not address the entity’s liabilities.
  • Mazars, which had prepared a proof-of-reserves report for Binance, suspended its work with crypto clients in December 2022.
  • Article 75(7) of MiCA requires crypto-asset custodians to keep clients’ crypto legally segregated so that the custodian’s creditors have no recourse to it.

Exercise nine, six, three, one

9CollectList up to 9 claims a platform makes about the safety of customer assets, from its website, a proof-of-reserves page or its terms, such as ‘reserves exceed 100%’ or ‘assets held 1:1’.
6ClusterSort them into 6 categories: asset evidence, liability evidence, independent review, legal segregation, regulatory supervision, and marketing statements without evidence.
3DistillReduce the 6 categories to 3 groups: claims you can verify yourself, claims verified by an outside party, and claims you must take on trust.
1CrystallizeWrite 1 sentence explaining why a platform could pass a proof-of-reserves check and still fail to repay its customers.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS