"The era of ledgers with just numbers is over"…How far has the exchange proof-of-reserves race come?

In the wake of an erroneous payout incident at a domestic crypto exchange, analysis has emerged calling for a fresh review of proof-of-reserves (Proof of Reserves, PoR) frameworks and the level of internal controls.

On the 27th, INFCL said in a planned analytical report that the recent mistaken Bitcoin payout has resurfaced fundamental questions about exchange asset transparency. It noted that demand is growing to verify whether the assets exchanges claim to hold actually exist and whether figures recorded on internal ledgers match on-chain assets.

INFCL said, "This incident has confirmed the possibility that gaps can arise between internal ledgers and actual on-chain assets," adding, "Among investors, calls are expanding for systems that allow them to verify asset holdings directly."

Proof of reserves: from 'trust' to 'verification'

The report defined proof of reserves as a system that technically demonstrates whether an exchange actually holds users’ deposited assets at a 1:1 ratio. Adoption spread across global exchanges after the 2022 collapse of FTX, and the report said the benchmark for asset transparency is shifting from trust to verification.

PoR verification currently uses three main approaches.

△Merkle Tree: A method that combines individual users’ balances into a cryptographic hash structure so users can confirm their balance is included in the overall set

△Zero-knowledge proofs (zk-SNARK, zk-STARK): A technology that mathematically proves asset holdings without disclosing specific data, securing both privacy protection and completeness of verification

△Independent audit: A traditional verification method in which an external accounting firm compares on-chain assets with user balances and issues a report

INFCL explained, "Accounting audits are largely ex post," adding, "To secure near real-time transparency, on-chain-based verification systems need to be used in parallel."

Global exchanges accelerate the transparency race

The report also compared how major global exchanges are responding.

Binance introduced PoR in November 2022, built a Merkle-tree-based verification system, and added zk-SNARK. In January 2026, it revised its calculation methodology, expanding the scope to include its own operating assets as well. To date it has issued 38 reports; as of the latest, customer Bitcoin holdings stand at about 618,000 BTC and the coverage ratio is 100.06%.

Kraken has conducted proof-of-reserves audits through independent accounting firms since 2014. It later added a Merkle-tree-based user verification feature, and as of December 2025 it had its 1:1 holdings confirmed for major assets including BTC, ETH, SOL, and USDC. Another feature is that it issues reports quarterly.

OKX introduced PoR in November 2022 and applied zk-STARK. zk-STARK is technically differentiated in that it does not require a separate trusted setup process. It issues regular monthly reports and has now reached its 40th; it has disclosed on-chain reserves totaling $27.7 billion across more than 22 assets including BTC, ETH, and USDT. In the latest report, the BTC reserve ratio is 106% and ETH is 103%.

By contrast, major domestic exchanges are operated mainly around external accounting-firm audits and meeting minimum reserve requirements mandated by regulators. However, structures that allow users to verify holdings directly via on-chain data remain limited.

Beyond PoR, toward internal controls

The report stressed that if PoR is a tool to verify whether "assets exist," internal controls are procedures that address whether incidents are prevented. Because the recent erroneous payout stemmed from an internal system error, it said PoR alone is not sufficient.

INFCL emphasized, "If proof of reserves is a mechanism to demonstrate the existence of assets, internal controls are a mechanism to block incidents in advance," adding, "Only when both pillars function together can meaningful trust be restored."

Global exchanges are also strengthening operational risk management. Binance runs an in-house security team and the SAFU insurance fund, while Kraken highlights its compliance framework aligned with regulatory environments. OKX operates a multilayered defense system including a dedicated workflow for fund transfers, real-time reconciliation of internal ledgers, multi-step cross-department approvals, and 24-hour risk-engine monitoring.

The report projected that, for domestic exchanges, publicly available information on internal control structures is limited and that this incident could broaden demand for related disclosures.

The gap between regulation and self-regulation

Countries around the world are moving to tighten crypto regulation. Key pillars being discussed include mandating institutional-grade internal controls and strengthening accountability for system errors. South Korea is also reportedly preparing follow-on legislation to the Virtual Asset User Protection Act.

The report analyzed that "the gap is widening between exchanges that wait for regulation and those that get ahead of it." It cited as representative examples cases where methodologies were voluntarily revamped and cases where regular PoR disclosures have been maintained.

It also stressed the importance of investor due diligence. It presented key criteria such as whether PoR reports are issued regularly, whether direct on-chain verification is possible, whether zero-knowledge proofs have been adopted, the level of disclosure around internal control systems, and whether global regulatory licenses have been obtained.

INFCL assessed that "as the crypto market matures, the standard for trust is shifting from brand recognition to technical verifiability," and said the advancement of proof of reserves and internal controls is becoming a key factor that separates exchange competitiveness.