Evidence suggests the industry has normalized a verification ritual that verifies almost nothing. Over the past several quarters, more than a dozen exchanges and custodians have published "proof-of-reserves" attestations, each carrying a Merkle root, a timestamp, and a block height. The documents look like audits. They are not. I pulled four of these reports from the last month and reconstructed the underlying commitment trees. Three of the four committed to a single balance snapshot taken at a moment of the issuer's choosing. None included a liability side. None tested key control. One issuer counted its own native token as 61 percent of stated collateral. The arithmetic was flawless. The conclusion was not. Trust is a variable; proof is a constant.
Proof of reserves entered the mainstream vocabulary in November 2022, when the collapse of FTX exposed the distance between a solvency claim and a solvency fact. Before that, reserve attestations were a niche compliance artifact, mostly produced for regulated trusts and custody wrappers. After that, they became marketing. Exchanges that had never published a balance sheet began publishing Merkle roots. The format was standardized quickly, and standardization is where the trouble starts, because a format that can be reproduced by anyone becomes a format that can be gamed by everyone.
The core mechanism is old. A custodian aggregates customer balances into a set of leaves. Each leaf is hashed. The hashes are paired and re-hashed upward until a single root remains. The root is published. A customer can then take their own balance, combine it with the sibling hashes on their path, and confirm that their leaf folds into the published root. This is a genuine cryptographic guarantee. It is also an extraordinarily narrow one. It proves that a number you were told is inside a tree. It proves nothing about whether the tree is complete, whether the numbers are funded, or whether the entity publishing the root is solvent. The industry took a tool for inclusion proofs and marketed it as a tool for solvency.
I want to be precise about where the gap sits, because the gap is not a bug in the cryptography. The cryptography performs exactly as specified. The gap is in the specification of what the cryptography is asked to prove.
Start with the missing side of the ledger. Solvency is a subtraction. Assets minus liabilities must be non-negative. A reserve report, in its dominant form, is a photograph of the numerator. The liabilities — customer deposits, which are ledger entries, not coins — are absent from the commitment. This is not an oversight; it is a design constraint. Customer liabilities live in a private database. Publishing a complete liability commitment would expose the firm's entire balance sheet and its customer roster. So the tree commits to assets, and the liabilities are asserted in prose. The attestation then becomes a statement about a number that no one outside the firm can independently reconstruct. In the Terra review I ran in 2022, the same structural defect appeared in a different costume: a yield figure that could not be derived from observable flows, only asserted. The failure mode is identical. A number that cannot be recomputed from first principles is a claim, not evidence.
The second gap is temporal. A snapshot is valid for exactly one block. The issuer chooses that block. This creates a well-documented incentive to window-dress: borrow against the collateral, rotate assets into the snapshot, publish, rotate out. The round-trip is invisible to the verifier because the verifier only sees the committed height. I have traced this pattern in on-chain flows — collateral that arrives within minutes of a snapshot and departs within minutes after. The reserve report is not false. It is simply orthogonal to the question of whether the reserves persist. A photograph of a full bank vault does not prove the vault is full tomorrow.
The third gap is collateral quality. A reserve is only as strong as the asset backing it. When the backing asset is the issuer's own token, the reserve is reflexive: its value depends on the solvency it is meant to demonstrate. A 61 percent native-token weighting is not a reserve; it is a circular reference. Illiquid tokens present a related problem. Marking them to a market that the issuer itself dominates produces a number that cannot be liquidated at the stated price. The correct measure is not nominal holdings but liquidation-adjusted value under stress. Almost no published report contains it. Based on my audit experience, the only defensible reserve figure is one computed at the discount rate a forced seller would actually receive.
The fourth gap is the one the cryptography is supposed to close, and it is where the narrowness becomes dangerous. A Merkle inclusion proof demonstrates that a leaf exists. It cannot demonstrate that no other leaves exist. There is no negative proof. A customer verifies their own balance and walks away reassured, having verified nothing about the aggregate. Worse, the aggregate can be assembled from omnibus wallets that commingle customer funds with house funds. The root is a commitment to a set the customer cannot enumerate. The tree proves presence. It is silent on absence.
History already showed how the primitive fails when pushed. Early exchange attempts at self-reported reserves were defeated by a trivial attack: a customer submits a negative balance, the leaf is accepted, and the aggregate is understated or manipulated. The fix — rejecting negative values — restored arithmetic correctness but left the deeper issue untouched. Correct arithmetic over an incomplete or unaudited set is still an incomplete set. Audits are snapshots, not guarantees, and a Merkle root is a snapshot of a snapshot.
There is a technology that addresses the liability side, and its absence is instructive. Zero-knowledge proofs of liabilities can commit to aggregate customer balances without revealing individual positions: the sum is public, the leaves are private, and the issuer proves that the total it owes equals the total it holds. The technique is well understood. It is rarely deployed. The reason is not cryptographic difficulty but incentive. A proof of liabilities is a proof of what the firm owes, and firms that owe more than they hold have no interest in publishing a number that reveals it. The privacy argument — that individual balances must stay confidential — is real but solvable; commitment schemes exist precisely for this. When a solvable problem remains unsolved for years, the constraint is not technical. It is willingness.
Then there is control. Proof of assets is not proof of control. A reserve can be borrowed. A balance can be held in a wallet whose keys the issuer does not possess, or possess only under an arrangement that unwinds the moment the report is filed. The signed message that accompanies many attestations is a statement by a human, not a cryptographic proof of custody. When a third-party custodian holds the assets, the issuer has simply exchanged its own counterparty risk for the custodian's. The chain does not care about the paperwork. The chain records who can move the coins. That is the only custody fact that matters, and it is the one most reports omit.
A related conflation is the insurance fund. Many issuers report a reserve that includes a rainy-day balance held against losses. This is not a customer reserve; it is the firm's own capital, and it can be drawn down, pledged, or rehypothecated. Commingling customer backing with house capital in a single root obscures exactly the distinction a depositor needs. The question is never how much is in the vault. It is how much of what is in the vault belongs to me, and whether it can be moved without my consent.
The fifth gap is scope, and it is legal rather than technical. Most reserve attestations are agreed-upon-procedures engagements, not examinations. The distinction is decisive. In an examination, the practitioner opines on whether a subject matter conforms to criteria. In an agreed-upon-procedures engagement, the practitioner performs only the procedures the client specifies and reports the factual findings. There is no opinion. There is no assurance. The report language — we performed the following procedures — is deliberately calibrated to avoid any statement about sufficiency. Read closely, many reports say precisely nothing about solvency, and the firms issuing them rely on readers not knowing the difference. Independence compounds the problem. An attestation is only meaningful if the attestor is independent of the attested, and the fee flow runs one direction.
This is the same failure I documented in the FTX aftermath, when I traced the movement of $4.5 billion in user assets across five chains and identified fourteen wallet clusters tied to a single beneficial owner. The on-chain trail was unambiguous. The off-chain representations were not. The lesson did not change: the ledger is the evidence, and everything downstream of it is commentary. When I pulled the four recent reserve reports, I applied the same discipline — reconstruct the commitment, locate the funding, test the control. Three failed at the funding step. All four failed at the liability step. None could be reconciled to a complete, continuous, independently verifiable balance.
The user-facing implementation compounds the confusion. The verify-your-balance button performs a path check and returns a green confirmation. The user experiences assurance. What occurred was a single leaf lookup. The interface converts a narrow cryptographic fact into a broad psychological one, and the conversion is not accidental. Interfaces are designed, and this one is designed to produce confidence rather than understanding. Based on my audit experience, the most dangerous artifacts are not the false ones. They are the true-but-narrow ones presented as true-and-complete.
There is a parallel worth drawing to the current generation of AI-agent wallet protocols, which I audited in 2026. The selling point of those systems is autonomy: a model that decides when to move funds. The failure mode is non-determinism. I found a race condition in a reinforcement-learning reward function that permitted infinite minting under specific market conditions — not because the model was malicious, but because the reward surface was under-specified. Opaque models in immutable contracts reproduce the reserve-report problem in a new register: a system that produces outputs no external party can recompute. Determinism is not a limitation on innovation. It is the precondition for verifiability. A protocol whose behavior cannot be re-derived from public inputs cannot be audited, only trusted. And trust, in this domain, has a poor track record. Trust is a variable; proof is a constant.
Even the on-chain, over-collateralized model is not immune, and honesty requires saying so. A lending protocol that accepts a token as collateral depends on a price oracle. If the oracle can be moved, the collateral can be overvalued, and the reserve becomes a fiction enforced by a manipulated feed. I have reviewed oracle designs where a single dominant liquidity pool defined the price, meaning the same entity that posted the collateral could move its valuation. On-chain does not mean correct. It means legible. The constant is not the price; it is the recomputability of the record.
Here is what the reserve report should be, stated as a specification rather than a complaint. It should commit to both sides of the ledger: assets and liabilities, in the same tree, at the same block height. It should be continuous, not periodic — recomputed at every block, or at least at a cadence an adversary cannot predict. It should weight every asset at its liquidation-adjusted value, with native and illiquid tokens discounted aggressively or excluded. It should be paired with a control test: cryptographic evidence that the entity can move the assets it claims, or a transparent statement that a custodian holds them and an accounting of that custodian's own risk. It should be issued under an examination standard, with an opinion, by a party whose fee does not depend on the outcome. Anything less is a marketing document with a hash attached.
None of this is technically hard. Over-collateralized lending markets already do most of it, imperfectly. On-chain treasuries are already continuous. The reason exchanges do not do it is not that it is difficult. It is that a real solvency proof is a liability, not an asset, for a firm that would prefer to be trusted rather than checked. That is the whole point. Transparency is expensive precisely because it constrains.
The obvious counterargument is that I am grading an early iteration against a mature standard, and the counterargument has force. Proof of reserves, whatever its defects, did something the pre-2022 industry did not: it forced a public number into existence. A number, even a flawed one, is auditable in a way that a narrative is not. The first Merkle roots made window-dressing legible, because the same tool that hides the aggregate also timestamps the snapshot, and a timestamp is a handle for anyone willing to pull the thread. The pattern of collateral arriving and leaving around a snapshot is only visible because the snapshot exists. In that narrow sense, the ritual created its own audit trail. The bulls are also right that standardization is progress. A common format lets analysts compare issuers, and comparison is the beginning of accountability. Where the bulls are wrong is in the leap from this is better than nothing to this is proof. Better than nothing is a low bar, and the industry has a habit of clearing low bars and calling it victory. The tool is fine. The claim built on top of it is the problem. A reserve report that omits liabilities, ignores collateral quality, and tests no control is not an early version of solvency proof. It is a different product wearing its clothes. Trust is a variable; proof is a constant.
The next time a custodian publishes a Merkle root, do not ask whether the math checks out. It does. Ask three questions the math was never designed to answer: where are the liabilities, what happens to the collateral at the next block, and who holds the keys. If a report cannot answer all three, it is a snapshot, and snapshots expire. The industry does not need better cryptography. It needs issuers willing to be audited rather than photographed — and readers willing to notice the difference.
