You are reading an excerpt from our free but shortened abridged report! While still packed with incredible research and data, for just $20/month you can upgrade to our FULL library of 50+ reports (including this one) and complete industry-leading analysis on the top crypto assets.
Becoming a Premium member means enjoying all the perks of a Basic membership PLUS:
- Full-length CORE Reports: More technical, in-depth research, actionable insights, and potential market alpha for serious crypto users
- Early access to future CORE ratings: Being early is sometimes just as important as being right!
- Premium Member CORE+ Reports: Coverage on the top issues pertaining to crypto users like bridge security, layer two solutions, DeFi plays, and more
- CORE report Audio playback: Don’t want to read? No problem! Listen on the go.
CEXs Using PoR
According to analysis by Nic Carter, at least 11 significant cryptocurrency exchanges (significant defined as those holding $500+ million in client assets) have conducted at least one Proof of Reserves attestation since November 2022. The total amount of assets covered by these recent PoRs was $33 billion. On average, each of these PoRs covered 73% of the total assets held by the exchange.
Five of these exchanges are conducting PoRs on a monthly basis or more frequently, while two are producing attestations on a daily or bi-weekly basis. More information on these figures can be found in a recent article.
Since Q4 2022, several major cryptocurrency exchanges, including Kraken, BitMEX, OKX, and Binance have all released Proofs of Reserve, which in the aggregate covered $33 billion worth of assets, representing 4% of the total crypto market cap. While these attestations vary in quality, it's still a positive trend towards greater transparency in the industry. However, it should be noted that many custodial cryptoassets held by credible institutions, such as Coinbase, Fidelity Digital Assets, and Gemini are not included in these attestations.
BitMEX and Deribit are the only exchanges that undertake PoRs with high frequency, as they don't rely on auditors to oversee their process. Kraken, on the other hand, has a slower cadence due to their usage of an auditor for oversight. For auditor-overseen PoRs, it's unlikely that the frequency will be faster than a monthly policy.
Only BitMEX and Deribit allow third parties to verify liabilities for themselves. While most exchanges allow their clients to individually verify whether their liabilities are included in the set, they mostly don't publish the full liability set. As a third party, it's preferable to have the ability to undertake verification for oneself.
BitMEX
BitMEX has adopted a highly transparent approach for its Proofs of Reserve, opting to not rely on an auditor, and instead choosing a model that allows for open-source code and replication of the procedure. In terms of assets, BitMEX lists all of the bitcoin balances held by the exchange and the execution scripts for these unspent transaction outputs (UTXOs) that prove they're spendable by the BitMEX multisig.
On the liabilities side, they publish the Merkle tree of user balances in full, which is different from the standard approach where users are only exposed to their leaf in the Merkle tree and path to the stem. This allows anyone to vet the liability set in full without issues of excluded or negative balances.
To protect privacy, BitMEX randomly splits user balances into two so that specific balances can't be tracked over time. Impressively, BitMEX now publishes PoR attestations twice a week, a more frequent cadence than most other exchanges. While some critics have bemoaned the lack of accounting firms with expertise in facilitating the PoR process, top-20 audit firm Armanino has been undertaking these engagements for years and it's not the only one.
Binance
Binance, one of the largest crypto exchanges, has updated its PoR system to include 11 new tokens. Binance’s PoR system now reflects the reserves held for a total of 24 assets with total reserves exceeding $63 billion as of March 1, 2023. Binance claims to have all user funds collateralized with at least a 1:1 ratio in addition to more reserves. The update was in line with Ethereum Co-Founder Vitalik Buterin’s suggestion on making centralized exchanges more safe and trustless. Binance also made its PoR system code open-source.
On the other hand, Binance's PoR is incomplete and scores poorly, as it only covers Bitcoin, which represents just 16.5% of client assets. While individual users can verify their inclusion in the liability set, the entire liability list isn't published, making it difficult for a third party to verify the procedure. Audit firm Mazars supervised the attestation with "Agreed Upon Procedures" and then deleted their AUP.
Security firm Mysten Labs found a number of issues in the Binance PoR, including four possible ways Binance could have understated liabilities. Binance has mentioned plans to involve third-party auditors in subsequent attestations and expand the set of assets covered. However, significant improvements are necessary before complete assurance can be given. Despite some criticism around Binance, the situations are different from that of FTX, and Binance could alleviate concerns with a more complete PoR.
Coinfloor
Digital asset platforms use different methods to conduct their PoR. Coinfloor, for example, publishes a monthly transparency report that includes a bitcoin transaction that sends all funds in the current attestation from one address to another, proving ownership. They also publish an obfuscated list of customer liabilities along with corresponding accounts that can be identified using a secret authentication token and timestamp. Customers can verify their balance by computing the SHA1 digest of the message from their dashboard and finding the resulting output in the publicly-published liabilities list. Additionally, Coinfloor includes the SHA256 hash of the report inside the bitcoin transaction.
Kraken
Kraken has engaged with Armanino LLP to conduct their attestation, which provides a high level of confidence to clients that they're being transparent about their liabilities and not hiding any negative or undercounted balances. Additionally, Kraken has covered a variety of assets, including BTC, ETH, USDT, USDC, XRP, ADA, and DOT, which represent the majority of their platform funds. They have even covered staked funds for ETH, ADA, and DOT. Currently, Kraken is conducting PoRs every six months, although there's hope that this frequency will increase over time. Kraken is realistic about the limitations of PoRs and does not claim it to be a cure-all for exchange issues.
PoR Regulation
Currently, regulation of digital asset platforms in the U.S. is fragmented and primarily regulated on a state-by-state basis as money transmitters. This approach may not adequately address the needs of custodial institutions that hold billions of dollars in client assets. Implementing PoR legislation, along with requirements for segregating client assets from operating capital or maintaining them in a separate trust insulated from bankruptcy, could help improve the situation.
Many exchanges have already adopted PoR measures voluntarily and PoR legislation would formalize this existing practice. PoR offers a level of assurance that often surpasses traditional audits in a reserve context. If all onshore exchanges adopted PoR, it would exert pressure on offshore exchanges to follow suit. Additionally, regulatory mandates for PoR domestically would stimulate the development of more advanced technical tools and CPA firms to oversee attestations, making it easier for offshore exchanges to participate in PoR.
Despite its potential benefits, PoR is still widely misunderstood and criticized in the crypto space and among policymakers. Recently, Senators Warren and Wyden referred to PoRs as "sham audits," and Bloomberg Tax called PoRs "misleading reserve estimates." The departure of PoR pioneers Armanino and Mazars from the crypto industry also fueled conspiracy theories about the validity of the PoR procedures they supervised.
Nevertheless, as the demand for greater transparency and security in the crypto space grows, PoR is likely to become an increasingly important tool for safeguarding user funds on digital asset exchanges. PoR legislation and policy could lead to a more consistent approach to custodial oversight, enhancing the overall credibility of exchanges and boosting user trust in the crypto industry.
