--- title: "Proof of Reserves Explained: What Crypto Exchanges Can Prove" description: "Proof of reserves can improve exchange transparency, but it does not prove full solvency. How reserves, liabilities, liquidity and audits differ." url: https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves --- Digital Assets & Finance · 31 October 2026· 18 min read # Beyond the Binance Hack: What Proof of Reserves Can and Cannot Prove A practical guide to exchange transparency, liabilities, solvency, and the questions every user should ask By [Dr. Jovian Tan](https://joviantan.com/about) ·Published 31 October 2026 ![Illustration titled Beyond the Binance Hack: What Proof of Reserves Can and Cannot Prove. A magnifying glass shows a reserves panel with a tick and a liabilities panel with question marks, in front of an open vault of coins beneath a Binance sign, with checklists headed Proof of Reserves and Proof of Liabilities](https://joviantan.com/_img/images/insights/beyond-binance-hack-proof-of-reserves-1920.webp) Illustration. The figure and the questions shown in the image are illustrative: they are not data about, or findings on, Binance. **In this article** ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#introduction-the-question-a-reserve-figure-cannot-answer-alone)Introduction: The Question a Reserve Figure Cannot Answer Alone A crypto exchange can publish wallet addresses, show billions of dollars in assets, and provide a cryptographic proof that your account balance is included in a published dataset. Those are meaningful transparency measures. But they do not automatically answer the most important question a customer has: **will the exchange be able to return what it owes me when I need it?** That question is harder than it sounds. An exchange may control substantial on-chain assets while its published liabilities are incomplete, some obligations sit outside the calculation, assets are pledged or borrowed, or operational problems prevent timely withdrawals. A snapshot can be accurate and still be too narrow to establish the full financial condition of a business. This is why proof of reserves (PoR) should be understood as an important piece of evidence, not a certificate of safety. The question is timely. In [my analysis of Binance's October 2026 security incident](https://joviantan.com/insights/binance-security-crisis-customer-trust), one open issue was how customers can assess the exchange's position afterwards. Binance has said it [will publish an updated Proof of Reserves once remediation is complete](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7). When that report arrives, readers will need to know what it can and cannot show. The lesson extends beyond Binance or any single platform, and nothing here suggests that any limitation described proves misconduct by any exchange. Every custodial exchange asks customers to trust a company to hold assets on their behalf. Better disclosure can make that trust more testable. The challenge is to understand precisely what the evidence establishes, what it leaves unanswered, and how the pieces fit together. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#1-what-does-proof-of-reserves-actually-mean)1\. What Does Proof of Reserves Actually Mean? In its simplest form, proof of reserves attempts to show that a custodian controls a defined set of assets at a particular point in time. In crypto, some of that evidence can be independently checked against public blockchains. But a customer is not owed a reserve wallet. A customer is owed a balance, under the exchange's contractual and legal arrangements. To assess whether the exchange can meet those obligations, two sides must be considered: - **Assets:** What assets does the exchange control, and can it demonstrate control over them? - **Liabilities:** What does the exchange owe its customers and other creditors, and has the full amount been captured? A reserve calculation is only as useful as both sides of this equation. Imagine an exchange controls 10,000 BTC in wallets it can demonstrate it controls. If the relevant customer BTC liabilities are 9,500 BTC, that is encouraging evidence for that asset and that snapshot, assuming the liability figure is complete and the assets are not encumbered. If the published liability figure captures only 8,000 BTC of the 9,500 BTC actually owed, the same wallet evidence produces a more flattering ratio than the facts support. The arithmetic is easy. Establishing that the inputs are complete, correctly scoped and independently supported is the difficult part. In my analysis, a proof-of-reserves report is best read as a **boundary statement**. It is not only about the assets it displays. It is also about what it leaves out: entities, wallets, tokens, liabilities, legal claims, pledged assets, borrowing, fiat balances and activities outside the stated scope. The first question should be "What is inside the boundary?" The second should be "What remains outside it?" ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#2-reserves-liabilities-solvency-and-liquidity-are-different-things)2\. Reserves, Liabilities, Solvency and Liquidity Are Different Things These concepts are often compressed into one reassuring headline. They should be separated. Concept The question it helps answer What it does not establish by itself Proof of assets / reserves Did the entity control the stated assets at the relevant time? Whether all liabilities are known, or whether assets are unencumbered and available Proof of liabilities Were the covered customer balances or obligations included and added up correctly? Whether every relevant liability across the whole business has been disclosed Proof of solvency Do relevant assets exceed relevant liabilities under a defined accounting and legal scope? Whether every asset can be converted to cash or delivered immediately Liquidity Can the entity meet obligations when due? Whether it is solvent over the longer term Security and operational resilience Can the entity protect keys, systems and processes against failures and attacks? Whether the balance sheet is solvent A company can be solvent but illiquid: it may own valuable assets but be unable to turn them into the required form quickly enough. It can also appear liquid for a short period while being insolvent overall. And an entity with ample reserves can still suffer a security breach if its keys, access controls or operational processes fail. **The practical takeaway: do not let one metric stand in for five different risk questions.** ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#3-how-merkle-trees-help-users-verify-their-balances)3\. How Merkle Trees Help Users Verify Their Balances A Merkle tree is a data structure that combines many records into a single cryptographic commitment, commonly represented by a Merkle root. A user can receive a proof showing that a particular record is included in the committed dataset without needing to see every other customer's record. This helps address a genuine tension: customers need to verify inclusion, while exchanges should not publish everyone's balances and account details. Vitalik Buterin's [2022 technical essay on proof of solvency](https://vitalik.eth.link/general/2022/11/19/proof_of_solvency.html) explains the related Merkle-sum tree, in which each node also carries the sum of the balances beneath it. It is a technical discussion, not a regulatory or audit standard. However, a Merkle proof answers a narrow question: **is this record included in the committed dataset?** It does not, on its own, prove that the dataset contains every customer, that the balances were extracted correctly from the exchange's systems, or that the exchange controls enough assets to cover the dataset. A cryptographic commitment can faithfully preserve an incomplete spreadsheet. Cryptography protects the integrity of the committed data. It does not automatically guarantee the completeness or truth of the original input. That distinction is central to evaluating PoR. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#4-what-zero-knowledge-proofs-add-and-what-they-do-not)4\. What Zero-Knowledge Proofs Add, and What They Do Not Zero-knowledge proofs, including zk-SNARKs, let a system demonstrate that certain computations or conditions hold without exposing the underlying private data. In a PoR design, they can help show that user balance records contribute to an aggregate and satisfy defined constraints, while preserving customer privacy. Binance says [its PoR system](https://www.binance.com/en/proof-of-reserves) combines Merkle trees with zk-SNARKs. By [its own description](https://www.binance.com/en/blog/tech/6654580406550811626), the proofs check that each user's balances are included in the published totals, that no user has a negative total net balance, and that the Merkle root changes validly when a user's record is updated. These are Binance's descriptions of its own system, not independent conclusions. As a design, it goes further than simply publishing a wallet list or an opaque total. But the key phrase is **"defined constraints."** A proof can demonstrate that a computation was performed correctly on the inputs supplied. It cannot independently discover a liability that was never entered into the system, prove that every legal entity and product was included, or determine whether a wallet's assets have been pledged to someone else, unless the system explicitly models and proves those facts. Zero-knowledge proofs strengthen verifiability and privacy. They do not make accounting scope, governance or evidence collection disappear. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#5-the-denominator-problem-what-does-the-exchange-owe)5\. The Denominator Problem: What Does the Exchange Owe? The headline reserve ratio is often expressed as reserves divided by customer liabilities. The assets in the numerator attract attention because some can be checked on a public blockchain. In my analysis, the hidden variable is not the ratio. It is the completeness of the denominator. That makes the denominator a governance and data-integrity problem, not merely a mathematical one. Questions a reader should ask include: - Does the calculation cover all relevant customer accounts, products and supported assets? - Are spot balances, margin accounts, loans, collateral, staking products, earn products and other obligations treated consistently? - Are negative balances and cross-collateral arrangements handled transparently? - How were the exchange's internal customer records reconciled to the published liability total? - Were dormant accounts, pending withdrawals, accrued interest and other obligations included where appropriate? - Is the scope limited to one brand, platform, legal entity, jurisdiction or asset? - Can the reviewer explain how completeness was tested, rather than merely confirming that a supplied dataset adds up? These are not accusations against any particular exchange. They are the questions needed to interpret any financial claim. A system can calculate a ratio to several decimal places and still be weak if its liability population is incomplete. Precision is not the same as completeness. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#6-the-snapshot-problem-solvency-is-a-condition-not-a-badge)6\. The Snapshot Problem: Solvency Is a Condition, Not a Badge A proof usually relates to a specific date and time, not to every moment before and after it. Binance's [first PoR announcement in November 2022](https://www.binance.com/en/support/announcement/detail/0c7a786cbe8c4e108f3301385ab61e39), for example, specified a snapshot taken at 23:59 UTC on 22 November 2022 and the block heights used. That is useful because it tells readers when the evidence applies. But a snapshot is not a live guarantee. A snapshot can be accurate at 23:59 UTC and say little about the position a day later. Assets can move, be borrowed, be pledged or become inaccessible. Market prices can change. New liabilities can arise. The [PCAOB's Office of the Investor Advocate](https://pcaobus.org/news-events/news-releases/news-release-detail/investor-advisory-exercise-caution-with-third-party-verification-proof-of-reserve-reports) makes the same point about third-party PoR reports: because they concern one point in time, they give no assurance about whether assets were later used, lent or otherwise became unavailable. This leads to a better way of reading disclosure. Check not only the ratio, but also the snapshot date, the reporting frequency, the covered assets, the included liabilities, and whether meaningful changes between reporting dates are disclosed. The time gap is itself a risk variable. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#7-control-is-not-the-same-as-availability)7\. Control Is Not the Same as Availability A wallet balance visible on a public blockchain is evidence that the address held those assets at the observed block. To attribute the assets to an exchange, the process also needs credible evidence that the exchange controls the relevant keys or otherwise has the right to use the assets. Even demonstrated control leaves more questions: - Are the assets pledged as collateral or subject to a third-party claim? - Were they borrowed temporarily for the snapshot? - Are they held for customers, for the company's own account, or for another entity? - Can the exchange transfer them when needed, or are they locked in staking, lending, bridge or smart-contract arrangements? - Are the assets liquid enough to meet withdrawals without material slippage? - Does the report include fiat and off-chain assets, and if so, how were those independently confirmed? These issues are not all visible from blockchain balances alone. Fiat balances [cannot be verified cryptographically](https://vitalik.eth.link/general/2022/11/19/proof_of_solvency.html) and generally depend on bank evidence and accounting procedures. Legal ownership and encumbrances may require contracts, confirmations and legal-entity analysis. Asset quality matters too. In my analysis, a 1:1 ratio is meaningful only when assets are measured in the right units and are usable to meet the matching obligations. One BTC owed to a customer should not casually be treated as covered by a volatile exchange-affiliated token, or by an asset that cannot be liquidated promptly. Matching each asset to the same asset liability is more informative than a single US-dollar headline. The distinction is between **control at a moment** and **unrestricted availability to meet a specific obligation**. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#8-why-the-binance-por-story-matters)8\. Why the Binance PoR Story Matters After the collapse of FTX in November 2022, exchanges faced intense pressure to show that customer assets were backed. The [CFTC's summary of its later judgment](https://www.cftc.gov/PressRoom/PressReleases/8938-24) against FTX and Alameda, for US$12.7 billion, records that customer funds were commingled and misappropriated. Those findings concern FTX. They say nothing about any other exchange, but they explain why the question became urgent. Binance [announced its PoR system on 25 November 2022](https://www.binance.com/en/support/announcement/detail/0c7a786cbe8c4e108f3301385ab61e39). It reported a 101% Bitcoin reserve ratio for that snapshot, covering BTC only, and said further assets, third-party review and zk-SNARKs were planned. In [February 2023](https://www.binance.com/en/blog/tech/6654580406550811626) it described adding zk-SNARK checks. These are separate points in the evolution of the disclosure and should not be merged into one timeless claim. The 101% figure is historical and specific to its scope. It is not a current reserve ratio. The Mazars episode is also instructive. In December 2022, [CoinDesk reported](https://www.coindesk.com/business/2022/12/07/binances-bitcoin-reserves-are-overcollateralized-says-audit) on an assessment by the firm covering Binance's Bitcoin reserves and liabilities at a single snapshot, and later updated its article to clarify that the assessment was not an audit. Days later, [Reuters reported](https://finance.yahoo.com/news/1-auditing-firm-mazars-pauses-141558281.html) that Mazars had paused PoR work for crypto clients, citing concerns about how such reports are understood by the public, and had deleted the webpage containing the report. That engagement is not current, and none of this shows that its figures were wrong. It shows how easily a narrow engagement can be read as something broader. Regulators have said so directly: - The [US SEC's investor bulletin of July 2023](https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-bulletins/investors) states that PoR reports are not equivalent to financial statement audits, and that such a report does not tell investors the whole story about an entity's liabilities. - The [PCAOB's Office of the Investor Advocate](https://pcaobus.org/news-events/news-releases/news-release-detail/investor-advisory-exercise-caution-with-third-party-verification-proof-of-reserve-reports) warned in March 2023 that these reports are inherently limited and give no assurance that reserves will be adequate in the future or that customer assets will be protected. The advisory states that it represents the views of that office's staff, not necessarily those of the Board. These warnings should not be distorted into a conclusion that any particular exchange is insolvent. They describe limitations in a type of evidence. The correct conclusion is narrower: a PoR report must be read according to its scope, procedures and assurance level. Equally, PoR is not useless. Publicly checkable wallet evidence and user-level inclusion proofs are more useful than an unsupported assurance. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#9-independence-is-a-design-property-not-a-logo)9\. Independence Is a Design Property, Not a Logo In my analysis, a third-party name on a report is not enough. Readers need to know who selected the procedures, what evidence the reviewer could access, whether liabilities and controls were tested, what level of assurance was given, whether the full report is public, and what professional standards govern the work. This matters because of how these engagements can be structured. According to the [PCAOB staff advisory](https://pcaobus.org/news-events/news-releases/news-release-detail/investor-advisory-exercise-caution-with-third-party-verification-proof-of-reserve-reports), in an "agreed-upon procedures" engagement it is the crypto entity's management, not the report's provider, that determines the procedures, and the report offers factual findings rather than an opinion on the adequacy of reserves. The [SEC bulletin](https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-bulletins/investors) adds that such services may be provided by firms that are not subject to the independence requirements that apply to audits. The same logic applies to cryptography. A proof can be mathematically sound while the inputs supplied to it remain incomplete. The useful question is not "Who verified this?" alone, but "What exactly could they see, test and refuse to sign?" ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#10-withdrawals-are-signals-not-solvency-tests)10\. Withdrawals Are Signals, Not Solvency Tests It is tempting to treat withdrawals as the real test: if the money comes out, everything must be fine. In my analysis, that overreads the evidence in both directions. A successful withdrawal shows that a particular withdrawal was processed under particular conditions. It does not establish that every customer could withdraw at once, that all liabilities are covered, or that there are no hidden claims. Conversely, a delayed or suspended withdrawal can result from compliance checks, network congestion or operational controls. In October 2026, for example, Binance said it had [suspended withdrawals while security checks were completed](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7). A pause is not, by itself, proof of insolvency. Readers should avoid building conclusions on single anecdotes, whether reassuring or alarming. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#11-what-a-stronger-proof-of-solvency-framework-would-look-like)11\. What a Stronger Proof-of-Solvency Framework Would Look Like In my analysis, the answer is not "blockchain or auditors". It is a layered evidence model. On-chain evidence can help prove wallet balances and transaction history. Cryptographic methods can help prove inclusion and aggregation. Bank confirmations, custody records, legal-entity mapping, accounting reconciliations, control testing and independent financial-statement audits address different blind spots. ### [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#a-asset-verification)A. Asset verification - Publish the reporting date, block heights, supported assets and wallet scope. - Demonstrate wallet control using an appropriate method, while protecting private keys. - Explain how cold storage, omnibus wallets, custodians, bridges, staking and smart-contract positions are treated. - Identify material encumbrances and distinguish customer assets from corporate assets. - Explain how fiat and off-chain assets are confirmed. ### [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#b-liability-completeness)B. Liability completeness - Explain how customer balances were extracted and reconciled. - Publish enough methodology for an independent reviewer to test completeness without exposing private customer data. - Define which products, entities and obligations are included and excluded. - Use cryptographic commitments and proofs where they meaningfully improve privacy and reproducibility. - Explain how negative balances, margin, lending, collateral and pending transactions are handled. ### [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#c-independent-assurance-and-governance)C. Independent assurance and governance - Name the reviewer and publish the full report, not just a marketing summary. - State whether the engagement is an agreed-upon-procedures engagement, an attestation or a financial-statement audit. - Describe the standards followed, the procedures performed, the evidence available to the reviewer and the limitations. - Explain the reviewer's independence and any relevant conflicts. - Provide financial statements and control information appropriate to the entity's size, legal structure and regulatory obligations. ### [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#d-timeliness-and-ongoing-monitoring)D. Timeliness and ongoing monitoring - Publish a clear cadence and preserve historical snapshots. - Explain how significant changes are monitored between snapshots. - Report material incidents, asset restrictions and changes in scope transparently. - Consider mechanisms that shorten the period in which users must rely on stale information. - Do not imply that frequent snapshots eliminate all risks. ### [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#e-customer-asset-protections)E. Customer-asset protections - Disclose the legal and operational treatment of customer assets. - Explain segregation, rehypothecation policy, custody arrangements, withdrawal controls and recovery procedures. - Clarify what customers can legally claim if the platform fails. - Maintain security controls, incident response and independent testing separately from PoR. No single item guarantees safety. Together, however, they make a platform's claims more testable and make the remaining uncertainties more visible. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#12-a-practical-checklist-for-users)12\. A Practical Checklist for Users Before treating a PoR badge as meaningful reassurance, ask: 1. **When was the snapshot taken?** Is it recent enough to be useful? 2. **Which assets are covered?** Are the assets I hold included? 3. **Which liabilities are covered?** Does the report explain how completeness was tested? 4. **Is wallet control demonstrated?** Or are addresses simply labelled as belonging to the exchange? 5. **Are assets encumbered?** Does the report discuss pledges, borrowing or restrictions? 6. **Can I verify my own inclusion?** Is the method documented and usable? 7. **Who reviewed the work?** What procedures and professional standards were used? 8. **Is it a full financial-statement audit?** If not, what assurance does it actually provide? 9. **What is outside the scope?** Fiat, subsidiaries, lending, staking, derivatives or other obligations may be treated differently. 10. **What happens if withdrawals surge?** Is there evidence about liquidity, not just asset totals? 11. **How are customer assets legally protected?** What do the terms, custody arrangements and applicable rules say? 12. **What other evidence supports the claim?** Look for audited financial information, regulatory disclosures, security practices and a credible incident history. No checklist can remove custody risk. It can stop a user from confusing a narrow technical proof with a complete assessment of a business. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#13-a-better-test-of-transparency-what-could-falsify-the-claim)13\. A Better Test of Transparency: What Could Falsify the Claim? A useful test for any transparency system is not how impressive its dashboard looks, but how readily an independent person could challenge its claims. Can a user verify inclusion? Can a researcher inspect the reporting date and wallet evidence? Can a reviewer explain how liabilities were reconciled? Can the public identify the excluded entities and products? Can the report be compared with a prior snapshot? Are failures and changes explained rather than hidden behind a new headline number? This is my working definition of meaningful transparency: **disclosure should make important claims more falsifiable, not merely more persuasive.** It also points to where the industry should go next. PoR is a minimum disclosure layer, not a substitute for trust. It can reduce information asymmetry, but it cannot replace sound governance, segregation of customer assets, restrictions on rehypothecation, strong key management, clear legal claims, credible recovery procedures or regulatory supervision. A reserve ratio should never be presented as a universal safety score. The goal should not be to replace human accountability with cryptography. It should be to use cryptography where it provides strong, reproducible evidence, while keeping accounting, legal, governance, custody and regulatory controls for the questions cryptography cannot answer. A mathematical proof can verify a rule. It cannot decide whether the right rule was chosen, whether the correct data was supplied, or whether the business will behave responsibly when conditions deteriorate. ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#conclusion-treat-por-as-evidence-not-a-verdict)Conclusion: Treat PoR as Evidence, Not a Verdict Proof of reserves is a valuable step toward a more transparent crypto market. It can make selected asset holdings more visible, let customers check whether their balances appear in a published dataset, and raise the cost of making unsupported claims. But it is not, by itself, proof of complete solvency, immediate liquidity, sound governance, secure custody or guaranteed withdrawals. Its value depends on the scope of the assets and liabilities, the evidence of control, the treatment of encumbrances, the independence and competence of the reviewer, and how recently the evidence was collected. The most informed question is not simply, "Does this exchange have proof of reserves?" It is: **"What exactly has been proved, by whom, for which assets and liabilities, at what time, and what material risks remain outside the proof?"** That is a higher standard than trusting a headline ratio. It is also a more useful starting point for protecting customer assets and rebuilding trust. * * * ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#sources-and-further-reading)Sources and Further Reading 1. **Binance, "Binance Releases Proof of Reserves System", 25 November 2022.** The initial announcement: snapshot time, block heights, the initial BTC reserve ratio and planned additions. [Read the announcement](https://www.binance.com/en/support/announcement/detail/0c7a786cbe8c4e108f3301385ab61e39). 2. **Binance, Proof of Reserves page.** Binance's own explanation of its Merkle-tree and zk-SNARK approach and how users verify their records. It describes Binance's system in Binance's words; it is not an independent evaluation. [Read the page](https://www.binance.com/en/proof-of-reserves). 3. **Binance, "How zk-SNARKs Improve Binance's Proof of Reserves System", 10 February 2023.** The stated constraints of the zk-SNARK design. [Read the post](https://www.binance.com/en/blog/tech/6654580406550811626). 4. **Binance, Security Incident Update, last updated 30 October 2026.** The statements on suspended withdrawals and on an updated Proof of Reserves. [Read the update](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7). 5. **US SEC, Investor.gov, "Investors in the Crypto Asset Markets Should Exercise Caution With Alternatives to Financial Statement Audits", 27 July 2023.** Why PoR reports are not equivalent to financial statement audits. [Read the bulletin](https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-bulletins/investors). 6. **PCAOB Office of the Investor Advocate, "Exercise Caution With Third-Party Verification/Proof of Reserve Reports", 8 March 2023.** Limitations of PoR reports, in the views of that office's staff and not necessarily those of the Board. [Read the advisory](https://pcaobus.org/news-events/news-releases/news-release-detail/investor-advisory-exercise-caution-with-third-party-verification-proof-of-reserve-reports). 7. **Vitalik Buterin, "Having a safe CEX: proof of solvency and beyond", 19 November 2022.** A technical essay on proof of liabilities, Merkle-sum trees, zero-knowledge proofs, proof of assets and fiat. [Read the essay](https://vitalik.eth.link/general/2022/11/19/proof_of_solvency.html). 8. **CFTC, "CFTC Obtains $12.7 Billion Judgment Against FTX and Alameda", 8 August 2024.** Historical context on the FTX matter only. [Read the release](https://www.cftc.gov/PressRoom/PressReleases/8938-24). 9. **CoinDesk, "Binance's Bitcoin Reserves Are Overcollateralized, New Report Says", 7 December 2022, updated later.** Contemporary reporting on the Mazars assessment, a defined scope and snapshot rather than an audit. [Read the report](https://www.coindesk.com/business/2022/12/07/binances-bitcoin-reserves-are-overcollateralized-says-audit). 10. **Reuters, via Yahoo Finance, "Auditing firm Mazars pauses work for Binance, other crypto clients", 16 December 2022.** Historical context. [Read the report](https://finance.yahoo.com/news/1-auditing-firm-mazars-pauses-141558281.html). * * * ## [#](https://joviantan.com/insights/beyond-binance-hack-proof-of-reserves#editorial-note)Editorial note This article is for informational purposes only and does not constitute financial, legal, or investment advice. Statements attributed to Binance describe its own system and position. Passages marked as my analysis are the author's interpretation, not established consensus. Sources were last checked on 31 October 2026. Share this article [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fjoviantan.com%2Finsights%2Fbeyond-binance-hack-proof-of-reserves) [X](https://x.com/intent/post?text=Beyond%20the%20Binance%20Hack%3A%20What%20Proof%20of%20Reserves%20Can%20and%20Cannot%20Prove&url=https%3A%2F%2Fjoviantan.com%2Finsights%2Fbeyond-binance-hack-proof-of-reserves) About the author [Dr. Jovian Joris Tan Chern Chian](https://joviantan.com/about), professionally known as Dr. Jovian Tan, is a Kuala Lumpur-based technology entrepreneur and the founder and Chief Technology Officer of Bitara, working across blockchain, Web3 infrastructure, AI infrastructure and digital financial infrastructure. ## Related insights - ![Illustration of a dark trading desk at night: a laptop showing the Binance logo, a world map of red network connections, an alert panel reading Security incident, Investigation, Systems review and Funds SAFU, and a brass padlock beside a city skyline](https://joviantan.com/_img/images/insights/binance-security-crisis-customer-trust-1920.webp) Digital Assets & Finance · 30 October 2026· 14 min read ### [Beyond the Hack: Can Binance Turn a Security Crisis into a New Standard for Trust in Crypto?](https://joviantan.com/insights/binance-security-crisis-customer-trust) Binance's security incident is a test of whether customer protection, financial resilience and accountability can extend beyond public assurances, and a chance to set a new standard for how exchanges handle a crisis. By Dr. Jovian Tan [All insights](https://joviantan.com/insights)