Proof of reserves is a process by which a custodian, exchange or other platform shows that it controls a certain amount of Bitcoin at a specific moment. Done well, it pairs that with evidence of what the provider owes its clients. It is a useful transparency tool, but it is not an audit, and it does not by itself prove that a provider is solvent or well controlled.
How proof of reserves works
Because Bitcoin balances are recorded on a public blockchain, a provider can demonstrate control of specific addresses without revealing private keys. The usual steps are:
- Assets: the provider identifies the addresses it controls and proves control, typically by signing a message with the relevant keys or by moving a small amount on request.
- Liabilities: the provider publishes a summary of what it owes clients, often using a Merkle tree, a data structure that lets each client check their own balance is included without seeing anyone else's.
- Comparison: the total assets are compared with total client liabilities at the same moment.
- Attestation: an independent accounting firm may perform agreed procedures and report on the result.
Assets without liabilities is only half the picture. A provider could control a large balance and still owe clients more than it holds.
What proof of reserves does and does not tell you
| It can show | It cannot show on its own |
|---|---|
| Control of specific addresses at a point in time | Whether assets were borrowed for the snapshot |
| Total client liabilities, if included | Liabilities outside the client ledger, such as loans |
| That an individual client balance is included | Solvency of the provider as a whole |
| Ratio of assets to client liabilities | Whether controls operated between snapshots |
| Legal ownership of the assets in insolvency |
The gaps matter. A point-in-time snapshot can be dressed up for the day. Off-ledger liabilities may not appear. And control of keys says nothing about who would own the coins if the provider failed.
Proof of reserves in a governance framework
From a board's point of view, proof of reserves is evidence, not assurance. It should sit alongside, not replace, the core custody tests.
Segregation
Does the provider hold the company's Bitcoin in segregated addresses, or in an omnibus pool? With segregated addresses, the company can often verify its own holdings directly on the blockchain, which is stronger than a provider-wide snapshot.
Bankruptcy remoteness
Proof that coins exist is different from proof that they belong to clients. The contract, the legal structure and the governing law decide that. Take legal advice.
Independent assurance
SOC 1 Type II and SOC 2 Type II reports test whether controls operated effectively over a period, typically six to twelve months. That covers the time between snapshots that proof of reserves cannot.
Insurance
Insurance terms are a separate question. A strong reserve ratio does not mean losses from theft or error are covered.
Practical tip: if your holdings are segregated, reconcile your internal ledger directly to your own blockchain addresses every month. That is your own proof of reserves, and auditors value it.
Questions to ask a provider about proof of reserves
- How often is proof of reserves performed, and is the timing announced in advance or unannounced?
- Does it include liabilities, or assets only?
- Are all client liabilities included, including those of affiliates?
- Who performs the independent work, and what exactly is the scope of their report?
- Are any reserve assets lent out, pledged or otherwise encumbered?
- Can we verify that our own balance is included?
- How does the proof of reserves relate to your SOC reports and audited financial statements?
These belong in a broader custody due diligence process.
Where proof of reserves fits for corporates
For a company choosing a custodian or a trading counterparty, proof of reserves is most useful as a screening signal. A provider that publishes regular, liability-inclusive reports with independent involvement is showing a willingness to be checked. A provider that refuses raises a question worth exploring.
For a company holding its own keys, the concept still applies. The finance team should be able to show, at any time, that the Bitcoin recorded in the ledger matches what sits in the company's addresses. That reconciliation supports the audit and the disclosures required under fair value accounting.
For counterparties used in execution, such as OTC desks and venues, the related question is how long company assets sit with them at all. Shortening that window is often more effective than relying on any snapshot. See settlement and counterparty risk.
Limits worth remembering
- A snapshot is only as good as the moment it was taken.
- Methods differ between providers, so results are not always comparable.
- An attestation report is not the same as a full financial statement audit. Read the scope.
- Transparency about assets does not replace a sound legal structure.
How The Bitcoin World helps
We help finance teams interpret proof of reserves alongside SOC reports, contracts and insurance terms as part of custody architecture and provider selection. We do not hold client assets. Custody and execution are carried out by licensed third-party institutions. Our guide to corporate Bitcoin custody sets out the wider options.