Crypto users are demanding more than screenshots of wallet balances. They want evidence that exchanges hold enough liquid assets to meet customer withdrawals, that those assets are not pledged elsewhere, and that the firms controlling private keys can act when markets become stressed.
For much of crypto’s history, exchange confidence was measured through trading volume, token listings and the speed of withdrawals. That standard is changing. After a series of failures exposed weaknesses in how platforms handled customer funds, users and institutions are asking a more basic question: where is the money, and who can move it?
The question has become increasingly important as digital asset markets mature. Large investors now allocate capital through custodians, prime brokers, exchange traded products and regulated venues. Smaller traders still rely on centralized exchanges for liquidity and convenience. Both groups, however, remain exposed to the same structural risk. A platform may display a large wallet balance while its customers face losses because the balance is pledged, borrowed against, owned by another entity or inaccessible to the people running the exchange.
Proof of reserves has emerged as the most visible answer. These reports can show that a company controls certain blockchain addresses at a particular moment. They can also provide a useful check against claims that are plainly inconsistent with on-chain holdings. But a reserve snapshot is not the same as a full examination of solvency, liquidity or custody controls.
The next phase of exchange transparency will therefore depend on combining several forms of evidence: blockchain balances, customer liabilities, legal ownership, lending disclosures, internal controls and independent verification. The firms that provide that information may gain a durable advantage. Those that continue to rely on marketing claims could face faster withdrawals when confidence weakens.
The limits of a wallet snapshot
A proof of reserves report typically attempts to demonstrate that an exchange holds a quantity of digital assets equal to, or greater than, the assets it says belong to customers. The evidence may consist of signed messages, wallet addresses, an accounting firm’s attestation or a dashboard that updates balances over time.
That information can be valuable. Public blockchains make it possible to inspect wallet balances without depending entirely on company statements. A user can see whether a reported address contains bitcoin, ether or stablecoins, and can monitor whether those assets move. This level of visibility is unusual in traditional finance, where the public rarely receives a real time view of a broker’s custodial accounts.
Yet reserves alone do not establish that an exchange is solvent. The missing side of the equation is liabilities. If a platform reports that it controls 100,000 bitcoin, customers need to know whether they are owed 80,000 bitcoin, 100,000 bitcoin or 140,000 bitcoin. Without a reliable measurement of customer claims, the reserve figure has limited meaning.
Liabilities can also be difficult to define. A customer may hold a spot balance, a margin position, a derivatives contract or a claim against an affiliate. The exchange may net some positions against each other, while customers may assume that every displayed asset is held on a one to one basis. A report that does not explain those accounting choices can create an appearance of certainty without answering the central question.
The timing of a report matters as well. An exchange can borrow assets shortly before an attestation and return them afterward. It can move funds between affiliated wallets. It can use temporary credit from a market maker or another platform. A point in time snapshot may therefore show control of assets without explaining how that control was obtained or whether it can be maintained.
Control is more than ownership
Even when assets are visible on-chain, customers need to know who controls the relevant private keys. A wallet address may belong to an exchange, a custodian, a lending counterparty or a special purpose entity. The distinction matters because legal ownership and technical control do not always sit with the same organization.
An exchange may outsource custody to a specialist provider. That arrangement can reduce operational risk if the custodian has stronger security systems and segregation procedures. It can also introduce a new layer of exposure. Customers may not know whether the custodian can rehypothecate assets, whether the exchange has a direct legal claim to them, or how quickly the assets can be returned during a dispute.
Multisignature arrangements create another set of questions. Requiring several approvals to move funds can limit the damage caused by a compromised employee or stolen key. But a report should identify which entities hold the signing authority, how many signatures are required and whether any signer is related to the exchange. A wallet controlled by several executives may still represent concentrated operational risk.
Geographic distribution is relevant too. Keys held in different jurisdictions may support business continuity, but cross border structures can complicate recovery. Bankruptcy law, regulatory intervention and contractual disputes may determine whether customers can access assets even when those assets remain visible on a blockchain.
For this reason, credible custody reporting must connect on-chain control to legal claims. Customers should be able to understand whether assets are held for their benefit, whether they can be used in the exchange’s ordinary business and whether they would be returned separately from corporate property if the platform failed.
Rehypothecation remains the central blind spot
Rehypothecation occurs when an institution uses assets posted by one party for another purpose, such as lending them to a third party, pledging them as collateral or deploying them in a trading strategy. It is common in traditional markets, where it can improve liquidity and lower financing costs. In crypto, it can also turn a simple custody relationship into a chain of interconnected obligations.
An exchange that lends customer bitcoin may earn income and deepen market liquidity. The customer, however, is no longer exposed only to the exchange’s technology and management. The customer is also exposed to the borrower, the collateral arrangement and the ability to unwind the position under pressure.
This risk tends to become visible when liquidity disappears. During calm periods, a platform may meet withdrawals while a substantial share of customer assets is committed elsewhere. When prices fall or lenders demand repayment, the exchange may need to sell collateral, borrow additional funds or restrict withdrawals. The same assets can appear to support more than one economic claim.
Transparency should therefore show the amount of customer property that is lent, pledged or used in decentralized finance strategies. It should identify counterparties by category, describe collateral rules and disclose maturity mismatches. An exchange does not necessarily need to reveal every trading strategy in real time, but it should explain how much liquidity can be accessed immediately and how much depends on a third party performing as expected.
Stablecoins deserve particular attention. An exchange may report large stablecoin reserves while holding a mix of instruments with different redemption terms and risks. Some may be directly redeemable from the issuer, while others may be borrowed, deposited in protocols or held through an affiliate. The label of the token alone does not reveal how quickly it can become cash or a major cryptocurrency during a market shock.
Independent audits and their boundaries
Traditional audits can strengthen exchange disclosures, but their role is often misunderstood. An audit normally examines financial statements under a defined accounting framework and for a specified period. It may not provide continuous assurance over wallet control, customer segregation or the availability of assets during a sudden withdrawal surge.
An attestation can be narrower still. It may confirm that management presented certain information and that the accountant performed selected procedures. That is different from an audit that tests systems, transactions, liabilities and controls in depth. Users should be told exactly what work was performed, what evidence was examined and what was excluded.
The independence of the reviewer also matters. An accounting firm that receives substantial consulting fees from an exchange may face perceived conflicts, even if its procedures meet professional requirements. A report prepared by a custodian, software vendor or affiliated service provider should not be presented as equivalent to an independent audit.
Useful reporting would include the scope of the engagement, the date of the evidence, the treatment of customer liabilities and any limitations identified by the reviewer. It should also explain whether the firm tested private key access, reviewed related party transactions and examined transfers made shortly before the reporting date.
No audit eliminates risk. But a well designed process can make it harder for an exchange to hide a deficit, misclassify customer funds or rely on temporary financing. It can also give regulators and institutional clients a common framework for comparing platforms.
The liquidity question
A solvent exchange can still fail if it cannot meet withdrawals when customers ask for their money at the same time. Liquidity is therefore separate from solvency. An asset may have a high market value on paper but be difficult to sell without causing a large price impact.
This distinction is especially important for smaller platforms. Their order books may be thin, their banking relationships limited and their access to emergency financing uncertain. A dashboard showing reserves in a less liquid token may offer little comfort if users are trying to withdraw bitcoin or fiat currency.
Exchanges should disclose the composition of reserves by asset, the share held in highly liquid instruments and the estimated time needed to convert those assets. They should explain whether fiat balances sit at banks, payment firms or affiliated companies. They should also publish information about withdrawal limits, settlement partners and contingency arrangements.
Stress testing could provide a more practical measure of resilience. A platform might show how it would respond if a defined share of customers withdrew funds over several hours while the value of major collateral assets fell. The exercise would not predict every crisis, but it could reveal whether the exchange has enough immediately available liquidity or depends on optimistic assumptions.
Customer behavior provides an early signal of perceived risk. When users move assets to self custody, transfer stablecoins to competing venues or reduce balances despite stable prices, they may be responding to concerns that are not visible in trading data. Exchange outflows can therefore reflect more than profit taking. They can show a change in the location of liquidity and a declining willingness to fund centralized intermediaries.
The cost of transparency
More disclosure will not be free. Smaller exchanges may struggle to pay for frequent attestations, legal reviews, security testing and independent audits. They may also lack the technical staff needed to build reliable liability accounting across spot, margin and derivatives products.
That cost could accelerate consolidation. Large platforms with deeper compliance budgets and stronger banking relationships may be able to meet higher standards, while regional exchanges retreat from certain services or rely on third party custodians. Such consolidation could improve safety, but it might also reduce competition and concentrate liquidity in a small number of venues.
A tiered framework could limit that effect. Every exchange could be required to disclose basic wallet control, customer liabilities and related party exposure. Platforms offering margin, lending or derivatives could face additional requirements. Institutions handling large balances might need continuous monitoring, segregation reviews and recovery tests.
Standardization would also help customers compare reports. At present, one exchange may describe reserves by blockchain address, another by asset category and another through a third party dashboard with limited methodology. A common format could include reserve assets, customer liabilities, encumbered assets, affiliate transactions, custody providers, withdrawal performance and the date of the latest independent review.
Regulators may eventually define many of these requirements. But companies do not need to wait for formal rules. Transparent reporting can serve as a commercial signal to institutions that need approved counterparties and to retail customers who are more cautious after past failures.
A new competition for trust
The economics of exchange custody are changing because users are beginning to treat transparency as part of the product. Low fees and deep liquidity remain important, but they are not enough to retain capital if customers doubt that withdrawals will work in a crisis.
Institutional investors are likely to push this shift further. Their mandates often require documented controls, segregation of assets, business continuity plans and defined legal protections. A platform that cannot explain its custody structure may be excluded even if it offers better execution. In this sense, transparency can influence capital flows before it affects prices or trading volume.
Retail investors may respond more gradually. Many users keep assets on exchanges because self custody introduces its own risks, including lost keys, phishing and poor transaction practices. The practical choice is not simply centralized custody versus personal wallets. It is a comparison between different forms of operational and counterparty risk.
The strongest exchanges will recognize that proof of control is not a single certificate. It is an ongoing process that links public blockchain evidence with private accounting, legal documentation and tested internal procedures. The objective is not to promise that losses are impossible. It is to show customers where the risks are, who bears them and how the platform would respond when liquidity becomes scarce.
The next exchange crisis may still begin with a price collapse, a failed borrower or a banking disruption. Its scale, however, will depend on how much information customers have before they decide whether to withdraw. Platforms that disclose only what looks favorable may discover that partial transparency creates its own suspicion. Those that reveal the structure of their liabilities, custody arrangements and liquidity buffers will give capital a reason to stay.
For crypto markets, that is the more important test. The question is no longer whether an exchange can display assets on a blockchain. It is whether customers can establish that those assets are available, legally protected and controlled by an organization capable of returning them when confidence disappears.