Proof of Reserves (PoR) is a cryptographic mechanism that lets a centralized exchange demonstrate it actually holds the customer assets its books claim. The minimum-credible version: a Merkle-tree commitment to all user balances plus on-chain attestation of platform-owned addresses, with user-side tools to verify individual inclusion. Mt. Gox didn't have it. FTX didn't have it. After FTX collapsed in November 2022, PoR went from "nice to have" to "table stakes" within months.
What a credible PoR looks like
Three components, all required:
Reserves attestation. The exchange publishes a list of on-chain addresses it claims to control, plus the total balance across those addresses. Anyone can verify the addresses on chain. Better implementations include signed proofs that the addresses are actually controlled (sign a message from each address).
Liabilities attestation via Merkle tree. The exchange computes a Merkle tree where each leaf represents a user account balance, then publishes the Merkle root. The sum of all leaves should equal the platform's customer liability. Each user can independently verify their own leaf is included in the tree by checking the Merkle path.
Independent audit or attestation. A reputable firm (historically Mazars; more recently Armanino, Friedman, Hacken) confirms that the on-chain addresses do contain at least the claimed reserves, and that the Merkle root represents at least the claimed liabilities. The auditor signs and timestamps the report.
What PoR does not prove
PoR is a snapshot, not a continuous attestation. The platform proves it had the reserves at the moment of the snapshot — typically once a month. Between snapshots, anything can happen: rehypothecation, internal loans to affiliated trading desks, undisclosed leverage on prop trading. The 2022 FTX collapse happened despite that platform's prior PoR attestations, because the rehypothecation happened between snapshots.
PoR also does not cover off-balance-sheet obligations: marketing partnerships, employee compensation in unvested tokens, regulatory penalty reserves. These can be material to whether the platform survives.
The major exchanges' PoR cadence in 2026
Binance publishes monthly Merkle-tree PoR with user-side verification tools. OKX, Bybit, and Bitget publish monthly. Kraken publishes biannually via a Merkle-tree approach. Coinbase publishes audited financials (as a publicly traded company) but has resisted full Merkle-tree PoR. Robinhood publishes Form 8-K SEC filings rather than crypto-native PoR.
For a US-resident holder picking an exchange, the PoR signal is one of three or four to look at — not the only one, but high on the list. An exchange that has publishedMerkle-tree PoR monthly for two years is materially less likely to be running undisclosed losses than one that has never published anything.
How to actually verify
Binance's verification tool: log in, navigate to Account > Proof of Reserves, view your account's Merkle leaf and the path to the published root. Compare the root hash to the one Binance published on their public PoR page. If they match, your balance is included; if they don't, ask questions publicly.
Doing this once per year on each CEX you hold balances at is the meaningful operational habit. The first time you do it takes ten minutes; subsequent times are faster.
Further reading: Exchange evaluation handbook, CEX, Merkle tree.