Following years of occasional high-profile collapses among crypto platforms, Proof of Reserves (PoR) has become one of the most closely watched components of an exchange's asset security and riskFollowing years of occasional high-profile collapses among crypto platforms, Proof of Reserves (PoR) has become one of the most closely watched components of an exchange's asset security and risk
Learn/Cryptocurrency Knowledge/Security Knowledge/How to Asse...ion Methods

How to Assess Whether an Exchange's Funds Are Safe: Understanding the PoR Mechanism and Verification Methods

Beginner
Dec 3, 2025MEXC
0m
Safe Token
SAFE$0.1539-1.78%
PortugalNationalTeam
POR$0.5737-0.06%
Core DAO
CORE$0.1242+7.06%
Morpheus Labs
MIND$0.0000886-2.09%
Lorenzo Protocol
BANK$0.04658+2.71%

Following years of occasional high-profile collapses among crypto platforms, Proof of Reserves (PoR) has become one of the most closely watched components of an exchange's asset security and risk management systems. At its core, PoR addresses a single, crucial question: Does the exchange truly hold enough assets to cover all user funds?

When users deposit their crypto with an exchange, three concerns often come to mind:
  • If a bank run were to occur, could the platform immediately fulfill all withdrawal requests?
  • Are assets like USDT and BTC actually held 1:1 in reserve, or have they been diverted for other uses?
  • When an exchange claims to have sufficient reserves, how can users verify that claim?

These questions are exactly what the PoR mechanism is designed to answer. PoR offers an open, verifiable framework that allows users and third parties to periodically confirm whether an exchange's total assets are sufficient to cover all customer balances. In essence, PoR transforms trust from a matter of verbal assurance into one grounded in verifiable data.

1. What Is PoR and Why It Represents Reliability?


The logic behind Proof of Reserves (PoR) is quite straightforward:

An exchange periodically publishes the on-chain wallet addresses it controls, revealing the actual amount of assets it holds. It then calculates its reserve rate using a simple formula: Wallet Assets / Total User Assets = Reserve Rate. If the result shows a reserve rate of ≥ 100%, it indicates that the platform's disclosed assets are sufficient to cover total user balances at the time of the snapshot, even under large-scale withdrawal scenarios. The strength of this mechanism lies in its transparency and verifiability. PoR is not a self-declared claim; rather, it allows any user or independent auditing institution to verify the authenticity of reserves directly through on-chain data.

From an industry standpoint, PoR has gradually become a baseline security standard among leading exchanges. Most platforms now release bi-monthly or quarterly snapshots along with third-party audits to disclose their reserve ratios and asset compositions. However, implementation details vary: some exchanges focus more on frequency and openness, while others emphasize the quality of reserve composition or the transparency of independent audits.

Among them, MEXC was one of the early adopters to systematize PoR. Its approach illustrates the full logic of PoR in practice; publicly revealing reserve ratios, disclosing asset structures, and maintaining long-term stability through continuous snapshots. The following are its most recently published snapshot data, serving as a useful reference for understanding how PoR operates in real-world scenarios.

1.1 Total Wallet Assets vs. Total User Assets: Does the Reserve Rate Truly Exceed 100%?


According to MEXC's latest audit data from November, the exchange's total on-chain wallet assets significantly exceed its total user assets. The reserve rates for major tokens are as follows:
  • USDT: 130% (approximately $2.25 billion in reserves vs. $1.72 billion in total user assets)
  • USDC: 124% (approximately $113 million in reserves vs. $92 million in total user assets)
  • BTC: 135% (4,785 BTC in reserves vs. 3,555 BTC held by users)
  • ETH: 105% (57,334 ETH in reserves vs. 54,437 ETH held by users)

These figures show that MEXC's reserves for all major assets are well above 100%, indicating that the platform maintains a surplus buffer to ensure full coverage of user assets even under extreme market conditions.


1.2 Composition of Reserve Assets: Are High-Quality Assets Sufficient to Support Withdrawal Capacity?


The reliability of PoR depends not only on the amount of reserves but also on the quality of those reserves. If an exchange's reserves consist mainly of its own platform token or highly volatile assets, even a seemingly adequate reserve rate could lose credibility during extreme market conditions, as the redemption capacity would be significantly weakened.

As mentioned above, MEXC's reserve structure is centered around stablecoins (USDT and USDC) and major assets (BTC and ETH). These core assets provide high liquidity and quick convertibility, ensuring the platform can maintain stable redemptions even during sharp market fluctuations.

This structure also reflects a broader industry trend. An increasing number of exchanges are reducing their reliance on platform tokens and illiquid assets, and moving toward reserve models dominated by highly liquid instruments. Such a trend is generally associated with improved resilience and greater long-term sustainability.


The true value of Proof of Reserves lies in its long-term verifiability. A single high reserve rate is not enough to prove financial strength; only consistent, stable reserves over time can demonstrate real reliability. MEXC's reserve data has been publicly available since January 11, 2023, with PoR security reports released every two months. To further enhance transparency and provide more up-to-date asset verification, MEXC plans to upgrade to monthly PoR disclosures in the near future. Data from the most recent six reporting periods are as follows:


From this data, we can see that USDT and USDC reserve rates have consistently stayed within the 105%-118% range, BTC has maintained a high level of 120%-130%, and ETH has remained steady between 103%-110%. None of these assets have fallen below the 100% benchmark, demonstrating MEXC's strong and disciplined liquidity management.

Overall, the PoR mechanism allows an exchange's financial health to be displayed in a quantifiable and traceable manner. However, for most users, seeing the reserve rate numbers alone is not enough, they want to know how to verify the authenticity of this data.

To address this, leading exchanges typically introduce a Merkle Tree verification mechanism, which enables transparent and cryptographically provable audits of user balances and reserves. In the next section, we will break down how this mechanism works and how exchanges integrate it into their PoR systems to achieve truly verifiable, trustworthy, and transparent asset disclosures.

2. How Users Can Verify the Authenticity of PoR


"Don't Trust, Verify" has become a core principle across the crypto industry. With Merkle Tree verification, users no longer need to rely on third-party assurances. Instead, they can independently and efficiently verify their own deposited assets using cryptographic hash functions, all while keeping their personal information completely private.

2.1 What Is a Merkle Tree and Why Is It So Important?


A Merkle Tree is a highly efficient cryptographic data structure. It functions like an inverted tree, where millions of user asset records on an exchange form the leaves at the bottom. These records are recursively hashed layer by layer until they are condensed into a single 32-byte root hash known as the Merkle Root.

This root hash represents the complete set of all user balance data. Even the smallest change to any individual account will alter the Merkle Root entirely. The platform's proof of reserves will show the root hash so users can verify whether their balances are correctly included in the total liabilities and cross-check them against the exchange's reserves to assess full coverage.

Imagine an exchange with eight users (A through H). You are User A. Once the Merkle Tree is constructed, the platform provides you with a small data package containing:

1) Your leaf node (hA), generated from your account ID and balance according to a defined format.
2) The hashes of your neighbor nodes, which serve as clues to reconstruct the path up to the root.
  • For example, your leaf node hA pairs with hB to form hAB, so the exchange provides hB (without revealing who B is or their balance).
  • Then hAB pairs with hCD to form hABCD, so you receive hCD, and so on until you reach the final root hash, the Markle root, hABCDEFGH.

If the Merkle Root you calculate matches the root hash published by the exchange, it verifies that your assets are correctly included in the platform's total liabilities, which can then be assessed against the platform's published reserves. If it doesn't match, it may indicate an omission, a data inconsistency, or a discrepancy in the underlying Merkle Tree construction.

This method has several major advantages:
  • Efficient and privacy-preserving: You only need to download a very small proof file and can complete the verification in minutes without exposing your assets or anyone else's.
  • Tamper-proof: Because of the mathematical properties of hash functions, any modification, even by a single cent, will completely change the root hash.
  • Trustless verification: You don't need to take the exchange's word for it. With just a computer and open-source code, you can verify it yourself. This embodies the core crypto principle: "Don't Trust, Verify."

2.2 How to Use the Merkle Tree to Verify Your Assets on MEXC?


Below is a step-by-step guide on how to verify that your assets have been fully included in the reserves using MEXC's Merkle Tree verification process.

Step 1: Visit the GitHub repository
Go to the official repository. This repository contains the complete source code and documentation, allowing users to audit and reproduce the Merkle Tree construction process independently.

Step 2: Download the source code
On the repository page, click the "Code" button and select "Download ZIP." This will download the entire project package, including the core verification logic.

Note: To run the verification process, you'll need to have JDK 1.8 or higher and Maven 3.6.3 or a compatible version installed. These are standard components in the Java ecosystem and ensure compatibility and security when building the project.



Step 3: Build the verification tool with Maven
Open your terminal (Command Prompt on Windows or Terminal on macOS/Linux), navigate to the directory where you downloaded the project, and run the following command to build it:

# Enter the project directory cd mexc-merkle-proof-of-reserves-main # Use Maven to clean and build the project mvn clean package

Step 4: Check the build output
After the build is complete, go to the project's root directory.

# View project root directory files ls # Output: README.md pom.xml target

Step 5: Prepare your personal proof file
Copy the personal Merkle Proof file provided by MEXC (usually named myProof.json) into the target directory.

# Example copy command (adjust according to your file path) cp ../myProof.json target/ # Or if the file is in another location cp /path/to/your/myProof.json target/

Step 6: Switch to the tool directory
Navigate to the target directory.

# Enter the target directory cd target

Step 7: Confirm files are ready
List the contents of the directory to ensure that both the .jar file and the proof file are present.

# View files in target directory ls

Step 8: Run the verification program
Execute the .jar file to verify your proof.

# Execute the verification command java -jar mexc-proof-of-reserves.jar myProof.json

The program will use the user's proof data to calculate the Merkle Root and compare it with the root hash already published by the platform.

Step 9: Check the verification output

validate result is : true

If the output shows validate result is : true, it means your balance has been correctly included in the Merkle Tree, and the platform's total liabilities are complete and accurate. Conversely, if the result is false, it may indicate data tampering or omission.

In addition to the Merkle Tree verification method described above, most exchanges also provide a simplified on-platform verification tool, allowing users to complete personal proof of reserve verification in just a few steps. MEXC users can refer to "How to Verify User Assets on MEXC" for detailed instructions on the web verification process.

3. How to Cross-Verify and Why Third-Party Audits Are Essential


To more thoroughly verify a Proof of Reserves (PoR) report, users can perform multi-source cross-verification. This involves using third-party tools to compare and analyze on-chain data. For example:
  • DeFiLlama CEX Transparency can be used to view the on-chain asset holdings of major exchanges.
  • CryptoQuant and similar platforms allow users to track reserve movements and detect unusual fluctuations, helping to identify potential liquidity risks early.

However, users should note that third-party tools may experience delays in data collection, so it’s best to reference multiple data sources for a balanced assessment.

At the same time, on-chain wallet data alone can only confirm how many assets an exchange holds, not whether all user liabilities are fully recorded. An exchange might exclude part of its users' balances or temporarily borrow assets before taking a snapshot to inflate reserves. These issues cannot be detected purely through on-chain data, which highlights the critical role of independent third-party audits.

More exchanges are now adopting a triangular verification model that combines platform PoR reports, on-chain wallet transparency, and third-party audits. This approach transforms transparency from a static snapshot into an ongoing, verifiable audit system, eliminating blind spots in user self-verification.

Audit firms directly publish reports that review both the completeness of user liability records and the accuracy of on-chain asset holdings, ensuring that the exchange has enough reserves to cover all user withdrawals. Importantly, these audits are not one-time events but continuously updated, allowing users to monitor reserve health over time. Audit firms also disclose key verification data, including the global Merkle Root and exchange wallet addresses, enabling technically skilled users to independently verify the audit's authenticity.

Currently, MEXC has partnered with the globally recognized blockchain auditing firm Hacken to further enhance PoR transparency. Hacken, which also provides audit services for Bybit, OKX, and other leading exchanges, is known for its credibility in the industry. Using established auditing standards, Hacken conducts comprehensive reviews of MEXC's user asset records and actual reserves to ensure full coverage of withdrawal demands. Moreover, Hacken releases independent monthly audit reports, ensuring neutrality and transparency. Users can access these third-party reports to verify MEXC's reserve status with confidence.

Conclusion


In the crypto industry, transparency is not optional, it is essential for survival. The collapse of exchanges such as FTX has made it clear that asset security should never rely on blind trust for a platform, but rather on verifiable mathematical proofs and independent audits.

A robust security framework combines three pillars: a Proof of Reserves (PoR) system, publicly verifiable on-chain wallet data, and third-party independent audits. Together, these elements shift users from passive reliance on a platform's promises to active verification of their own asset safety.

Questions like "Can I withdraw my funds during a bank run?" and "Has my crypto been misused?" no longer need to remain hidden behind a black box. Instead, they can be answered openly through data, cryptographic verification, and transparent oversight by every user.

Sign Up on MEXC
Sign Up & Receive Up to 10,000 USDT Bonus