When a payment gateway holds your money, you are trusting it to still have the coins when you ask for them. For years that trust rested on reputation alone. Proof of reserves is one way for a custodian to show, in public, that the coins are there. This guide explains what it can and can't tell you, and how to check one yourself instead of taking the headline number on faith.
What proof of reserves is
A proof of reserves has two halves. One is what the custodian holds: the balances of its blockchain addresses. The other is what it owes: the total of every customer balance it keeps. Put them side by side, coin by coin, and you get a coverage ratio. If it holds at least as much as it owes, coverage is 100% or more.
The idea became common among crypto exchanges after a run of exchange failures in 2022. Ethereum co-founder Vitalik Buterin's essay Having a safe CEX: proof of solvency and beyond is a good introduction to the techniques. It describes, for example, how a Merkle tree lets each user check that their own balance was counted in the total owed, and why a check done once in a while falls short of one done in real time.
The two halves are not equally easy to verify. Holdings are on public blockchains, so anyone can look them up. What is owed lives in the custodian's own database, so it is harder for an outsider to check.
Why it matters for a payment gateway
A custodial payment gateway is in the same position as an exchange, on a smaller scale. Customers pay into addresses the gateway controls, the gateway keeps a balance for each business, and the coins leave only when the business asks for a payout. Between those moments, the business can see a number in a dashboard, but not the coins themselves.
Non-custodial gateways don't have this problem, because payments go straight to a wallet the business controls. That is a different trade-off, with its own costs, and our guide to custodial vs non-custodial crypto payments compares the two. If you do use a custodian, a proof of reserves is one of the few things you can check without asking it to trust you back.
What proof of reserves proves
- The listed addresses held those amounts at that moment. Anyone can confirm this on a block explorer, and it doesn't depend on trusting the custodian.
- Coverage per coin, if the owed figure is right. If the ledger total is complete and accurate, coverage of 100% or more means there were enough coins of that kind to pay everyone back at that moment.
- A track record, if it is repeated. A single snapshot is easy to stage. Hundreds of hourly snapshots in a row are much harder to fake, and gaps or sudden drops are visible to everyone.
What it doesn't prove
The PCAOB, the US body that oversees auditors of public companies, put out an investor advisory in 2023 urging caution with proof of reserve reports, because they are not audits and give limited assurance. The main limits are these:
- It is a snapshot. It shows one moment. Coins can move afterwards, and coins in transit between the custodian's own addresses during the check can be counted late.
- The owed side relies on the custodian's records. If a debt is missing from the ledger, coverage looks better than it is. Merkle-tree schemes let users check their own balance was included, but not that nothing else was left out.
- A listed address isn't always proof of control. Anyone can list an address. Signing a message with its key, or a business finding its own deposit and pool addresses in the list, ties the two together more firmly.
- It doesn't show how the platform is run. Key storage, security practices, staff access and the company's other debts are all outside its scope.
- It is not an audit or a guarantee. It is information you can check, not a promise about the future.
How to check a proof of reserves yourself
- 1Read it coin by coin. A total in US dollars can hide a shortfall in one coin behind a surplus in another, and you will be paid out in the coin you hold.
- 2Download the address list and look up a handful of addresses on a block explorer for each network. Pick some at random, including small ones.
- 3If you are a customer of the custodian, find your own addresses in the list, for example the deposit address an invoice was paid to, or your business's pool address.
- 4Check how fresh the snapshot is, and whether every balance could be read. A partial snapshot undercounts what is held.
- 5Come back over days and weeks. Steady coverage across many snapshots says more than one good number.
How Crypto Merchant's proof of reserves works
Crypto Merchant is a custodial gateway, so it publishes a public proof of reserves page. The worker refreshes it every hour. For every coin, it shows:
| Column | What it is | Where it comes from |
|---|---|---|
| Owed | Business balances, partner shares set aside for revenue splits, and refunds and claims waiting for customers | The ledger |
| Held on-chain | The balances of Crypto Merchant's pool and deposit addresses | Read from the blockchains |
| Coverage | Held divided by owed. Anything above 100% is Crypto Merchant's own coins, such as fees and gas | Worked out from the two |
Every address holding coins is listed with block-explorer links, without saying which business it belongs to, and /reserves.csv downloads all of them. The page says when a snapshot couldn't read every balance, because then the held total may be lower than what is actually there.
Each business has its own pool wallet, from its own account under Crypto Merchant's recovery phrase, not a share of one hot wallet. The Wallets page in the portal shows a business its pool addresses, with explorer links for each network and the live on-chain balance, so it can find them in the public list. The recovery phrase itself is kept offline on paper, as the security docs describe.
Its limits
The same limits apply as for any proof of reserves. It is a snapshot, so coins moving between our addresses during a check can be counted late. The owed side comes from our ledger, without a Merkle tree, so a business can check its own balance in the portal but not, from the page alone, everyone else's. It proves the coins exist, not how the platform is run, and it is not an audit.
Other things to look at
A proof of reserves is one signal among several. When you choose where to keep money, also look at:
- The custody model: who holds the keys, and how wallets can be recovered if servers are lost.
- Account security: two-step sign-in, team roles, and who can move money out.
- The fees and rules for getting your money out. On Crypto Merchant that is 1% per paid invoice and payouts any time with no minimum; the pricing section lists everything.
- Licences, registrations and track record, if your bank or partners require them.
- How fast the provider answers when something goes wrong.
Our crypto payment gateway comparison sets these out for several well-known providers, including which ones publish a proof of reserves.