ذرائع کی جانچ پر مبنی تحقیق: Binance / OKX

The six pieces to separate

When you open a Proof of Reserves page, separate six layers before drawing any conclusion.

This separation is the whole method. If a page collapses these layers into one marketing claim, the reader should slow down.

Binance example: inclusion plus zk-SNARK constraints

Binance's public Proof of Reserves page describes PoR as evidence that assets held in custody for users cover user assets 1:1, including reserves. The page says Binance uses a Merkle Tree so users can verify that their assets are included in aggregate net account balances. It also says the Merkle Tree is validated by a zk-SNARK mechanism.

The useful detail is not the slogan. It is the mechanics. Binance says Merkle Trees consolidate large data sets into a single root hash and let users verify whether specific contents were included in a sealed set of data. In a PoR context, that means a user can check whether their account balance was included in the liabilities report used for the reserve calculation.

Binance's zk-SNARK section describes constraints on the balance set. It says each user's account balances contribute to the claimed total user asset balance, the total net balance of an account is greater than or equal to zero, and the root update is valid after account information is updated to the leaf hash. That helps address a classic PoR problem: an exchange should not be able to make negative-balance users cancel out positive-balance liabilities in a misleading way.

The Binance support FAQ adds timing. It says monthly proof-of-reserve snapshots are taken on the first day of each month at 00:00 UTC and released by the seventh day. It also says the report is a snapshot, not a display of real-time assets, and may not match a user's current asset count. For verification cycles from 2026-08-01 onward, the FAQ lists verifier tool version 1.2.1.

That timing warning matters. If a user checks a PoR report on September 8, the report may describe September 1 balances. It can still be useful, but it is not a live guarantee that every withdrawal request on September 8 is fully covered.

OKX example: account assets, wallet assets and custody caveats

OKX United States' Proof of Reserves page says OKX maintains a 1:1 reserve of account assets and performs periodic global PoR reports. The same page displays its 46th Proof of Reserves for August 2026, describes $22.96B in primary assets, and lists 22 coins. NexuAlpha treats those figures as OKX page claims, not as independently verified figures from this article.

OKX's page is useful because it exposes several labels readers should not flatten. It separates "OKX account assets" from "OKX wallet assets" and then shows wallet assets split across exchange and third-party custody lines. That distinction matters. Account assets are the exchange-side customer balances being compared. Wallet assets are the disclosed asset base used for the reserve ratio. Third-party custody balances introduce another verification dependency: the page itself says users may contact third-party custodians for verification of those balances.

OKX also says it upgraded its PoR system with zk-STARK and publishes wallet address information where users can check on-chain assets. Its wallet ownership section says listed addresses contain a signed message stating that the address is an OKX address. A valid signature can support address-control evidence, but it is still not a complete audit. It tells you that the signer controls an address, not that every liability has been counted or that assets will remain available tomorrow.

Why PoR is not a full audit

The SEC Chief Accountant's July 27, 2023 statement warned that some crypto firms market third-party or accounting-firm work as a kind of audit even when the work is not a financial-statement audit. The statement says non-audit arrangements are not as rigorous or comprehensive as financial-statement audits and may not provide reasonable assurance to investors.

The PCAOB investor advisory is even more direct for PoR readers. It says proof-of-reserve reports are inherently limited and not audits. It warns that such reports may verify an asset type at a specific moment while not addressing liabilities, digital-asset holder rights and obligations, whether assets were borrowed, whether assets became unavailable after the report, internal controls, governance, or future reserve adequacy.

Those warnings do not mean PoR is useless. They mean PoR should not be asked to do an audit's job. A strong PoR system can improve transparency around a specific reserve question. A full financial-statement audit addresses a broader company-wide reporting question under a defined audit framework. Those are different jobs.

A practical reading checklist

Start with the timestamp. Is the report real time, daily, monthly or occasional? Binance's FAQ gives a monthly schedule and explicitly says the report is a snapshot. A stale snapshot can still be useful, but it should not be mistaken for live solvency.

Then identify the asset set. Which coins are included? Are fiat balances included? Are bridged assets, staked assets, loaned assets, wrapped assets or third-party custody balances handled separately? OKX's page shows why this matters: exchange wallets and third-party custody can sit under the same reserve presentation.

Next, inspect the liability side. Does the exchange publish aggregate customer balances? Does the user have a Merkle leaf, account hash or record ID? Can the user verify inclusion without exposing their identity or balance to the public? Binance's FAQ describes account index, account ID hash, total equity, total debt, total collateral, assets, root and proof as part of its user verification files.

After that, examine the proof type. A Merkle proof can help a user verify inclusion in a tree. A zk-SNARK or zk-STARK can prove that selected constraints were satisfied without revealing every account. But proof strength depends on the constraints, implementation, source files, public verification keys, and whether users or third parties actually run the verifier.

Finally, check independence and scope. Was the work performed by the exchange, an accounting firm, a security firm, an open-source tool, or a community verifier? Is the procedure public? Does the report say what it excludes? Does it mention internal controls, governance, related parties, loans, fiat, legal entities or off-balance-sheet obligations? Silence on those items should not be treated as proof that no risk exists.

What PoR can and cannot tell you

PoR can support three useful checks. First, it can let a user test whether their own account balance appears inside a published reserve process. Second, it can let observers compare disclosed wallet assets against stated customer balances for covered coins. Third, it can make reserve claims harder to fake casually because wallet addresses, signatures, Merkle roots and proof files create data that outsiders can inspect.

PoR cannot, by itself, prove full solvency. It may not show all liabilities. It may not show whether assets are borrowed, pledged, lent, controlled through third parties or moved after the snapshot. It may not cover fiat obligations, derivatives exposure, pending legal claims, affiliate balances, operating-company debt, cybersecurity controls or governance quality. It may not be performed under PCAOB auditing standards or subject to PCAOB inspection.

The honest conclusion is narrow but useful: PoR is a transparency tool, not a safety certificate. Read it as one input in venue due diligence, alongside licensing, legal entity, custody model, withdrawal history, incident record, insurance or backstop disclosures, financial statements where available, and the user's own jurisdictional rights.

NexuAlpha view

NexuAlpha should treat PoR as a venue-risk dimension, not as a venue ranking shortcut. A stronger exchange profile should separate reserve ratio, asset coverage, snapshot date, proof mechanism, user-verification path, wallet ownership evidence, third-party assurance, liability coverage and stated limitations.

This article can connect to internal profiles for Binance and OKX, plus future guides on custody models, CEX risk checks, stablecoin backing, and exchange solvency indicators. The internal link should not say "Binance is safer" or "OKX is safer." The better link text is operational: "how Binance PoR verification works" or "how OKX reports account assets and wallet assets."

FAQ

Is Proof of Reserves the same as an audit?

No. PoR can verify selected reserve and balance data under a defined process, but SEC and PCAOB materials warn that non-audit crypto assurance work should not be marketed as equivalent to a financial-statement audit.

What does Merkle inclusion prove?

It can help a user verify that their account leaf was included in a published Merkle tree. It does not prove all other customers were included or that every liability was captured.

What do zk-SNARKs or zk-STARKs add?

They can prove selected constraints about the published balance set without exposing every account balance. They do not automatically cover liabilities or risks outside the constraint system.

Why does wallet ownership matter?

Wallet signatures can show that an exchange controls listed addresses. That helps verify custody claims for those addresses, but it does not prove all assets or obligations are captured.

What is the biggest PoR mistake?

The biggest mistake is treating a point-in-time reserve disclosure as a live solvency guarantee. A PoR report should start questions, not end them.

Editorial disclosure

NexuAlpha analyzes public venue disclosures and separates verified facts from unknowns. This article contains no affiliate link, no investment recommendation, no exchange safety ranking and no claim that any user should keep assets on a centralized exchange.