What Is Proof of Reserves (PoR)?

Proof of reserves shows that a custodian controlled certain assets at a given point in time and attempts to match them against customer balances or liabilities. A complete PoR has to answer at least three questions: assets, liabilities, and individual inclusion.

The Three Components of PoR

Proof of assets verifies which on-chain addresses and assets the platform controls. A common method is for the platform to sign with the private keys of those addresses, or to prove control in a verifiable transaction.

Proof of liabilities aggregates customer balances at the snapshot time. A Merkle tree can compress a large number of account records into a single root hash, letting a user prove with their own path that their balance is included without revealing other users' details.

The coverage relationship can be written as:

Reserve coverage ratio = verified reserve assets ÷ customer liabilities in the same scope

The numerator and denominator must use the same asset scope, valuation basis, and time. Merging all assets into a single USD figure can hide a shortfall in one individual coin.

What Does User Self-Verification Prove?

A successfully verified Merkle path shows that a given balance was included in that liabilities tree. It does not prove that no other accounts were left out, nor that the full set of liabilities the platform published is true and complete.

Zero-knowledge proofs can verify constraints such as totals and non-negative balances without exposing account details, but a proof only guarantees the statement its circuit expresses. The input scope, the data source, and off-platform liabilities still need other evidence.

Why PoR Is Not the Same as a Financial Audit

PoR is usually a procedure for specific assets at a specific point in time. It does not necessarily examine fiat accounts, borrowings, related-party transactions, customers' legal rights, whether assets were temporarily borrowed, or how funds were used after the snapshot.

A PCAOB investor alert states plainly that a PoR report is not an audit of financial statements and does not provide an equivalent level of assurance about future reserve adequacy, internal controls, or governance. When a third party is involved, it also matters whether it performed an audit, an attestation, or agreed-upon procedures.

How to Read a PoR

Record in order the reporting entity, snapshot time, assets, address list, liability scope, treatment of negative balances, user self-verification, names of third parties, scope of procedures, and report history. Check whether older reports can still be downloaded and whether changes in wallet addresses are explained.

Hotcoin currently discloses on-chain reserve information through public articles and its CoinMarketCap reserve page. When reading it, check the data date, address scope, and how liabilities are verified in the same way; total assets alone do not tell you about overall solvency.

PoR should be read together with the corporate entity, custody, governance, and exit records. For the wider framework, see Exchange Security and Trust Evaluation.

FAQ

Does a reserve coverage ratio above 100% guarantee withdrawals at any time?

No. You also have to consider asset liquidity, networks, banking settlement, the scope of liabilities, and operational and legal restrictions.

Will a Merkle tree expose my account balance?

The design goal is usually to let users verify inclusion without revealing details, but privacy depends on the leaf construction, the salt values, and the published data. Check the specific method used.

If a platform publishes all its wallet addresses, is third-party verification unnecessary?

Publishing addresses helps you inspect the assets, but it cannot independently prove customer liabilities, internal controls, or off-chain obligations.

Is a monthly PoR better than an annual audit?

Frequency and scope solve different problems. Frequent snapshots provide timeliness, while a full audit examines a broader area. The two cannot simply replace each other.