What Is Proof of Reserves and How to Check It Before Trusting a Crypto App

What is proof of reserves and how do you check it?

Proof of reserves is a published check meant to show that a crypto app holds what its customers are owed. A complete one covers both what the company holds and what it owes. Most published versions only cover the first half, which proves much less than it appears to. The checklist below shows how to tell them apart.

Key Takeaways

Proof of reserves is a process where a company provides information to build trust about the customer assets it holds in custody (Chamber of Digital Commerce, Proof of Reserves).
It splits in two. Proving assets is easy, since wallet balances are public. Proving liabilities is where fraud risk concentrates, because a platform can underreport what it owes (Chamber of Digital Commerce).
Showing assets alone says nothing about solvency, since those assets might be pledged elsewhere or belong to the company instead of its customers (Chamber of Digital Commerce).
Snapshots can be gamed. A platform can borrow funds from a third party to pass a single check, which is why repeated audits matter more than one (Chamber of Digital Commerce).
Brighty publishes a proof of reserves page describing a Merkle tree approach verified by an independent third party, alongside custody through Fireblocks (Brighty, Proof of Reserves; Brighty, Homepage).

What is proof of reserves?

Proof of reserves is a method a company uses to show it holds enough assets to cover what it owes customers. The Chamber of Digital Commerce describes it as a process that provides information to build trust about custodial digital asset holdings (Chamber of Digital Commerce).

The idea took hold after several large platforms collapsed holding customer money they could not return. A company that shows the coins are there, repeatedly and in public, gives customers something firmer than a promise.

Execution is where it gets complicated. The term covers everything from a genuine third-party examination down to a company posting a few wallet addresses and calling it transparency. The gap between those two is what this article is about.

Why does showing assets alone prove nothing?

Because a company's assets tell you nothing about its debts. An exchange can hold a billion dollars of Bitcoin and still be deeply insolvent if it owes customers two billion.

The framework splits the problem in two. Proving assets is the easy half, since a platform can publish wallet addresses and anyone can check the balances on a block explorer. Proving liabilities is the hard half, because the only record of what customers are owed sits in the company's own database, and a platform could simply underreport it. The Chamber of Digital Commerce calls liabilities the riskier side of the equation and the place where fraud risk concentrates (Chamber of Digital Commerce).

Two further problems sit underneath even a good asset proof. Those assets might be encumbered, meaning pledged as collateral or subject to a lien, so they exist but cannot freely be used to repay customers. They might also be the company's own operating funds, which were never customer money in the first place (Chamber of Digital Commerce).

A publication showing only wallet balances is a bank showing you its cash drawer while declining to mention its loan book.

How does a Merkle tree let you check your own balance?

A Merkle tree is the cryptographic trick that solves an awkward problem: proving your balance was included in the total, without the company publishing everyone's balances for the world to read.

It works by hashing each customer's identifier and balance together with a random value, then combining those hashes in pairs, over and over, until everything collapses into a single value called the root hash (Chamber of Digital Commerce). The company publishes that root. You receive the handful of hashes along your own branch, and you can check that they combine into the published root. If your balance had been left out or altered, the maths would not reconcile.

This matters because it attacks the underreporting problem directly. If every customer can independently confirm their inclusion, a platform cannot quietly shrink its stated liabilities.

The method has a known weakness. A sophisticated platform could build the tree selectively, tweaking nodes along verification paths so individual checks pass while the total stays wrong (Chamber of Digital Commerce). The cryptography alone does not close every gap, which is why an independent examiner still matters.

How do you check a crypto app's proof of reserves?

Seven questions separate a meaningful proof of reserves from a marketing page. Work through them on the provider's own published materials.

Does it cover liabilities, or only assets? If the publication shows wallet balances with no attempt to establish what customers are owed, it is half a proof. This single question eliminates most of what gets published.
Who performed it, and are they independent? Look for a named firm. The Chamber guidance points to certified public accountants, who carry professional obligations a company's own staff do not (Chamber of Digital Commerce).
Can you verify your own balance? A Merkle tree approach should come with a tool and instructions letting you check your own account. If the method is described but no tool exists, you cannot actually test anything.
When was the snapshot, and how often is it repeated? A platform can borrow funds to pass a single check (Chamber of Digital Commerce). A published schedule makes that expensive and visible.
Did they prove they control the keys? Holding an address is not the same as controlling it. Examiners confirm control through methods like a send-to-self transaction, which demonstrates access to the private keys (Chamber of Digital Commerce).
Are the assets free of liens? Reserves pledged elsewhere as collateral cannot be returned to you (Chamber of Digital Commerce).
Does it cover everything? Partial coverage of assets or accounts leaves room for exactly the shortfall the exercise should rule out (Chamber of Digital Commerce).

Questions one and three do most of the work. If liabilities are missing and you cannot check your own balance, the rest is decoration.

What are the warning signs?

A few patterns reliably mark a publication that will not survive scrutiny.

A list of wallet addresses presented as the whole proof. Assets without liabilities.
No date, or one from over a year ago. A snapshot describes a moment that has since passed.
The word "audited" with no firm named. Audited by whom, against what criteria?
A described method with no working tool. Explaining Merkle trees is not the same as letting you use one.
A single historical exercise. One check is a photograph. A schedule is a practice.
Reserve claims that live only in marketing copy. If the figure appears on a landing page and in no report, there is nothing to examine.

None of these prove a platform is unsound. They tell you the publication is not evidence, so your confidence has to rest on something else.

There is a real tension here. Publishing every wallet address exposes a company's entire transaction history to anyone who cares to study it, with security consequences of its own (Private Proof of Solvency, 2023). A firm weighing that against full disclosure is not automatically hiding something, which is why an independent examiner counts for more than raw publication.

What Brighty publishes

Brighty maintains a proof of reserves page setting out how its process works. Customer balances are organised into a Merkle tree, which produces a single fingerprint, and an independent third party verifies that the assets Brighty reports meet or exceed the combined balances of its users (Brighty, Proof of Reserves).

The page states that the audit covers cryptocurrencies, fiat holdings and DeFi positions, and that users can independently confirm their own balance was counted in the audit (Brighty, Proof of Reserves). On custody, Brighty's homepage cites audited custody with Fireblocks and continuous transaction monitoring (Brighty, Homepage).

Apply the checklist above to this page as you would to any other. The described method covers the liabilities side, which puts it ahead of a wallet-address list. Where the page does not spell something out, such as the firm conducting the verification or the date of the most recent check, ask support directly. A provider confident in its process will answer, and that holds for every app you use, including this one.

FAQ

Does proof of reserves mean my money is safe?

No. It indicates that assets covering customer balances existed at the moment of the check. It says nothing about what happens afterwards, and nothing about the company's wider financial position (Chamber of Digital Commerce).

What is the difference between proof of reserves and an audit?

A full financial audit examines a company's whole position under professional standards. Most proof of reserves exercises are narrower, checking custodial holdings against customer balances on one day. The two get conflated, which benefits whoever is publishing.

Can a company fake proof of reserves?

It can game a weak one. Borrowing assets to cover a scheduled snapshot is a documented weakness, as is building a Merkle tree so that individual checks pass while the total understates liabilities (Chamber of Digital Commerce). Independent examination and frequent repetition raise the cost of both.

How often should a crypto app publish it?

More often than once. The specific cadence matters less than whether a schedule exists and is kept, because a single historical check tells you about one day that has already gone.

Should I avoid apps without proof of reserves?

Treat it as one input. Many supervised firms publish nothing called proof of reserves while operating under rules that do a similar job, such as obligations to keep client assets separate from the company's own. The absence matters most where nothing else is doing that job.

How do I check my own balance in a Merkle tree?

The provider gives you a record ID and the hashes along your branch, and a verification tool combines them to reproduce the published root hash. If your provider describes a Merkle tree but offers no tool, ask them how to perform the check.

Download Brighty to hold crypto and euros in an app that publishes how it verifies reserves, and bring the checklist above with you.