Crypto News Dispatch

Crypto news, five minutes a day

security incidents

How Exchange Reserve Reports Have Evolved

From a wallet address posted on social media to cryptographic inclusion proofs. What improved, and what the remaining gap is.

ELENA VOSS · · 2 min read

Reserve reporting in this sector has improved substantially in a short period. The remaining limitation is the same one it started with.

The stages

Stage one: address disclosure. A venue publishes wallet addresses and invites anyone to check the balances.

Establishes that the venue controls certain assets. Says nothing about liabilities, and the addresses could be borrowed for the occasion.

Stage two: attested totals. An accounting firm confirms that assets exceeded customer liabilities at a point in time.

Better, because liabilities are included. Depends entirely on the firm’s work and the standard applied, and a customer cannot verify their own balance was counted.

Stage three: cryptographic inclusion proofs. Customer balances are combined into a tree structure whose root is published. Each customer receives a proof that their balance was included in the total, without revealing anyone else’s.

This is a genuine advance. It converts the liability side from a claim into something individually verifiable.

Stage four: continuous or frequent attestation with unpredictable timing, which addresses the snapshot problem.

What the best current practice looks like

An inclusion proof each customer can verify, a liability total attested by a named firm under a stated standard, address disclosure allowing independent verification of the asset side, and frequent unpredictable timing.

Several venues now do all four. Many do one or two and describe it in the same language.

The gap that remains

Completeness. A customer can verify their balance was included. They cannot verify that every customer was included.

An exchange could omit some customers entirely, and every included customer’s proof would still check out.

Closing that gap requires an auditor attesting that the liability set is complete, which is not a cryptographic property. The strongest current arrangements depend on that non-cryptographic half.

Continuity. Snapshots can be prepared for.

Encumbrance. Assets visible on-chain may be pledged elsewhere.

What to check on a report

Whether liabilities are included. Whether you can verify your own inclusion. Who performed the attestation and under what standard. How frequent and how predictable the timing is.

A report missing the first two is a marketing document.

The structural conclusion

No reserve report makes a venue a safe place for long-term holdings, because the risks include insolvency, regulatory action and operational failure, none of which a snapshot addresses.

What it does is reduce the probability of the worst outcome for the balance you keep there. Venues publishing proofs and attestations, such as a platform serving European retail customers, are meaningfully more transparent than those that do not, and the rule about sizing the working balance is unchanged by that.

reservestransparencyhistory

Spotted an error? Corrections are published with a note at the foot of the article.Send the details.

More from the wire