Proof of Reserves

One of the biggest risks in crypto is "custodial risk"-the danger that an exchange (like FTX) is using your deposits for other things and doesn't actually have the money when you want to withdraw it. Proof of Reserves is the industry's answer to this. It uses "Merkle Trees" to allow users to verify their own balance is included in the exchange's total liabilities, while the exchange also provides "on-chain proofs" showing the total assets they control in their cold wallets. If Assets >= Liabilities, the exchange is fully backed.

A standard PoR audit usually has two parts. First, an independent auditor (or a decentralized protocol like Chainlink) verifies the exchange's control over certain blockchain addresses. Second, the exchange generates a Merkle root of all user balances. A user can then take a "Merkle proof" of their own balance and check it against the root. This allows for "private verification": I can prove my money is there without the whole world seeing my balance. This is much more powerful than a traditional bank audit, which happens behind closed doors and only once or twice a year.

For investors, PoR is a "trust but verify" tool. You should generally avoid keeping large amounts of capital on exchanges that do not provide regular, third-party-verified Proof of Reserves. However, PoR is not perfect. It usually only shows "assets" and "liabilities"-it doesn't necessarily show an exchange's "off-chain debts" or "liabilities to other companies." An exchange could have a perfect PoR but still be insolvent if they have a massive secret loan from a bank. Therefore, while PoR is a major step forward for transparency, it should be used alongside other risk management practices, such as self-custody.