Proof of Reserves (PoR) became the standard CEX transparency mechanism following the FTX collapse in November 2022. Three years in, the realized PoR practice across the major exchanges has matured into specific operational patterns — but with substantial variation in audit frequency, scope, and methodological rigor that user-facing exchange comparison content rarely surfaces. I have been tracking the major exchange PoR disclosures since the post-FTX framework emerged and the realized Q1 2026 data shows specific disclosure differentials that affect the operational meaning of "proof of reserves" across different platforms.
The structural fact that anchors the analysis: PoR is not a uniform standard. Different exchanges produce PoR disclosures with materially different frequency, methodological coverage, and audit independence. A casual reader comparing "Exchange A produces PoR" against "Exchange B produces PoR" without examining the specific framework details will substantially overestimate the comparability of the disclosures.
The Q1 2026 Major CEX PoR Disclosure Patterns
The realized PoR disclosure pattern across the major exchanges as of Q1 2026:
Binance:
- Audit frequency: monthly snapshot disclosure
- Most recent audit: March 1, 2026
- Methodology: Merkle-tree user verification + asset-side wallet verification
- Independent auditor involvement: limited (Mazars disengaged in late-2022, no equivalent independent auditor since)
- Coverage: spot-asset reserves only (does not cover derivatives margin or institutional balance sheet)
- Disclosed reserve assets: BTC, ETH, USDT, USDC, BNB, primary altcoin holdings
Coinbase:
- Audit frequency: quarterly attestation
- Most recent attestation: end-Q1 2026 (March 31)
- Methodology: SOC 1 Type II audit framework, plus quarterly proof-of-reserves attestation
- Independent auditor involvement: Big-4 firm (Coinbase has remained with PCAOB-registered audit framework)
- Coverage: full balance sheet attestation
- Higher methodological rigor relative to most CEX PoR frameworks
Kraken:
- Audit frequency: bi-annual full PoR audit
- Most recent: late-2025
- Methodology: Armanino-equivalent independent audit
- Independent auditor: independent audit firm
- Coverage: comprehensive reserve assets
Bybit:
- Audit frequency: monthly snapshot disclosure
- Most recent audit: March 12, 2026
- Methodology: Merkle-tree verification
- Independent auditor: limited involvement
- Coverage: spot reserves
OKX:
- Audit frequency: monthly snapshot disclosure
- Most recent: March 15, 2026
- Methodology: Merkle-tree verification
- Independent auditor involvement: limited
- Coverage: spot reserves
Bitget:
- Audit frequency: monthly snapshot disclosure
- Most recent: March 5, 2026
- Methodology: Merkle-tree verification
- Independent auditor involvement: limited
- Coverage: spot reserves
MEXC:
- Audit frequency: monthly snapshot disclosure
- Most recent: March 8, 2026
- Methodology: Merkle-tree verification
- Independent auditor involvement: limited
- Coverage: spot reserves
The realized pattern shows substantial methodological variation. Coinbase and Kraken operate with materially more independent-audit involvement than the typical CEX PoR framework. The other major exchanges (Binance, Bybit, OKX, Bitget, MEXC) operate with similar methodological frameworks based primarily on Merkle-tree user verification with limited independent-audit involvement.
What Merkle-Tree PoR Actually Verifies
Merkle-tree PoR verification is the standard mechanism most CEX PoR frameworks use. The mechanism produces (1) a snapshot of user balances aggregated into a Merkle tree, with (2) asset-side wallet ownership verification through specific signed messages. Users can verify their individual balance was included in the snapshot through their account's specific verification path.
The structural verification limits:
First, Merkle-tree snapshot is point-in-time only. The verification covers a specific snapshot moment, typically the end of the disclosure period. Activity between snapshots is not captured. An exchange could theoretically operate with insufficient reserves between snapshots and produce clean snapshots at the disclosure moments.
Second, asset-side wallet verification covers only disclosed wallets. The exchange verifies that specific wallet addresses contain the disclosed asset balances. The verification does not capture undisclosed wallets, off-balance-sheet liabilities, or related-party positioning that does not appear in the disclosed wallet set.
Third, liability-side verification depends on user participation. The Merkle-tree user verification requires users to actively check their inclusion. If users do not check, exchanges can theoretically produce trees that exclude specific user balances. The realized user-verification rate across major exchanges runs approximately 5-15% of total user accounts — meaning approximately 85-95% of user balances rely on no user-side verification.
For the disclosure to be operationally meaningful, the user-side verification rate would need to approach 100%. The realized verification rate suggests that Merkle-tree PoR functions more as a "signal of intent to be transparent" than as a comprehensive verification mechanism.
What Independent-Audit PoR Adds
Coinbase's quarterly attestation framework and Kraken's bi-annual independent audit framework add specific methodological components that Merkle-tree PoR does not include.
Liability-side comprehensive verification. Independent-audit frameworks include verification of all customer liabilities, not just balances that users actively verify. The audit firm reviews exchange records to confirm the aggregate disclosed customer liability matches actual exchange records.
Off-balance-sheet identification. Independent audits include review of related-party positions, lending arrangements, derivative-margin positioning, and other structural positions that may not appear in straightforward asset-versus-liability disclosure.
Continuous obligations vs point-in-time snapshots. Bigger-rigor audit frameworks include continuous obligations that cover the period between snapshots, not just the snapshot moments. This addresses the structural gap that point-in-time Merkle-tree PoR leaves.
The realized differential between independent-audit-PoR and Merkle-tree-PoR is structurally meaningful. For users who weight reserve attestation heavily in exchange selection, the audit frequency and methodology details matter substantially.
What This Tells Me About Exchange Selection On Trust Grounds
Three structural reads for traders evaluating exchange selection partly on PoR grounds.
First, PoR is not a binary "has it" or "doesn't have it" property. The substantial methodological variation across exchange PoR frameworks means "Exchange has PoR" is insufficient information for comparison. Traders weighting reserve attestation should examine specific audit frequency, independent-auditor involvement, and methodological coverage.
Second, Coinbase and Kraken operate with structurally more rigorous PoR frameworks than other major exchanges. For users specifically prioritizing reserve attestation rigor, these two venues provide structural advantages. Other major exchanges (Binance, Bybit, OKX, Bitget, MEXC) operate with comparable methodological frameworks at lower rigor relative to the audit-firm-mediated alternatives.
Third, PoR is one input to exchange trust, not the sole input. Beyond PoR, exchange trust depends on operational track record (history of customer-loss events), regulatory positioning (jurisdictional anchoring), and structural transparency around related operations. PoR-focused comparison without integrating these other dimensions produces incomplete trust evaluation.
My Current Exchange Trust Read
For my own positioning across exchange selection, I run trust evaluation as a multi-factor assessment that includes PoR rigor as one input. My realized current allocation:
- Coinbase: meaningful USD-denominated and regulated-anchored exposure (highest trust ranking on the multi-factor framework)
- Kraken: secondary USD-denominated exposure
- Bybit: moderate exposure for non-US-anchored operations (clean operational track record, VARA license, but Merkle-tree PoR rather than independent audit)
- Binance: minimal exposure (operational scale advantage offset by structural concerns about regulatory positioning)
- Other exchanges: minimal exposure (use case-specific only)
The allocation reflects my read that exchange trust differentials are real and meaningful, with implications for how much capital I am willing to maintain on each venue. For traders who weight reserve attestation differently, the appropriate allocation will differ.
Honest Limits
I did not access exchange-specific audit reports or internal documentation — the PoR framework descriptions referenced here come from publicly disclosed exchange announcements and audit framework documentation through April 2026. The audit frequency and methodology summaries reflect publicly disclosed information and may not capture every operational detail. The user-verification rate estimates reflect approximate behavioral inference from publicly disclosed verification engagement data. The trust-evaluation framework reflects my own multi-factor approach and may differ from other appropriate trust frameworks. The personal allocation observations reflect my current positioning and are not investment advice or recommended allocation. Exchange PoR practices may evolve through 2026 if regulatory frameworks or competitive dynamics drive convergence on more rigorous standards.