What this comes down to
- A proof demonstrates that verifiable assets matched committed liabilities at one instant. It does not demonstrate solvency.
- Three gaps recur: it is point-in-time, it covers only disclosed liabilities, and control of an address is not unencumbered ownership.
- Zero-knowledge constructions let a custodian prove the total without publishing individual balances, removing the main commercial objection.
- A proof and an assurance engagement answer different questions. Presenting one as the other is the failure mode to watch for.
After the collapse of FTX in November 2022, Proof of Reserves moved from a cryptographic curiosity to a commercial expectation. Custodians published proofs, auditors were asked to opine on them, and a good deal of confusion followed about what had actually been demonstrated. The confusion persists, and it is expensive: institutions have accepted proofs as assurance, and have declined perfectly sound proofs because they were presented as something they were not.
The underlying mechanism is elegant and worth understanding precisely, because its limits follow directly from its construction.
How a proof is constructed
A Proof of Reserves has two halves that are frequently conflated. The liability half commits the custodian to a total it owes customers. The asset half demonstrates control of holdings on the ledger.
- 01
Commit to liabilities
Every customer balance becomes a leaf in a Merkle tree. Combining leaves pairwise up to a single root produces a fingerprint of the complete liability set that cannot be changed after publication without changing the root.
- 02
Publish the root
The root is published. Each customer can then be given the path from their own leaf to the root, letting them verify their balance was included in the committed total without seeing anyone else’s.
- 03
Demonstrate asset control
The custodian identifies the on-chain addresses holding reserves and proves control, ideally by signing a nominated message with each key rather than by asserting ownership.
- 04
Compare
Anyone can read the on-chain balances independently and compare them with the committed liability total. The arithmetic is public and verifiable.
The elegance is that no trust in the custodian is required for the comparison itself. Every input is either published or independently readable from the ledger.
The three gaps
Each limitation follows from the construction rather than from poor execution, which is why no amount of engineering rigour closes them.
| Gap | Why it exists | What closes it |
|---|---|---|
| Point in time | A proof describes one block height. Assets can be borrowed before and returned after. | Frequent or randomly timed proofs, plus assurance work covering the period between them. |
| Undisclosed liabilities | Only balances the custodian chose to include are in the tree. Off-chain debt, loans and obligations are invisible. | An assurance engagement over the complete liability position, including off-chain records. |
| Encumbrance | Controlling a key does not establish that the assets are unpledged, unlent or beneficially owned. | Legal review of custody arrangements and lending activity, plus representations that can be tested. |
The privacy objection, and how zero-knowledge answers it
The commercial resistance to publishing proofs is rarely about the arithmetic. It is that a Merkle scheme with published totals reveals the size of the customer book, and grouping information can reveal a great deal about individual holdings. For a custodian serving institutions, that is a genuine confidentiality problem rather than an excuse.
Zero-knowledge constructions resolve it. A custodian can prove that the sum of all customer balances equals a stated total, that no balance is negative, and that a given customer’s balance is included, without revealing any individual figure or the shape of the distribution. This removes the last defensible reason not to publish, and it is where serious work in this area has concentrated.
Proof and audit are different instruments
A proof is a procedure the custodian runs and publishes. An audit or assurance engagement is an independent practitioner’s opinion, performed under a professional standard, with defined responsibilities and a scope statement. They answer different questions and neither substitutes for the other.
- A proof gives verifiable arithmetic about a moment, with no reliance on the custodian’s honesty for the comparison.
- An assurance engagement gives a qualified opinion about a period, and can address the liabilities and encumbrances a proof cannot see.
- A proof accompanied by an assurance engagement covering off-chain liabilities is the strongest publicly available position.
- A proof described as an audit is a presentation problem that should be challenged before anything else in the document is assessed.
Reviewing a published proof
If an institution is relying on a counterparty’s published proof, these are the questions that separate a meaningful exercise from a marketing artefact.
- Was asset control demonstrated by signing a nominated message, or merely asserted by listing addresses?
- Is the liability commitment a verifiable Merkle root or a zero-knowledge proof, or just a published number?
- Can an individual customer verify their own inclusion, and is the verification tool available and usable?
- How was the timing chosen, and could the custodian have anticipated it?
- Does an independent practitioner appear, and under which standard, with what scope?
- Are off-chain liabilities addressed anywhere in the document, or silently out of scope?
- Is there any statement about lending, rehypothecation or pledged collateral?
- How frequently is this repeated, and is the history published?
The proof was correct in every respect. The question nobody had asked was what else the entity owed to people who were not in the tree.
If you are building one
Build for repetition rather than for a single announcement. The value of a proof compounds with frequency and with an unbroken published history, and the operational burden of producing one is almost entirely in the first exercise. Automate the liability extraction, script the signing ceremony, publish a verification tool a non-technical customer can actually use, and choose timing you do not control.
Then engage an assurance provider for the part the cryptography cannot reach. The combination is what earns institutional trust; either half alone invites the question the other half answers.
Related questions
Does a Proof of Reserves prove that a custodian is solvent?
No. It proves that verifiable on-chain assets matched the liabilities the custodian committed to at one instant. Solvency is a statement about all assets and all liabilities over time, including off-chain obligations that a proof cannot see. A proof is strong evidence about a narrow question, not a solvency opinion.
How often should a custodian publish a proof?
More often than a counterparty can predict. Monthly with unannounced timing is materially stronger than quarterly on a published calendar, because predictable timing is what makes the borrowed-assets gap exploitable. Publishing the full history matters as much as the frequency.
Can Proof of Reserves work for assets that are not on a public ledger?
The liability half works anywhere, because a Merkle commitment is independent of the asset type. The asset half does not, since it relies on public verifiability of balances. For off-chain assets you are back to conventional assurance, which is precisely why hybrid custodians need both instruments.