What Is Proof of Reserves and Why Doesn't It Prove Your Exchange's Wallets Are Clean?

Proof of reserves confirms an exchange holds the crypto it claims to hold, but it says nothing about whether those wallets received stolen, sanctioned, or laundered funds.

Passing a proof-of-reserves attestation doesn't mean an exchange's wallets are clean. It means the exchange held the coins it claimed, at the exact moment someone checked. Reserves audits verify balances. They don't check where those balances came from, whether a wallet passed through a mixer first, or whether OFAC sanctioned the last owner. Most explainers stop at the Merkle-tree math. None of them mention that a reserves report and AML screening are answering two completely different questions.

What Does a Proof-of-Reserves Attestation Actually Verify?

A proof-of-reserves report answers one question: does the exchange hold at least as much crypto as it owes its customers? Auditors build a Merkle tree from every customer balance, publish the root hash, and let each user confirm their own balance sits inside it without exposing anyone else's holdings. Then they add up the exchange's on-chain wallets and compare the total against what customers are owed. Say the wallets hold 100,000 ETH and customers are owed 95,000 ETH. The exchange passes. That's the whole test. Nobody checks whether any of that ETH sat in a wallet that received funds from a hacked bridge, a mixer, or a sanctioned address six months earlier. The audit asks whether the money is there. It never asks where the money came from.

The Snapshot Problem: Balances Change the Day After the Audit

A reserves report is a photograph, not a live feed. Most exchanges publish one on a monthly or quarterly cycle, and the wallets it covers can look completely different a week later. Coins move in. Coins move out. New deposits arrive from addresses nobody screened, and none of that shows up until the next snapshot, if there's even a next one. Kraken publishes reserves data closer to real time than most. Plenty of platforms still treat proof of reserves as a once-a-quarter press release instead of a running control. A snapshot only tells you the truth on the day it was taken.

Can a Wallet Holding Stolen or Sanctioned Crypto Still Pass a Reserves Check?

Yes, every time. A hot wallet holding coins traced to a hack, a mixer, or an OFAC-sanctioned address contributes exactly as much to the reserves total as clean crypto does. The Merkle tree math can't tell the two apart. Nothing in a standard proof-of-reserves attestation screens the underlying addresses for sanctions exposure, mixer contact, or a stolen-funds history, because that was never the question being asked. An exchange can publish a flawless reserves report the same week one of its wallets receives a deposit tied to Lazarus Group or a fresh Tornado Cash withdrawal. The audit won't flag either one. It was never built to.

The Zondacrypto Collapse Shows the Gap in Practice

In April 2026, on-chain investigators at Recoveris published findings on Zondacrypto, then Poland's largest crypto exchange. Its Bitcoin hot wallet had fallen from 55.7 BTC in August 2024 to just 0.18 BTC, a 99.7 percent drop, with no reserves attestation catching it along the way. Between December 18, 2025, and April 2, 2026, more than $21 million moved out across 511 transactions and 30 different cryptocurrencies, much of it landing on Kraken. Customer losses topped EUR 82.4 million. Zondacrypto's founder has been missing since March 2022. A proof-of-reserves program, published on any real cadence, would have caught a 99.7 percent balance collapse in days instead of years. What it still can't do, even running perfectly, is tell you whether the wallets receiving those funds were clean to begin with.

So Does Proof of Reserves Replace Wallet Screening?

No. The two checks answer different questions, and an exchange needs both to mean anything. Proof of reserves answers whether the exchange can cover what it owes. Wallet screening answers whether specific addresses are tied to sanctions, mixers, or stolen funds. Etherscan will show a wallet's raw balance and transaction history for free, the same way a reserves report shows a balance total, but neither tool tells you what that balance is exposed to. Screen the wallet with Plastron instead, and get a sanctions, mixer, and stolen-funds exposure score across Ethereum and six other chains in seconds. Plastron's own screening corpus carries 3,901 labeled addresses across scam, fraud, hack, and mixer categories, and the OFAC Specially Designated Nationals list currently names 780 crypto-linked addresses directly. None of that shows up in a Merkle tree. A reserves-audited exchange with an unscreened hot wallet is still one deposit away from a problem its auditors were never asked to look for.

FAQ

Does proof of reserves check for sanctions or AML compliance?

No. It verifies that customer balances are backed one-to-one by on-chain holdings. It has no sanctions list, no mixer detection, and no transaction-history review built in.

How often do exchanges publish proof-of-reserves reports?

Most publish monthly or quarterly. A handful, including Kraken, update closer to real time. Between reports, wallet balances and their contents can change completely with nobody watching.

Can a Merkle-tree proof-of-reserves audit be faked?

The math itself is hard to fake once published, but an exchange can still borrow assets for the snapshot date and move them out right after, which is why cadence and third-party verification matter as much as the tree.

Does proof of reserves show an exchange's liabilities, not just its assets?

Rarely on its own. A reserves report proves assets exist; it says nothing about debts, loans, or obligations the exchange owes elsewhere, which is why shortfalls can hide behind a clean-looking balance sheet.