Reading a Proof-of-Reserves Update

A proof of reserves report is a snapshot of the assets a custodian claims to hold on behalf of customers at a specific moment, usually published as a list of addresses and a total. The proof of reserves figure is only half of a solvency question, and the half that is easier to produce.

Reading one properly means separating what the report establishes from what the headline number implies. This article covers the three common levels of assurance, why liabilities are the harder side, how to run a coverage ratio yourself, and which questions a reserves update cannot answer no matter how professional it looks.

• Reserves are an asset-side snapshot. They answer “what is held”, not “what is owed”.
• Control of an address is not the same as ownership. A signature proves keys, not that the coins are unencumbered.
• Coverage is a ratio, and ratios hide denominators. A high percentage against an incomplete liability set is meaningless.
• Timing is part of the claim. A snapshot taken at one block height says nothing about the balance sheet a month later.

What a proof of reserves report does and does not show

The report shows that, at a stated time, a set of addresses controlled by the reporting entity held a stated quantity of assets. That is a real and useful fact: it rules out the simplest form of misrepresentation, where a venue claims holdings it does not have. The mechanism is usually a signed message from each address, which demonstrates control of the private key at that moment.

What it does not show is what the entity owes. Solvency is assets minus liabilities, and a reserve figure without a liability figure is an inventory count. A custodian can hold a billion in assets, owe 1.3 billion to customers and publish a perfectly accurate reserve report, because the report never mentions the 1.3 billion.

Three levels of assurance, and what each is worth

Reports that all get called reserve attestations sit on a spectrum, and the differences are about who verified what.

Self-reported snapshots

The entity publishes addresses and totals with no external review. This is better than nothing because addresses can be checked independently on-chain, but the selection of addresses is entirely the entity’s choice, and nothing prevents it from omitting an address that carries a lien, a loan or a claim from a counterparty.

Third-party attestation

An accounting firm performs agreed-upon procedures and states that the balances match at a point in time. Attestations are narrow by design: they confirm the procedures were followed, not that the procedures were sufficient, and they typically cover assets only. Read the scope paragraph before the conclusion, because the scope is where the limitation lives.

Full audit with liabilities

A full audit covers both sides, includes internal controls, and expresses an opinion on the financial statements rather than on a single number. It is the strongest option and the rarest, partly because verifying customer liabilities requires handling personal data and partly because the work is expensive and slow.

Why liabilities are the harder half

Assets are public on a blockchain; liabilities are private records. Proving what you owe every customer requires each customer to check a leaf in a Merkle tree against their own balance, which means publishing a root and asking users to verify inclusion. That process is technically feasible and socially awkward: few users check, and the ones who do reveal information about their own holdings.

A reserve report answers a question about assets. Solvency is a question about the difference between assets and liabilities, and the difference is the part that usually goes unpublished.

The arithmetic: coverage ratios and what they hide

Coverage is reserves divided by liabilities. Assume a report shows 1,020,000,000 in reserves against 1,000,000,000 in customer liabilities, which is a coverage ratio of 102 percent and reads as comfortably solvent.

Now ask what the liability figure includes. If the reported liabilities cover only deposit accounts and exclude balances held through an institutional or omnibus arrangement, the true figure might be 1,400,000,000. The same reserves against that denominator give 1,020 divided by 1,400, or 73 percent. Nothing in the report changed; only the completeness of the denominator did, and the completeness is asserted rather than proven.

Timing does similar work. Suppose 40 percent of reserves sit in a volatile asset and its price falls by half between the snapshot and the date you read the report. The reserve figure drops from 1,020,000,000 to roughly 816,000,000 while liabilities in dollar terms stay near 1,000,000,000, and coverage moves from 102 percent to about 82 percent. A snapshot is a photograph of a moving object, and the older it is, the less it describes the present.

How to read a proof of reserves update in seven steps

1. Find the timestamp and the block height. A report without one cannot be tied to anything.
2. Check whether liabilities appear at all, and if so, whether they are proven or merely asserted.
3. Read the scope paragraph for what the reviewer did and did not examine.
4. Identify who performed the work and whether they are independent of the entity.
5. Look for the addresses, not just totals, so the balances can be checked on-chain yourself.
6. Recompute the coverage ratio with the numbers given rather than trusting the stated percentage.
7. Compare the report date with today, and note how much of the reserve asset mix could have moved.

What a proof of reserves update cannot tell you

It cannot tell you whether the entity is solvent, because solvency needs liabilities. It cannot tell you whether the assets are unencumbered, because a token in an address can be collateral for a loan that does not appear. It cannot tell you about off-chain obligations, contingent liabilities, or commitments to counterparties that settle outside the visible addresses.

The disclosure habit

It also cannot tell you about governance. A reserve report is a disclosure, and disclosure depends on the entity continuing to disclose. The absence of a new update after a period of regular ones is itself information, and it is usually noticed later than it should be.