Proof of reserves and crypto custody

The question underneath all of this

When you hold crypto on a platform, you usually do not hold the asset. You hold a claim against a company that holds the asset — or says it does. Proof of reserves and custody disclosures are attempts to give you evidence about that claim. Reading them properly is the difference between informed risk and blind trust.

What proof of reserves tries to show

A proof-of-reserves exercise attempts to demonstrate that a platform controls at least as much of an asset as its customers are owed. In its fuller form it has two halves:

• The assets side. Evidence that the platform controls specific on-chain balances, often by signing messages from the addresses or moving funds in a demonstrable way.
• The liabilities side. Evidence of what customers are collectively owed, frequently using a Merkle tree so an individual customer can verify their own balance was included without the platform publishing everyone's balances.

Both halves are needed. Assets alone prove nothing about solvency, because they say nothing about how much is owed.

What it does not prove

• It is a snapshot. An attestation describes a moment in time. Balances can change the next block.
• It rarely covers liabilities beyond customers. Loans, corporate debt, obligations to affiliates and off-chain commitments may sit outside the exercise entirely. A platform can pass a reserves check and still be insolvent.
• Control is not the same as unencumbered ownership. Assets shown may be borrowed, pledged as collateral, or shared with another entity.
• Attestation is not audit. An agreed-upon-procedures report or attestation has a narrower scope and a different standard than a full financial-statement audit, and the report itself normally says so.
• Exclusions matter. Many exercises cover selected assets, selected entities or selected customer groups. The scope paragraph is the most important part of the document.
• Verification depends on you. A Merkle proof only helps if customers actually check their inclusion, and if the tool to do so still works.

Custody models, and who holds the keys

• Platform custody (omnibus). Customer assets are pooled in shared wallets and your entitlement is tracked in the platform's internal ledger. Convenient, and entirely dependent on that ledger and the platform's solvency.
• Segregated custody. Assets are held in accounts or wallets identified as belonging to clients, sometimes at a separate custodian. Whether segregation actually protects you in an insolvency depends on the legal regime governing the entity.
• Third-party qualified custodian. A specialist firm holds the assets under its own regulatory permissions. This adds an independent party — and another set of terms to read.
• Self-custody. You hold the keys, in software or hardware, with a recovery phrase. Counterparty risk drops to near zero and personal operational risk rises sharply: lost phrases, damaged devices, signing mistakes and social engineering are unrecoverable.
• Multi-signature and MPC arrangements. Control is split across parties or devices so no single key is sufficient. Stronger against single points of failure, more complex to operate and to recover.

Read the terms, not the reassurance

The legally meaningful answers are in the user agreement and custody policy, not the landing page. Look specifically for: whether the platform states that title to the assets remains with you; whether it may lend, rehypothecate, stake or otherwise use your assets; what happens to your claim if the entity enters insolvency; whether a separate custodian is named; and which jurisdiction's law governs the relationship.

Also establish which entity you actually contract with. Groups often operate several entities across different countries, and the protections available to a customer depend on the specific entity named in your agreement — not on the group brand. The step-by-step method is in what to check before depositing.

Operational security if you self-custody

Self-custody removes platform failure from the equation and puts the entire burden on your own process. At minimum: record the recovery phrase offline and never type it into a website or share it with support, keep a tested backup in a separate physical location, verify receiving addresses on the device screen rather than in the browser, send a small test transaction first, and rehearse recovery before the amount involved becomes significant. Anyone contacting you to "validate", "migrate" or "unlock" a wallet is running a scam — the common scam patterns apply directly here.

A short evidence checklist

For the broader pattern of platform risk signals, see how to spot a risky platform and the safety hub. Readers working mainly in digital assets may want the crypto and forex path.

The limits of this guide

We describe how these mechanisms work; we do not certify any platform's reserves, custody arrangements or solvency, and we do not state which protections apply in your country, because that depends on the entity, the product and your residency. Crypto regulation differs widely and changes frequently.

Take regulated financial advice on whether holding digital assets suits your circumstances, legal advice on custody agreements or insolvency questions where meaningful sums are involved, and tax advice on how holdings, transfers and staking rewards are treated where you live.

The takeaway

Proof of reserves is a useful, narrow, dated piece of evidence — not a solvency guarantee and not a safety badge. Custody terms decide what you own if things go wrong. Read the entity, the scope and the agreement, keep only what you need on a platform, and treat any amount you would be unwilling to lose as a reason to learn self-custody properly rather than to trust harder.