How to Check an Exchange's Proof of Reserves (PoR): Verifying Your Own Balance and the Limits of Verification

When you see coins in your exchange account, it's easy to assume the exchange is holding that same amount. But the balance shown in your account and the assets sitting in the exchange's wallets need to be looked at separately. Proof of Reserves (PoR) is the material used to compare the two.

The key when reading a Proof of Reserves is not to stop at the assets held. It only becomes meaningful when you go on to check how the exchange tallied the balances it owes customers, and whether your own balance was included in that tally.

Separating Assets Held from Customer Balances in a Proof of Reserves

The assets in the wallets an exchange discloses answer the question "How much does it hold?" The balances in customer accounts answer the question "How much does it owe its customers?" The mere fact that there are lots of coins in the wallets isn't enough to conclude that customer balances are fully backed.

A Merkle Tree is a data structure used to verify customer balances. Balance data is converted into fixed-length values called hashes, and these values are combined step by step to produce a single Root Hash at the top. If the result you calculate starting from your own data matches the published root hash, you can verify that your data was included in that tally.^{1Source 1CoinEx, How to Check Whether My Assets Are in the Merkle Tree}

The important point here is that confirming your balance was included in the tally and confirming the exchange actually holds the assets are two different things. Merkle tree verification answers the first question. To compare assets held against customer balances, you also need separate data on the asset side.

Steps to Check Your Balance with a Merkle Tree

First, you need to match the point in time of the balance you're comparing. A snapshot is data that records balances at a specific moment, so it doesn't necessarily have to match the amount you see in your account right now. For example, suppose you had 1 BTC at the time of the snapshot and deposited 0.2 BTC afterward. The amount to compare in that verification data is 1 BTC.

Below is an example that follows CoinEx's official procedure. Other exchanges don't use the same file names or commands; you use the data and verification tools provided by that particular exchange.^{1Source 1CoinEx, How to Check Whether My Assets Are in the Merkle Tree}

1. Get your verification data from the Proof of Reserves page. Log in to your CoinEx account, go to "Proof of Reserves," and click "Copy My Audit." Compare the coins and amounts in the data with your balance at the time of that snapshot.

1. Save the data as a file. Paste the copied content into a text file named merkle_proof_file.json. Download the verification tool linked in the official help article, unzip it, and put the executable and the data file in the same folder.

1. Run the verification tool in a terminal. Navigate to the folder containing both files. On Mac or Linux, enter ./proof-of-reserves -f merkle_proof_file.json. On Windows, enter ./proof-of-reserves.exe -f merkle_proof_file.json.

1. Read the verification result. Merkle tree path validation passed means the path verification succeeded, and Merkle tree path validation failed means it failed. Success means the result calculated from the data you submitted matches the root in the verification data.

If you only read the success message and move on, you could miss cases where the balance amount differs from reality. There are two things to compare: your balance at the time versus the amount in the verification data, and the Merkle path verification result for that data.

Exchange Risks a Proof of Reserves Can't Reveal

A successful Merkle verification doesn't mean you've verified the exchange's financial health. What goes into the calculation is balances, hashes, and path data, so this calculation alone can't tell you about the exchange's other debts or any agreements outside the published data. A procedure that checks whether your balance was included shouldn't be stretched into a verdict on the safety of the whole company.^{1Source 1CoinEx, How to Check Whether My Assets Are in the Merkle Tree}

The timing of verification is another limitation. A result showing that the balance in a snapshot is correct doesn't mean the same state holds afterward. Likewise, whether every other customer's balance was included isn't proven just by your own account being included.

A failed verification doesn't immediately mean the exchange is short on assets, either. In this procedure, failure means the calculation result didn't match, so you should first check whether the file you used, the verification tool, and the target snapshot all correspond to one another. If the error isn't resolved, you can conclude that "the verification could not be completed," but that result alone isn't grounds to declare whether the exchange is insolvent.

You can read a Proof of Reserves in this order: match the snapshot time and the target assets, compare your balance amount, and then run the Merkle verification. Look at that result together with data on assets held, but confirming that "my balance was included" isn't enough on its own to conclude that "the whole exchange is safe."