Following years of occasional high-profile collapses among crypto platforms, Proof of Reserves (PoR) has become one of the most closely watched components of an exchange's asset security and riskFollowing years of occasional high-profile collapses among crypto platforms, Proof of Reserves (PoR) has become one of the most closely watched components of an exchange's asset security and risk

学ぶ/ブロックチェーン百科事典/セキュリティ知識/How to Assess Whether an Exchange's Funds Are Safe: Understanding the PoR Mechanism and Verification Methods

How to Assess Whether an Exchange's Funds Are Safe: Understanding the PoR Mechanism and Verification Methods

著者：MEXC

初級

Sep 21, 2026MEXC

11 分

Following years of occasional high-profile collapses among crypto platforms, Proof of Reserves (PoR) has become one of the most closely watched components of an exchange's asset security and risk management systems. At its core, PoR addresses a single, crucial question: Does the exchange truly hold enough assets to cover all user funds?

When users deposit their crypto with an exchange, three concerns often come to mind:

If a bank run were to occur, could the platform immediately fulfill all withdrawal requests?
Are assets like USDT and BTC actually held 1:1 in reserve, or have they been diverted for other uses?
When an exchange claims to have sufficient reserves, how can users verify that claim?

These questions are exactly what the PoR mechanism is designed to answer. PoR offers an open, verifiable framework that allows users and third parties to periodically confirm whether an exchange's total assets are sufficient to cover all customer balances. In essence, PoR transforms trust from a matter of verbal assurance into one grounded in verifiable data.

1. What Is PoR and Why It Represents Reliability?

The logic behind Proof of Reserves (PoR) is quite straightforward:

An exchange periodically publishes the on-chain wallet addresses it controls, revealing the actual amount of assets it holds. It then calculates its reserve rate using a simple formula: Wallet Assets / Total User Assets = Reserve Rate. If the result shows a reserve rate of ≥ 100%, it indicates that the platform's disclosed assets are sufficient to cover total user balances at the time of the snapshot, even under large-scale withdrawal scenarios. The strength of this mechanism lies in its transparency and verifiability. PoR is not a self-declared claim; rather, it allows any user or independent auditing institution to verify the authenticity of reserves directly through on-chain data.

From an industry standpoint, PoR has gradually become a baseline security standard among leading exchanges. Most platforms now release bi-monthly or quarterly snapshots along with third-party audits to disclose their reserve ratios and asset compositions. However, implementation details vary: some exchanges focus more on frequency and openness, while others emphasize the quality of reserve composition or the transparency of independent audits.

Among them, MEXC was one of the early adopters to systematize PoR. Its approach illustrates the full logic of PoR in practice; publicly revealing reserve ratios, disclosing asset structures, and maintaining long-term stability through continuous snapshots. The following are its most recently published snapshot data, serving as a useful reference for understanding how PoR operates in real-world scenarios.

1.1 Total Wallet Assets vs. Total User Assets: Does the Reserve Rate Truly Exceed 100%?

According to MEXC's latest audit data from November, the exchange's total on-chain wallet assets significantly exceed its total user assets. The reserve rates for major tokens are as follows:

USDT: 130% (approximately $2.25 billion in reserves vs. $1.72 billion in total user assets)
USDC: 124% (approximately $113 million in reserves vs. $92 million in total user assets)
BTC: 135% (4,785 BTC in reserves vs. 3,555 BTC held by users)
ETH: 105% (57,334 ETH in reserves vs. 54,437 ETH held by users)

These figures show that MEXC's reserves for all major assets are well above 100%, indicating that the platform maintains a surplus buffer to ensure full coverage of user assets even under extreme market conditions.

1.2 Composition of Reserve Assets: Are High-Quality Assets Sufficient to Support Withdrawal Capacity?

The reliability of PoR depends not only on the amount of reserves but also on the quality of those reserves. If an exchange's reserves consist mainly of its own platform token or highly volatile assets, even a seemingly adequate reserve rate could lose credibility during extreme market conditions, as the redemption capacity would be significantly weakened.

As mentioned above, MEXC's reserve structure is centered around stablecoins (USDT and USDC) and major assets (BTC and ETH). These core assets provide high liquidity and quick convertibility, ensuring the platform can maintain stable redemptions even during sharp market fluctuations.

This structure also reflects a broader industry trend. An increasing number of exchanges are reducing their reliance on platform tokens and illiquid assets, and moving toward reserve models dominated by highly liquid instruments. Such a trend is generally associated with improved resilience and greater long-term sustainability.

1.3 PoR Trends: Continuous Tracking to Verify Long-Term Stability

The true value of Proof of Reserves lies in its long-term verifiability. A single high reserve rate is not enough to prove financial strength; only consistent, stable reserves over time can demonstrate real reliability. MEXC's reserve data has been publicly available since January 11, 2023, with PoR security reports released every two months. To further enhance transparency and provide more up-to-date asset verification, MEXC plans to upgrade to monthly PoR disclosures in the near future. Data from the most recent six reporting periods are as follows:

From this data, we can see that USDT and USDC reserve rates have consistently stayed within the 105%-118% range, BTC has maintained a high level of 120%-130%, and ETH has remained steady between 103%-110%. None of these assets have fallen below the 100% benchmark, demonstrating MEXC's strong and disciplined liquidity management.

Overall, the PoR mechanism allows an exchange's financial health to be displayed in a quantifiable and traceable manner. However, for most users, seeing the reserve rate numbers alone is not enough, they want to know how to verify the authenticity of this data.

To address this, leading exchanges typically introduce a Merkle Tree verification mechanism, which enables transparent and cryptographically provable audits of user balances and reserves. In the next section, we will break down how this mechanism works and how exchanges integrate it into their PoR systems to achieve truly verifiable, trustworthy, and transparent asset disclosures.

2. How Users Can Verify the Authenticity of PoR

"Don't Trust, Verify" has become a core principle across the crypto industry. With Merkle Tree verification, users no longer need to rely on third-party assurances. Instead, they can independently and efficiently verify their own deposited assets using cryptographic hash functions, all while keeping their personal information completely private.

2.1 What Is a Merkle Tree and Why Is It So Important?

A Merkle Tree is a highly efficient cryptographic data structure. It functions like an inverted tree, where millions of user asset records on an exchange form the leaves at the bottom. These records are recursively hashed layer by layer until they are condensed into a single 32-byte root hash known as the Merkle Root.

This root hash represents the complete set of all user balance data. Even the smallest change to any individual account will alter the Merkle Root entirely. The platform's proof of reserves will show the root hash so users can verify whether their balances are correctly included in the total liabilities and cross-check them against the exchange's reserves to assess full coverage.

Imagine an exchange with eight users (A through H). You are User A. Once the Merkle Tree is constructed, the platform provides you with a small data package containing:

1) Your leaf node (hA), generated from your account ID and balance according to a defined format.

2) The hashes of your neighbor nodes, which serve as clues to reconstruct the path up to the root.

For example, your leaf node hA pairs with hB to form hAB, so the exchange provides hB (without revealing who B is or their balance).
Then hAB pairs with hCD to form hABCD, so you receive hCD, and so on until you reach the final root hash, the Markle root, hABCDEFGH.

If the Merkle Root you calculate matches the root hash published by the exchange, it verifies that your assets are correctly included in the platform's total liabilities, which can then be assessed against the platform's published reserves. If it doesn't match, it may indicate an omission, a data inconsistency, or a discrepancy in the underlying Merkle Tree construction.

This method has several major advantages:

Efficient and privacy-preserving: You only need to download a very small proof file and can complete the verification in minutes without exposing your assets or anyone else's.
Tamper-proof: Because of the mathematical properties of hash functions, any modification, even by a single cent, will completely change the root hash.
Trustless verification: You don't need to take the exchange's word for it. With just a computer and open-source code, you can verify it yourself. This embodies the core crypto principle: "Don't Trust, Verify."

2.2 How to Use the Merkle Tree to Verify Your Assets on MEXC?

Below is a step-by-step guide on how to verify that your assets have been fully included in the reserves using MEXC's Merkle Tree verification process.

Step 1: Visit the GitHub repository

Go to the official repository. This repository contains the complete source code and documentation, allowing users to audit and reproduce the Merkle Tree construction process independently.

Step 2: Download the source code

On the repository page, click the "Code" button and select "Download ZIP." This will download the entire project package, including the core verification logic.

Note: To run the verification process, you'll need to have JDK 1.8 or higher and Maven 3.6.3 or a compatible version installed. These are standard components in the Java ecosystem and ensure compatibility and security when building the project.

Step 3: Build the verification tool with Maven

Open your terminal (Command Prompt on Windows or Terminal on macOS/Linux), navigate to the directory where you downloaded the project, and run the following command to build it:

# Enter the project directory
cd mexc-merkle-proof-of-reserves-main
# Use Maven to clean and build the project
mvn clean package

Step 4: Check the build output

After the build is complete, go to the project's root directory.

# View project root directory files
ls
# Output: README.md    pom.xml    target

Step 5: Prepare your personal proof file

Copy the personal Merkle Proof file provided by MEXC (usually named myProof.json) into the target directory.

# Example copy command (adjust according to your file path)  
cp ../myProof.json target/
# Or if the file is in another location
cp /path/to/your/myProof.json target/

Step 6: Switch to the tool directory

Navigate to the target directory.

# Enter the target directory
cd target

Step 7: Confirm files are ready

List the contents of the directory to ensure that both the .jar file and the proof file are present.

# View files in target directory
ls

Step 8: Run the verification program

Execute the .jar file to verify your proof.

# Execute the verification command
java -jar mexc-proof-of-reserves.jar myProof.json

The program will use the user's proof data to calculate the Merkle Root and compare it with the root hash already published by the platform.

Step 9: Check the verification output

validate result is : true

If the output shows validate result is : true, it means your balance has been correctly included in the Merkle Tree, and the platform's total liabilities are complete and accurate. Conversely, if the result is false, it may indicate data tampering or omission.

In addition to the Merkle Tree verification method described above, most exchanges also provide a simplified on-platform verification tool, allowing users to complete personal proof of reserve verification in just a few steps. MEXC users can refer to "How to Verify User Assets on MEXC" for detailed instructions on the web verification process.

3. How to Cross-Verify and Why Third-Party Audits Are Essential

To more thoroughly verify a Proof of Reserves (PoR) report, users can perform multi-source cross-verification. This involves using third-party tools to compare and analyze on-chain data. For example:

DeFiLlama CEX Transparency can be used to view the on-chain asset holdings of major exchanges.
CryptoQuant and similar platforms allow users to track reserve movements and detect unusual fluctuations, helping to identify potential liquidity risks early.

However, users should note that third-party tools may experience delays in data collection, so it’s best to reference multiple data sources for a balanced assessment.

At the same time, on-chain wallet data alone can only confirm how many assets an exchange holds, not whether all user liabilities are fully recorded. An exchange might exclude part of its users' balances or temporarily borrow assets before taking a snapshot to inflate reserves. These issues cannot be detected purely through on-chain data, which highlights the critical role of independent third-party audits.

More exchanges are now adopting a triangular verification model that combines platform PoR reports, on-chain wallet transparency, and third-party audits. This approach transforms transparency from a static snapshot into an ongoing, verifiable audit system, eliminating blind spots in user self-verification.

Audit firms directly publish reports that review both the completeness of user liability records and the accuracy of on-chain asset holdings, ensuring that the exchange has enough reserves to cover all user withdrawals. Importantly, these audits are not one-time events but continuously updated, allowing users to monitor reserve health over time. Audit firms also disclose key verification data, including the global Merkle Root and exchange wallet addresses, enabling technically skilled users to independently verify the audit's authenticity.

Currently, MEXC has partnered with the globally recognized blockchain auditing firm Hacken to further enhance PoR transparency. Hacken, which also provides audit services for Bybit, OKX, and other leading exchanges, is known for its credibility in the industry. Using established auditing standards, Hacken conducts comprehensive reviews of MEXC's user asset records and actual reserves to ensure full coverage of withdrawal demands. Moreover, Hacken releases independent monthly audit reports, ensuring neutrality and transparency. Users can access these third-party reports to verify MEXC's reserve status with confidence.

Conclusion

In the crypto industry, transparency is not optional, it is essential for survival. The collapse of exchanges such as FTX has made it clear that asset security should never rely on blind trust for a platform, but rather on verifiable mathematical proofs and independent audits.

A robust security framework combines three pillars: a Proof of Reserves (PoR) system, publicly verifiable on-chain wallet data, and third-party independent audits. Together, these elements shift users from passive reliance on a platform's promises to active verification of their own asset safety.

Questions like "Can I withdraw my funds during a bank run?" and "Has my crypto been misused?" no longer need to remain hidden behind a black box. Instead, they can be answered openly through data, cryptographic verification, and transparent oversight by every user.

市場の機会

価格()

----

USD

() ライブ価格チャート

トレンドニュース

Coldcard Mk3の警告、3800万ドル相当のBitcoin掃討後に発生、原因は未確認

ビットコインハードウェアウォレットメーカーのCoinkiteは、4.0.1以降のすべてのMk3ファームウェアバージョンを含むColdcardデバイスに影響を与えるシード生成の問題についてユーザーに警告しました。この警告は、セキュリティ研究者が約3,800万ドル相当の594.48 BTCの組織的な移転を調査している中で出されました。しかし、Coldcardの問題がこれらの送金を引き起こしたことを確認

2026-07-31

Bitget、日本市場撤退へ 12月末に未決済ポジション強制決済

Bitgetが2026年8月3日に日本居住者向けサービス終了を発表。12月31日までに未決済ポジションを決済しないと強制決済されるため、資産保有者は期限までの対応が必要です。

2026-08-04

Mastercardが最大18億ドルでBVNKを買収完了—ステーブルコインがグローバル決済の中核に参入

2026/8/3、Mastercardは3月に取引を発表した後、ステーブルコインインフラプロバイダーのBVNKの買収を完了しました。

2026-08-04

中央化取引所の活動が弱まる中、DEX対CEXの現物取引量比率が24%に到達

The Blockの現在のデータシリーズによると、2026年7月、分散型取引所（DEX）のスポット取引量と中央集権型取引所（CEX）のスポット取引量の比率は24.14%に達した。この数値は、DEXが統合スポット市場の24.14%を支配していたことを意味するものではなく、データセットに含まれるCEXの取引量に対してDEXの取引量が24.14%に相当していたことを意味する。一方、DEXのスポット取引量

2026-08-04

MEXC制限国：禁止および制限地域の完全リスト

MEXCは、利用規約に明記された13の管轄区域からのユーザーを受け入れていません。対象は米国、カナダ、英国、シンガポール、香港、中国本土、マレーシア、カザフスタン、北朝鮮、キューバ、イラン、スーダン、ロシアの支配下にあるウクライナの地域です。さらに、EUまたは米国による包括的な制裁の対象国や、金融活動作業部会（FATF）が「行動要請対象の高リスク国・地域」に指定した国も対象外です。また、MEXC

著者：MEXC

2026-04-20

SMSフィッシングの見分け方

SMSフィッシングとは、SMS（ショートメッセージサービス）を悪用して、ユーザーの機密情報（ウォレットの秘密鍵やログイン認証情報など）を盗んだり、暗号資産を詐取したりする詐欺行為です。フィッシング攻撃者は通常、取引所やウォレットサービスプロバイダー、政府機関など、信頼性の高い組織を装い、被害者に個人情報を開示させたり、不正な取引を行わせたりします。1. SMSフィッシングの代表的な手口1.1 取引

著者：Priya Sharma

2026-04-15

ハニーポットトークンを見抜くための安全ガイド

暗号資産市場では、常に新しいプロジェクトや暗号資産が登場しています。これは高いリターンが期待できる一方で、投資家にとっては重大なリスクも潜んでいます。「ハニーポットトークン」という単語は、「購入はできるが売却ができない」暗号資産、または「極端に流動性が低く出金に問題がある」暗号資産を指す言葉です。この単語は、最初は魅力的に見えても、最終的にユーザーが資金を出金できなくなるようなトークンを説明する際

著者：MEXC

2026-04-15

フィッシング攻撃とは？

暗号資産取引市場では、フィッシング攻撃が一般的な詐欺の手口となっています。攻撃者は、正規の暗号資産取引所やカスタマーサービス担当者を装い、偽のサービスを提供してユーザーを騙し、ログイン情報、秘密鍵、または財務情報などの機密情報を提供するように仕向けます。1. フィッシング攻撃の種類偽のウェブサイト：正規の取引所やウォレットに酷似したウェブサイトを作成し、そこにユーザーを誘導して情報を入力させます。

著者：Priya Sharma

2026-04-15