Appendix of Don't Trust, Verify: The Proof of Reserves

·

In the rapidly evolving world of cryptocurrency, trust is a fragile commodity. With high-profile exchange collapses and liquidity crises making headlines, users are increasingly demanding transparency. One of the most critical tools in this pursuit is proof of reserves (PoR) — a mechanism that allows exchanges to cryptographically prove they hold sufficient assets to back user funds.

But not all proof of reserves implementations are created equal. Many exchanges offer what appears to be transparency but lacks verifiability — a practice often referred to as proof-of-reserve theater. This article dives deep into real-world examples, evaluating which platforms offer truly auditable systems and where improvements are needed.

What Is Proof of Reserves?

Proof of reserves is a cryptographic method used by cryptocurrency exchanges to demonstrate they hold enough on-chain assets to cover their users' liabilities. A robust PoR system should allow any user or third party to independently verify two things:

  1. Reserves: The exchange holds the claimed amount of crypto in its wallets.
  2. Liabilities: The total user balances are accurately represented and included in a Merkle tree or similar structure.

True verification requires publicly available data, open-source tools, and transparent processes — not just marketing visuals.

Exchanges With Verifiable Proof of Reserves

OKX: Leading the Way in Transparency

OKX stands out as one of the few exchanges offering a fully verifiable proof-of-reserves system.

👉 See how top-tier exchanges are setting new standards in transparency — explore OKX’s verification process.

How to Verify OKX’s Reserves

The reserve data is provided as a large CSV file (~211MB), containing wallet addresses and balances. You can use the Go-based VerifyAddress tool to confirm these addresses belong to OKX.

./build/VerifyAddress --por_csv_filename okx_por_2024041301.csv

For liabilities, OKX uses a ZK-STARK-based system. Users can download their inclusion proof from the "PoR Reports" section and validate it using the Python script zk_STARK_Validator.py.

python zk_STARK_Validator.py

While functional, the interface lacks detailed documentation and intuitive design.

Limitations and Recommendations

One key weakness: private keys only sign the message "I am an OKX address". This proves past control but not current ownership. A better approach would involve signing time-bound data like a recent block hash.

Recommendations:

BitMEX: Transparent and Technically Sound

BitMEX offers another gold-standard example of verifiable proof of reserves.

How to Verify BitMEX’s Reserves

Asset proofs are provided in YAML format (~205KB), listing Bitcoin descriptors. To verify, you need a running bitcoind node:

python3 validate_reserves.py --proof reserves.yaml --bitcoin mainnet://user:pass@localhost:8332

This checks whether the UTXOs matching the descriptors contain the claimed balance — a strong on-chain validation.

For liabilities, a 278MB CSV file contains encrypted user balances structured as Merkle tree leaves. Users can retrieve their Account Nonce from their profile and verify inclusion:

python3 validate_liabilities.py --proof liabilities.csv --account 2 --account_nonce [your_nonce]

The process works smoothly and aligns with Maxwell’s Proof of Liabilities model.

Limitations and Recommendations

Despite technical excellence, BitMEX only supports BTC. Given its wide range of traded assets, expanding PoR to other cryptos is essential.

Recommendations:

Exchanges With Limited or Non-Verifiable Proof

Kraken: Theater Over Transparency

Kraken claims to support proof of reserves for ADA, BTC, DOT, ETH, USDC, USDT, and XRP every six months. However, its implementation falls short.

While Kraken shows a success message like "Found your account details in the merkle tree", this is not independent verification — it's user-facing theater.

A positive aspect: Kraken partners with third-party auditors. These firms could perform validations on behalf of average users who lack technical skills.

Recommendations:

👉 Discover how truly transparent exchanges empower users through open data and tools.

Deribit: Pseudocode Instead of Proof

Deribit claims PoR support but provides only pseudocode and partial data downloads. There is no GitHub repository or executable code.

Like Kraken, this offers appearance without substance — another case of proof-of-reserve theater.

Gate.io: Potential, But Untested

Gate.io has published a GitHub repository (gateio/proof-of-reserves), but independent verification is lacking. Community testing is encouraged to assess its legitimacy.

Key Challenges in Proof of Reserves Implementation

Verification Frequency vs. Security Trade-offs

Hot wallets enable frequent proofs (e.g., BitMEX’s biweekly cadence). Cold storage, however, requires physical access to sign messages — a costly and risky process. That may explain Kraken’s six-month cycle.

As Vitalik Buterin noted in his 2022 essay on solvency proofs, balancing security and transparency remains a core challenge for centralized exchanges.

Core Keywords

Frequently Asked Questions (FAQ)

Q: What makes a proof of reserves truly verifiable?
A: A verifiable PoR must include publicly downloadable datasets, open-source verification tools, and clear documentation enabling independent users or auditors to confirm both asset holdings and user liabilities.

Q: Why is time-bound signing important for reserve proofs?
A: Signing static messages only proves past ownership. Using time-specific data (like block hashes) ensures the exchange controls the keys at the time of proof, reducing risk of using compromised or outdated keys.

Q: Can average users verify proof of reserves?
A: Currently, most verification processes require technical expertise. Exchanges should provide simplified interfaces or partner with auditors to make verification accessible to mainstream users.

Q: Why do some exchanges only support Bitcoin in PoR?
A: Bitcoin’s scripting simplicity makes it easier to implement cryptographic proofs. Multi-chain support requires more complex infrastructure across different consensus models and wallet standards.

Q: What is "proof-of-reserve theater"?
A: It refers to systems that appear transparent but lack actual verifiability — such as showing users a Merkle path without giving access to full data or tools. These designs prioritize PR over real accountability.

Q: How often should exchanges publish proof of reserves?
A: Ideally monthly or biweekly. Frequent proofs reduce the window for fraud. However, cold storage logistics may limit frequency — a trade-off between operational cost and transparency.

Final Thoughts

True financial integrity in crypto hinges on transparency that goes beyond marketing claims. Only OKX and BitMEX currently offer fully verifiable proof-of-reserves systems — with caveats around usability and asset coverage.

Other platforms like Kraken and Deribit fall into the trap of illusionary transparency, offering features that look like audits but cannot be independently validated.

As users demand greater accountability, exchanges must move from theater to substance. Open data, open code, and frequent proofs are no longer optional — they are the foundation of trust in digital finance.

👉 Join the movement toward transparent crypto trading — see how leading platforms are doing it right.