OKX Security Special｜PoR Chapter: Understanding an Exchange's "Health Check Report" in 5 Minutes

Read this article in 27 Minutes

1. PoR (Proof of Reserves) is a cryptographic verification mechanism used to demonstrate that an exchange's on-chain held assets are sufficient to cover users' total assets in a 1:1 ratio, ensuring transparency and user privacy, proving that the exchange has not misappropriated user funds and has solvency. 2. The three main steps and ideas of a PoR report: Overview (total user assets, platform total liabilities, and reserve ratio), Coin Details Check (inclusion of major coins), Detection of Common Patterns (such as fund shuffling between associated addresses, creation of fake liability accounts, etc.). 3. Evaluation of six key data points in a PoR report: Reserve ratio exceeding 100%, Inclusion of major coins in the PoR coverage, Reserve cleanliness (proportion of non-platform token assets to total reserve), Trend in reserves of major coins like BTC and ETH, Top 10 major coin distribution, Frequency of PoR report publication. 4. PoR report data should not be interpreted in isolation but combined with on-chain tracking, third-party platform verification, and the exchange's own public mechanisms to form a more comprehensive and objective assessment. 5. OKX adopts zk-STARK zero-knowledge proof technology, with globally open-source code, effectively preventing fake liability account schemes. Users can self-verify to prevent falsification of PoR reports, enhancing transparency and security.

Source: OKX

During the Black Swan event, major centralized exchanges rushed to show off their PoR (Proof of Reserves) reports. PoR is a cryptographic validation mechanism used to prove that the assets held by the exchange on-chain are sufficient to cover user assets at a 1:1 ratio, ensuring transparency and protecting user privacy. Its main purpose is to prove that the exchange has not misappropriated user assets and has the necessary solvency.

The difference between the exchange's PoR verification method and traditional finance is that PoR is based on cryptography to generate publicly verifiable proofs, supporting user-led verification. In contrast, traditional audits rely on third-party sampling and reporting, leaving users with passive trust and relatively limited transparency.

In theory, PoR is meant to reassure users, but currently, only a few top-tier exchanges represented by OKX are still monthly releasing PoR reports, while many others are already in a state of "slacking" or "stagnation." However, even with a PoR report, it cannot guarantee that the assets held by the exchange are completely secure. In other words, disclosing a PoR report does not equal absolute security. We need to understand what is behind the PoR and how each exchange specifically operates, reflecting the different levels of security among exchanges.

Blockchain expert Nic Carter once praised OKX as representing the highest level of mainstream exchange PoR quality. Next, we will take OKX as a sample to delve deeper into PoR: not just asking "whether it exists" but understanding how it is actually done and at what level of security OKX stands.

Start with These Three Steps

Many people open a PoR report and are immediately greeted by rows of tables or data: BTC Reserve Ratio 104%, ETH Reserve Ratio 101%, USDT Reserve Ratio 103%... Seeing all these numbers above 100%, they instinctively feel reassured: this platform should be reliable. But wait, actually, there are many hidden intricacies in the PoR report, and merely looking at the reserve ratio is far from enough.

To quickly grasp the key points and risks of PoR, you can follow these three main steps and thought processes.

Step One, Start with an Overview: Open the report and first look for total user assets, total platform liabilities, and reserve ratios. Different exchanges may use different terminology. For example, OKX uses account assets and OKX wallet assets, but both essentially refer to the assets and liabilities between users and the exchange. Don't just focus on the size of these numbers, but see if the reserve ratio is equal to or greater than 100%. For example, in OKX's April PoR, the BTC reserve ratio was 104%, not only meeting users' daily withdrawal needs but also reserving redundancy, indicating a stronger risk resistance.

Step 2, Check Coin Details: Not all coins are equally "stable." First, check if mainstream coins (BTC, ETH, USDT, USDC, etc.) are included, as these coins usually make up the majority of user assets and are core indicators of exchange liquidity, solvency, and risk management. Next, you need to open the details of each coin to see if the total exchange assets match the total user assets. For example, if there are 10,000 USDT in a wallet and the user's total asset is 9,000 USDT, then everything is fine. However, if it's the other way around, you should pay attention to whether there has been abnormal withdrawals or a decrease in reserve ratio.

Step 3, Identify Common Patterns: To demonstrate security, some exchanges may orchestrate a "capital shuffling" through associated addresses, only to move funds back after the Proof of Reserves (PoR) announcement; create numerous fake "liability accounts" to reduce platform liabilities, thereby proving solvency at a particular moment, only to revert back in the next period, etc. OKX adopts zk-STARK technology and has made its code globally open-source. On one hand, this effectively prevents the deceptive "liability account" scheme, and on the other hand, users can verify it themselves to prevent this "PoR Report Faking" trick.

If you don't have time to thoroughly analyze all the data, it is recommended to focus on three key indicators:

1. Is the reserve ratio consistently stable>100%?

2. Does it support user self-verification?

3. Are the reports regularly updated and cover mainstream assets and collateral assets?

Remember: It's not about how good the PoR data looks; the key is to understand the exchange's solvency and security capabilities.

Focus on These Six Data Points

First, Understand the Most Critical Security Data: Is the PoR Above 100%. This is like depositing money in a bank; the basic requirement is, of course, that the bank has enough money to repay you. This logic also applies to cryptocurrency exchanges. We need to see if the exchange's on-chain assets can cover user account assets in a 1:1 ratio; this ratio is called the "Reserve Ratio" (PoR = Platform Assets / User Assets × 100%).

Equal to 100%: Indicates the platform just has enough assets to cover user assets; Above 100%: Indicates the platform has more funds to cover payments and has some risk resistance. However, it's important to note that a higher reserve ratio does not necessarily mean a safer exchange; the two cannot be directly equated. For example, a sudden increase in the reserve ratio of a particular coin may be due to recent platform activities; Below 100%: This is a red alert! It indicates that the platform's holdings of that coin are insufficient to cover all users. Persistently being below 100% may suggest a run on the platform, or even an intentional cover-up of liquidity issues. However, because of this, many platforms may experience report interruptions during such times, which, in itself, is a risk signal.

Second, Which Coins Does PoR Cover: Does It Include Mainstream Coins? After all, our assets are not only staked in one coin. Mainstream coins such as BTC, ETH, USDT, and USDC generally account for 80% to 90% of user positions. The number of coins covered by PoR is an important indicator to evaluate the exchange's transparency and asset management capabilities. Taking OKX as an example, from initially covering 3 coins to now publicly disclosing 22 coins in PoR, it has essentially laid out users' major assets. Just the four coins BTC, ETH, USDT, and USDC alone represent over 66% of the platform's assets, while the 22 coins revealed in PoR constitute over 90% of the platform's assets. In other words, by just looking at these four coins, one can basically understand the security of the chosen platform.

Third, Reserve Cleanliness: That is, the proportion of non-platform coin assets to the total reserve, rather than counting on the platform's coin to "pad the numbers." Cleanliness is a key dimension in measuring the quality of exchange assets, directly reflecting the reserve's real value, liquidity, and risk resistance. Only when able to maintain an adequate reserve without relying on the platform's own token can an exchange prove genuine robustness. When evaluating the quality of an exchange's reserve, we can look at "cleanliness" in two ways:

Evidence by Individual Coin—The exchange issues PoR reports separately for each major coin (such as BTC, ETH, USDT, USDC, etc.), and as long as the reserve ratio for each individual coin is above 100%, it indicates that the coin is solvent. At this point, whether including the platform's own coin will not affect the judgment of the solvency of each mainstream coin.

Evidence by Total Assets—The exchange consolidates all assets (including the platform's coin) to provide an overall reserve ratio. In this method, if the platform's coin accounts for a high percentage, a setback in its price or liquidity could lead to a risk of the overall reserve becoming unable to be redeemed. Therefore, special attention must be paid to the proportion of non-platform coin assets in the total assets, that is, "cleanliness." Currently, most exchanges have included the platform's coin in PoR. Taking OKX as an example, although its PoR for individual mainstream coins has been maintained at above 100%, unaffected by OKB price fluctuations; when calculated according to the latest total asset method, its non-platform coin "cleanliness" is approximately 70%. This means that relying solely on BTC, ETH, USDT, USDC, and other highly liquid mainstream assets can support over 70% of the total user liability, truly achieving high transparency and risk resistance.

Fourth, Another Often Overlooked Point: The Reserves Trends of Mainstream Coins such as BTC and ETH. It most likely indicates that users or institutions are confident in the platform's security and liquidity. In recent times, OKX's ETH, BTC, and other mainstream coin reserves have shown an upward trend. For example, as of April 7, 2025, OKX's PoR report shows that the ETH in accounts has increased from 1,556,932 coins on October 8, 2024, to 1,770,686 coins, a growth of approximately 13.7%; BTC has risen from 126,082 coins on January 10, 2025, to 133,151 coins, an increase of about 5.6%, indirectly reflecting user confidence in the platform's security.

5. Percentage of Top 10 Mainstream Coins: Don't Let Low-Cap Coins Dictate the Game. The higher the percentage of the Top 10 mainstream coins, the healthier the Proof of Reserves (PoR) is, as these assets have strong liquidity, high stability, and can better support the platform's fund security under extreme circumstances. According to various PoR reports, in the current reserve structure of mainstream exchanges, the Top 10 coins by market cap account for over 80% of the total, while low-cap coins are kept between 10% and 20%, maintaining a healthy overall asset structure that meets users' expectations of high solvency. For example, as of April 7, 2025, the total value of OKX's Top 10 mainstream coins accounted for approximately 88.8% of the PoR.

6. The Frequency of PoR Report Releases Is Also Important: Not Just an Occasional Update. PoR reports usually reflect the asset situation at a specific point in time. The higher the frequency of PoR releases, the harder it is to conceal short-term liquidity issues or security risks that may arise on the exchange. Since the end of 2022, OKX has consistently released its PoR report monthly and has issued 30 consecutive reports as of April 2025. Additionally, each report is audited and verified by the blockchain security firm Hacken. This underscores why top-tier platforms like OKX repeatedly emphasize "monthly disclosure"—only through high-frequency and reliable audit updates can user confidence truly be enhanced and platform integrity maintained.

When evaluating an exchange's asset security, we must engage in data linkage, not solely relying on the exchange's self-published PoR reports. It is advisable to cross-verify information from multiple sources to make a more comprehensive and objective assessment. For instance, DeFiLlama's CEX Transparency module offers an overview of on-chain asset reserves for major centralized exchanges, serving as a vital external reference. Furthermore, in Nansen's "CEX Token Flow" section, one can observe real-time fund flows in and out of exchanges including Coinbase and OKX, capturing on-chain fund dynamics.

Previously, there have been instances of temporary anomalies in OKX's asset data on DeFiLlama, which were later found to be due to delayed third-party data fetching caused by address upgrades. Such events remind us that while third-party platforms are independent, they are also constrained by the timeliness and completeness of on-chain address identification. Additionally, there is a noticeable disparity between PoR data from some small to medium-sized exchanges and data from third-party on-chain monitoring platforms. If such discrepancies cannot be reasonably explained, further cautious investigation into the underlying reasons is necessary.

PoR data cannot be interpreted in isolation, and one should not take it lightly just because they see a "100%" or similar number. Only by combining on-chain tracking, third-party platform verification, and the exchange's own public mechanism can a more scientifically sound judgment on asset security be made.

Tools that Allow Users to Verify Exchange Data

While a platform may display its PoR, it does not mean it is absolutely trustworthy. When facing the ultimate question of "Once you deposit your money, is it actually there?" users need the ability to verify. Taking OKX's provided verification logic as an example, users only need to prove two points: first, prove the total user assets (account assets) are correct; second, prove the total platform on-chain assets (wallet assets) are correct, ultimately deriving the "reserve ratio."

For instance, if two users deposit assets into an exchange, one deposits 100U and the other 200U, making the platform's total liability 300U. The exchange's PoR needs to prove two things: that the total deposits from all (two) users are 300U and that the exchange wallet indeed holds 300U.

First step, total user deposit verification: OKX utilizes a zero-knowledge proof algorithm called "zk-STARK" to prove and verify all OKX account assets held by the exchange. OKX takes a "snapshot" of all user accounts and applies "constraints" using the "zk-STARK" algorithm. The first constraint is the "balance sum constraint," requiring the total asset amount to equal the sum of account asset balances; the second is the "non-negativity constraint," ensuring no negative assets are involved in inflating account balances artificially; the third is the "inclusion constraint," ensuring no accounts are left out.

Second step, exchange wallet asset verification: OKX has publicly disclosed a set of wallet addresses and signed a message with a private key stating "I am an OKX address," providing proof of ownership for these addresses. Anyone can then check the balances of these addresses on a blockchain explorer. Adding up these on-chain balances gives the actual total assets held by OKX.

Whether it's the three aforementioned constraints or the exchange wallet asset verification, OKX not only offers a detailed user self-verification guide for constant verification but also has made the PoR code open-source for the technical community to validate and use.

The PoR Scheme Itself Still Has Room for Iteration

OKX has been exploring a more secure underlying technological framework to prevent tampering or forgery of PoR report data. Since OKX introduced PoR based on the standard Merkle Tree in November 2022, upgraded to the full Merkle Tree V2 in March 2023, and subsequently pioneeringly introduced in-house zk-STARK zero-knowledge proof in April 2023, combining sum constraints, inclusivity, and non-negativity constraints to make the verification process more lightweight and open-source. Therefore, when evaluating any exchange's PoR report, in addition to focusing on the reserve ratio and user self-verification, one should also comprehensively consider its underlying technological implementation and evolutionary path to avoid overlooking potential tampering or audit vulnerabilities based solely on data metrics.

Why Upgrade to zk-STARK Technology? Traditional Merkle Tree proof schemes have vulnerabilities that allow CEX to act maliciously. The Merkle Tree is a common data structure used for reserve proof, where it hashes the balance of each account and organizes it into a tree structure to verify whether an account balance is included in the exchange's liability total. However, the traditional Merkle Tree has a critical flaw: it cannot prevent negative value nodes. If a centralized exchange (CEX) wants to act maliciously, they can create fake accounts and set their balances to negative values, making the reserve appear to match the liability, even though it does not in reality.

zk-STARK uses advanced encryption technology, and the generated proof is mathematically verifiable, with anyone able to verify its correctness. Most importantly, zk-STARK does not require a trusted setup. A trusted setup refers to a special process required to generate initial secret parameters in some cryptographic systems (such as zk-SNARK), and once the trusted setup is completed, all initial secret parameters need to be destroyed. If these initial secret parameters are leaked or manipulated, the security of the entire system could be compromised.

However, zk-STARK mitigates this risk. It is based on transparent encryption technology, and the entire process does not rely on any secret information or external trust, being completely decentralized. Users need not worry about platform black-box operations or potential vulnerabilities during setup. zk-STARK provides a truly "trustless" security guarantee and is currently the most secure solution in PoR.

How does zk-STARK address this issue? zk-STARK provides a mathematically strong assurance that can verify the authenticity and legitimacy of each account's balance. There are no hidden negative value nodes, ensuring that the net balances of all accounts are greater than or equal to zero. Additionally, the reserve total cannot be manipulated, and CEX cannot create a false impression of reserve matching through data manipulation. zk-STARK completely eliminates the vulnerabilities that traditional reserve proof may have, truly ensuring the security of user funds and preventing exchanges from deceiving users maliciously.

OKX Sustains Leading Trustworthiness and Transparency

In addition to adopting advanced zk-STARK zero-knowledge proof technology, OKX has also engaged a third-party independent audit firm, HACKEN, to provide users with additional trust assurance. Currently, Hacken's audit team verifies OKX's reserves on a monthly basis to ensure full coverage of on-chain assets against user liabilities, meaning the reserve ratio is at 100% or higher. Audit reports are made public and accessible to users at any time.

PoR is just one aspect of CEX security and cannot fully mitigate potential risks. When choosing a CEX, users should rely on PoR's on-chain asset verification capability and consider various factors such as governance structure, fund liquidity, and technical strength. OKX, relying on its consistent PoR release schedule, industry-leading zk-STARK innovative technology, and collaboration with third-party independent audits, has established a more trustworthy security line, truly achieving transparency and verifiability for users.

With its sustained leading trustworthiness and transparency, OKX is gaining the trust and preference of a wider global user base.

Disclaimer

The information provided in this video is for reference only and should not be considered or construed as (i) investment advice, trading advice, or an investment recommendation; (ii) an offer or invitation to buy or sell digital assets; or (iii) financial, accounting, legal, or tax advice. We do not guarantee the accuracy, completeness, or usefulness of such information. Digital assets (including stablecoins and NFTs) involve high risk and may depreciate or become worthless. Digital assets are not insured. Past performance is not indicative of future results. You should carefully consider whether trading or holding digital assets is suitable for you based on your financial condition, investment objectives, experience, and risk tolerance. For your specific situation, please consult with your legal, tax, and investment professionals. You are solely responsible for understanding and complying with relevant local laws and regulations.