What is Proof of Reserves?

Proof of Reserves (PoR) is a class of cryptographic and accounting attestations that verify a custodian held specific on-chain assets at a moment in time. Modern PoR typically combines a Merkle-tree of customer liabilities with an on-chain reserve attestation, allowing each customer to verify their individual balance was included in the audited total. The practice was popularized at Kraken in March 2014 and re-emerged as an industry standard after the November 2022 collapse of FTX.

Is Proof of Reserves enough for Bitcoin custody?

No. Proof of Reserves verifies that a custodian held assets at a moment in time, but it does not verify segregation, legal title, or who controls the keys. Every major custodial failure in Bitcoin's history, from Mt. Gox in 2011 through Bybit in 2025, occurred at a firm that had published a reserve attestation, used multi-signature wallets, or both. PoR is necessary but not sufficient.

What is the difference between Proof of Reserves and Proof of Ownership?

Proof of Reserves attests that a custodian controlled specific assets at a point in time. Proof of Ownership attests that assets are segregated on-chain, legally titled to the holder, continuously verifiable on any block explorer, and controlled by a distributed key quorum across independent institutions so that no single party can move them unilaterally. PoR is a disclosure overlay on an unchanged single-custodian architecture; Proof of Ownership is an architectural change.

Did Proof of Reserves prevent Bitcoin exchange hacks?

No. From Mt. Gox in 2011 through Bybit in 2025, every major custodial failure occurred at a firm that either published reserve attestations, used multi-signature wallets, or both. The recurring failure modes — commingled customer assets, unilateral control of key sets, undisclosed counterparty concentration, and the gap between snapshots — are structural and invisible to point-in-time attestations.

How was Bybit hacked if they had Proof of Reserves?

Bybit had monthly Hacken-audited PoR above 100%; published less than 24 hours before the February 21, 2025 hack. Lazarus Group had compromised a Safe{Wallet} developer machine weeks earlier and injected malicious JavaScript; signers approved what their UI showed as a routine transfer while the payload sent funds to an attacker address. The PoR was true when published and meaningless when signed — the architecture enabling the loss was invisible to any reserve attestation.

What is the safest way to custody Bitcoin through a third party?

The holder's bitcoin should be (1) held in a dedicated on-chain vault, never commingled with platform balances; (2) legally titled to the holder or a bankruptcy-remote entity; (3) verifiable in real-time on any block explorer; and (4) controlled by a distributed key quorum across independent regulated institutions, such that no single party can move the assets unilaterally. This is the Proof of Ownership standard. Onramp's Multi-Institution Custody is built around it.

The Proof of Reserves Illusion

Brian Cubellis | Chief Strategy Officer

May 29, 2026

Download the full report →

Key Takeaways

Proof of Reserves (PoR) is a class of cryptographic and accounting attestations designed to verify that a custodian controlled specific on-chain assets at a moment in time. It is a logical step in the right direction. It is not, on its own, a custody assurance regime.

PoR offers more transparency than most platforms offered before FTX, and the credible programs running today deserve recognition for what they have improved. But a snapshot is not safekeeping, and treating it as such creates a false sense of security that has not aged well in practice.

The historical record is consistent. Snapshots do not prevent losses. From Mt. Gox in 2011 through Bybit in 2025, every major custodial failure occurred at a firm that either published a reserve attestation, used some form of multi-signature wallets, or both. The architectures that produced the losses were invisible to the disclosures meant to detect them.

Whether you are an individual with a balance on an exchange, an advisor allocating client capital to a spot bitcoin ETF, a family office, or a corporate treasurer, the custody test is identical: are your coins held in a segregated, on-chain address, legally titled to you, with control distributed across independent institutions so that no single party can move them unilaterally?

The market should demand more. PoR is necessary but not sufficient. The next step is proof of ownership: segregated, client-titled, distributed across independent institutions. Onramp's Multi-Institution Custody is built around that standard. PoR documents the risk. MIC eliminates it.

Executive Summary

Proof of Reserves (PoR) was a meaningful response to the trust collapse that followed FTX in November 2022, and the strongest current programs (Kraken's CPA-attested Merkle trees, River's full-reserve cold-storage verification, Bitwise's daily ETF reconciliation, OKX's monthly attestations) represent real progress. PoR is a logical step. It is not, however, where the story ends, and it is increasingly being used as if it were. A platform with a polished PoR page, a green reserve ratio, and a recognizable auditor logo is treated by much of the market as evidence of safekeeping. In reality, it is just evidence that the platform controlled certain assets on a specific day.

What PoR does not establish is how private keys are secured, whether assets are commingled with the platform's balance sheet, whether the custodian has rehypothecated the collateral, what the terms of service do to your legal title in a bankruptcy, or what happens if a single key-holder is compromised. The question that matters is not whether the entity has the coins today. It is whether any single party can move or lose those coins tomorrow.

What's Inside

The full report covers five parts:

Part I | What Proof of Reserves Actually Is — The history of PoR from the 2011 Mt. Gox broadcast through the post-FTX explosion, a taxonomy of the five methodologies operating under the label, and an exact accounting of what PoR proves and what it cannot.
Part II | The Long Historical Record — A comprehensive case set of every major Bitcoin custodial failure from 2011 through 2025, the controls that were in place at each, and the structural failure modes that produced the losses despite those controls.
Part III | The Current Generation of Credible PoR Programs — An assessment of the strongest current implementations (Kraken, River, Bitwise, OKX) and why even the best of them cannot substitute for an architectural custody standard.
Part IV | Proof of Ownership: The New Standard — The four-pillar standard (segregation, legal title, deterministic verification, distributed control) that addresses each documented failure mode, with the technical specification for how Multi-Institution Custody implements it.
Part V | Anticipating the Objections — Direct responses to the most common arguments against the Proof of Ownership standard and the transition cost objections custodians raise.

Download the full report →

Key Takeaways

Executive Summary

What's Inside

The full report covers five parts:

Part I | What Proof of Reserves Actually Is — The history of PoR from the 2011 Mt. Gox broadcast through the post-FTX explosion, a taxonomy of the five methodologies operating under the label, and an exact accounting of what PoR proves and what it cannot.
Part II | The Long Historical Record — A comprehensive case set of every major Bitcoin custodial failure from 2011 through 2025, the controls that were in place at each, and the structural failure modes that produced the losses despite those controls.
Part III | The Current Generation of Credible PoR Programs — An assessment of the strongest current implementations (Kraken, River, Bitwise, OKX) and why even the best of them cannot substitute for an architectural custody standard.
Part IV | Proof of Ownership: The New Standard — The four-pillar standard (segregation, legal title, deterministic verification, distributed control) that addresses each documented failure mode, with the technical specification for how Multi-Institution Custody implements it.
Part V | Anticipating the Objections — Direct responses to the most common arguments against the Proof of Ownership standard and the transition cost objections custodians raise.

Download the full report →

The Proof of Reserves Illusion

Key Takeaways

Executive Summary

What's Inside

Related Reading

Get in touch with our team of experts

The Proof of Reserves Illusion

Key Takeaways

Executive Summary

What's Inside

Related Reading

Get in touch with our team of experts