A bitcoin proof of reserves is a claim by a custodian that it holds the coins it says it holds, backed by on-chain addresses and a cryptographic snapshot of customer balances. After every exchange failure of the last few years, Canadian buyers have started asking for one before they deposit. The problem is that most people read a proof of reserves report as a guarantee, when it is closer to a photograph of one moment in time. This guide explains what the report actually shows, where the gaps sit, and how to confirm your own bitcoin without trusting a PDF.
Table of Contents
- What Bitcoin Proof of Reserves Actually Proves
- How a Merkle Proof Works for an Ordinary Customer
- Why Proof of Reserves Can Still Fail You
- How to Verify Your Own Bitcoin, Step by Step
- Proof of Reserves vs Self-Custody in Canada
- Frequently Asked Questions
What Bitcoin Proof of Reserves Actually Proves
A proof of reserves has two halves, and they are not equally strong. The first half is a list of bitcoin addresses the company says it controls. Because the blockchain is public, anyone can add up the balances at those addresses at a given block height. The second half is a Merkle tree built from every customer balance, which lets each customer confirm that an entry matching their own holdings was included in the total the company is claiming.
Put together, a good report proves one narrow thing: at block height X, the addresses the company pointed at held at least the sum of the customer balances in the tree. That is a statement about assets and about one timestamp. It says nothing about what the company owes, what it has borrowed against those coins, or what happened to the addresses the day after the snapshot was taken.
This matters for Canadians because the phrase gets used loosely in marketing. A screenshot of a large bitcoin balance is not a proof of reserves. A signed message from a single address is not a proof of reserves. A proof of reserves without a matching proof of liabilities is a partial answer, and partial answers are exactly what failed customers at collapsed exchanges in 2022.
If you hold bitcoin on a platform, the useful question is not “do they publish a report?” It is “what does the report cover, who checked it, and could I withdraw today if I wanted to?” Our comparison of Bitcoin ATMs and online exchanges walks through how custody differs between the two models.
How a Merkle Proof Works for an Ordinary Customer
You do not need to be a cryptographer to use a Merkle proof, but you do need to understand what you are checking. A Merkle tree hashes every customer balance, then hashes pairs of those hashes together, layer by layer, until a single value remains. That final value is the Merkle root. The company publishes the root alongside the total balance it represents.
Your inclusion proof is a short list of hashes. Combined with your own balance and some salt or user ID, they should reproduce the published root. If they do, your balance was counted. If they do not, either the root changed or your entry is missing.
What the check does not tell you
An inclusion proof confirms your number is in the tree. It does not confirm the tree contains every customer, that the same customer was not counted twice, or that negative balances and internal accounts were excluded. A tree can be technically valid and still be built from an incomplete set of users. This is the single most common flaw in reports that look sophisticated.
Who signs the root, and when
The trust anchor is usually a third party attesting that the address list and the customer snapshot were produced honestly from the company’s own systems. Read the scope paragraph of that attestation rather than the headline. A review of a database export is not an audit of solvency, and the two get conflated constantly in press releases.
Because the bitcoin network is transparent by design, all of this checking is something you can do yourself rather than accept on faith. The original Bitcoin whitepaper describes the chain of signatures and proof-of-work that make independent verification possible in the first place.
Why Proof of Reserves Can Still Fail You
The weaknesses are structural, not technical accidents. Knowing them is how you read a report like a sceptic instead of a customer.
Liabilities are invisible
Assets without liabilities prove nothing about solvency. A firm can hold 10,000 BTC in labelled addresses and owe 14,000 BTC to customers, lenders and counterparties. The report will look healthy because the only number it publishes is the one that flatters it. Proof of liabilities is harder, because it requires publishing obligations and totals without exposing individual customers, and most firms simply skip it.
The snapshot is a window, not a state
Coins can be borrowed for the duration of a snapshot and returned afterwards. Addresses can be swapped between reports. A firm that knows the audit date can move balances into view and out again. Analysts at the Bank for International Settlements have documented how fragile this kind of disclosure is when it is not continuous, in their quarterly review of crypto market structure.
Pledged coins still show up as reserves
Customer coins lent out as collateral, or pledged against a line of credit, remain visible on-chain. They are in the address, so they count. They are also encumbered, so a customer trying to withdraw may find the coins are not free to move. On-chain balances cannot distinguish between an asset you own outright and an asset someone else has a claim on.
There is no deposit insurance behind it
Canadian deposit protection covers bank deposits, not crypto balances on a trading platform. The Bank of Canada’s overview of the financial system describes the guarantee structure that applies to deposit-taking institutions, and crypto custodians sit outside it. A reserve report is a transparency tool, not a backstop.
How to Verify Your Own Bitcoin, Step by Step
You can confirm that a purchase actually reached your wallet in a few minutes, and doing it once teaches you more than any report. Start with the transaction ID the platform or ATM gives you.
- Open a block explorer and paste the transaction ID into the search field.
- Check the output addresses. At least one must match the receiving address in your own wallet, character for character.
- Check the amount against what you paid for, allowing for the network fee the sender deducted.
- Count confirmations. One confirmation means the transaction is in a block; more confirmations mean more accumulated proof-of-work behind it.
- Decide what your own threshold is. For a normal purchase, a handful of confirmations is plenty; for a large transfer, waiting longer is free insurance.
If the address does not match, stop and do not resend. A mismatched output means the coins went somewhere you do not control, and no support ticket will reverse it. Our guide on verifying a Bitcoin transaction covers the explorer fields in more detail, including what a replaced or unconfirmed transaction looks like.
Keep your own record
Save the transaction ID, the CAD amount you paid, the BTC amount received, the fee, the timestamp, the receiving address and the platform or ATM location. You will want that set at tax time if you ever sell, and it is the only evidence of cost basis you will have years later.
Proof of Reserves vs Self-Custody in Canada
There is a simpler answer to the custody question: hold your own keys and the reserve report becomes someone else’s problem. When you buy bitcoin for cash at a Bitcoiniacs ATM, the coins are sent to an address you supply, so the balance never sits on someone else’s ledger. You can find a machine near you on the Bitcoiniacs ATM locations page, or use the crypto exchange page if you prefer to compare live pricing first.
Self-custody moves the risk rather than deleting it. A wallet you control cannot be frozen or lent out, but it can be lost. A seed phrase written on a phone photo, stored in a cloud note, or read out to anyone who calls you is not custody, it is a countdown. Write the phrase on paper or metal, keep it offline, and never type it into a website that asked for it.
Canadian platforms that custody crypto for customers operate as money services businesses and must register with the federal regulator. You can check registration status directly through FINTRAC. Registration tells you the firm is supervised for anti-money-laundering obligations; it is not a solvency guarantee, and it is not a reason to skip the questions above.
A workable middle ground for most people: keep a working balance on a platform you actively trade with, keep the long-term holding in a wallet you control, and treat any published proof of reserves as one input among several. If a platform’s report is thin, that is a signal about how it thinks about transparency, regardless of its balance sheet.
Frequently Asked Questions
Does proof of reserves mean my bitcoin is safe?
No. It means the company demonstrated control of certain addresses at a specific block height. It does not cover liabilities, pledged coins, or what happens after the snapshot. Treat it as evidence of transparency, not a guarantee of solvency or of your ability to withdraw on any given day.
If I buy 1 BTC on an exchange, does the exchange actually hold it?
Usually the exchange holds coins in pooled wallets and records your balance in its database. Your claim is against the company, not against a specific coin. That is why withdrawals depend on the firm’s liquidity rather than on a particular address, and why self-custody changes the risk profile so much.
Why do people say proof of reserves means nothing without liabilities?
Because assets alone cannot show solvency. If a firm holds 10,000 BTC but owes 14,000 BTC, the reserve number looks impressive and the business is still insolvent. Without a matching, credible total of what is owed, a reserves figure answers a question nobody was asking.
How do I check whether my own balance was included in the report?
Look for an inclusion proof, sometimes called a Merkle proof, tied to your account. The platform gives you a short list of hashes, you combine them with your balance and identifier, and the result should match the published Merkle root. If the platform publishes only a root and a total with no per-user proof, you cannot verify your own inclusion.
Can a Canadian Bitcoin ATM be audited the same way?
The machine holds cash and dispenses bitcoin to your wallet, so there is no customer balance sitting on its books to audit. Your verification is the transaction itself: the coins arrive at an address you control, and you can confirm them on a public block explorer. That is a stronger check than most reserve reports provide.
The practical takeaway is unglamorous. Read the scope of any reserve attestation, ask whether liabilities are published, verify your own withdrawals on-chain, and keep anything you are not actively trading in a wallet whose keys you hold. A report can tell you something useful about a custodian. Only your own keys tell you where your bitcoin is.