Proof of Reserves (PoR) is a cryptographic mechanism that lets a centralized exchange demonstrate it actually holds the customer assets its books claim. The minimum-credible version: a Merkle-tree commitment to all user balances plus on-chain attestation of platform-owned addresses, with user-side tools to verify individual inclusion. Mt. Gox didn't have it. FTX didn't have it. After FTX collapsed in November 2022, PoR went from "nice to have" to "table stakes" within months.
What a credible PoR looks like
Three components, all required:
Reserves attestation. The exchange publishes a list of on-chain addresses it claims to control, plus the total balance across those addresses. Anyone can verify the addresses on chain. Better implementations include signed proofs that the addresses are actually controlled (sign a message from each address).
Liabilities attestation via Merkle tree. The exchange computes a Merkle tree where each leaf represents a user account balance, then publishes the Merkle root. The sum of all leaves should equal the platform's customer liability. Each user can independently verify their own leaf is included in the tree by checking the Merkle path.
Independent audit or attestation. A reputable independent firm confirms that the on-chain addresses do contain at least the claimed reserves, and that the Merkle root represents at least the claimed liabilities. The auditor signs and timestamps the report.
What PoR does not prove
PoR is a snapshot, not a continuous attestation. The platform proves it had the reserves at the moment of the snapshot. Between snapshots, anything can happen: rehypothecation, internal loans to affiliated trading desks, undisclosed leverage on prop trading. FTX, for the record, never published a Merkle-tree proof of reserves, so the movement of customer funds to Alameda was never exposed to that kind of check. But even at a platform that does publish PoR, the same kind of misuse can happen between one snapshot and the next.
PoR also does not cover off-balance-sheet obligations: marketing partnerships, employee compensation in unvested tokens, regulatory penalty reserves. These can be material to whether the platform survives.
How often exchanges publish PoR
Publishing frequency and coverage differ from one exchange to the next and change over time. Check each exchange's official Proof of Reserves page for its current schedule, which assets are covered, and whether it offers a tool for verifying your own balance.
For a US-resident holder picking an exchange, the PoR signal is one of three or four to look at — not the only one, but high on the list. An exchange that has published Merkle-tree PoR monthly for two years is materially less likely to be running undisclosed losses than one that has never published anything.
How to actually verify
Binance's verification tool: log in, open the Proof of Reserves page (the menu path changes between app versions), view your account's Merkle leaf and the path to the published root. Compare the root hash to the one Binance published on their public PoR page. If they match, your balance is included; if they don't, ask questions publicly.
Doing this once per year on each CEX you hold balances at is the meaningful operational habit. The first time takes a little while; after that it gets quicker.
Further reading: Exchange evaluation handbook, CEX, Merkle tree.