Exchange security and proof of reserves

Two separate risks: someone breaking into your account, and the exchange itself failing.

Securing your exchange account

1. Use a unique, long password from a password manager, and a dedicated email address for crypto accounts.
2. Turn on strong two-factor authentication. A hardware security key or passkey is best, an authenticator app is next. Avoid SMS codes, which SIM swaps defeat.
3. Turn on the withdrawal allowlist (address book lock), so crypto can only go to addresses you've approved, with a delay for new ones.
4. Set an anti-phishing code if offered: a word the exchange includes in every genuine email.
5. Review devices, sessions and API keys occasionally, and delete any you don't recognize.
6. Only use the official app and site. Bookmark it. Search ads for exchange names are a favourite phishing route.
7. Know how to freeze your account. Most large exchanges have a "lock" or "disable account" option for emergencies. Find it now, not during an attack.

The other risk: the exchange itself

Crypto on an exchange is a claim on that company, not coins in your own wallet. It isn't covered by FDIC insurance, and if the exchange fails, customers can wait years in bankruptcy for partial recovery. That's the trade-off described in custodial vs. non-custodial wallets. Check that an exchange is registered and licensed where you live; see what is a crypto exchange?

What proof of reserves is

Proof of reserves (PoR) is a report an exchange publishes to show it holds customer assets. Typically it has two parts:

• Assets: the exchange shows it controls certain blockchain addresses (for example by signing a message with their keys) and adds up their balances.
• Customer balances: it publishes a cryptographic summary of all customer balances (a Merkle tree), so you can check that your own balance was included.

If assets equal or exceed customer balances, the exchange claims a reserve ratio of 100% or more.

What it doesn't prove

The US audit regulator, the PCAOB, warned investors on March 8, 2023 that proof-of-reserve reports:

• Are not audits, and aren't held to auditing standards.
• Likely don't address the exchange's liabilities, so an exchange can show plenty of assets while owing far more.
• Cover one point in time. Assets can be borrowed for the snapshot and returned the next day.
• Can't show whether the assets were borrowed or pledged as collateral to someone else.
• Say nothing about internal controls or governance, the things that stop staff from misusing funds.

In July 2023 the SEC's chief accountant added that such engagements "are neither as rigorous nor as comprehensive as a financial statement audit." So treat a good PoR as a minimum, not a clean bill of health, and check how often it's published and who did the work.

FTX: the example everyone learned from

FTX was one of the largest exchanges in the world when it collapsed in November 2022. Customers rushed to withdraw, withdrawals stopped, and FTX filed for bankruptcy on November 11, 2022. Customer deposits had secretly been used by its sister trading firm, Alameda Research. Founder Sam Bankman-Fried was convicted of fraud in November 2023 and sentenced on March 28, 2024, to 25 years in prison; prosecutors said customers had been defrauded of over $8 billion.

FTX published no proof of reserves. But even a snapshot of its wallets wouldn't have revealed the hidden debts and the customer money already lent out, which is exactly the gap the PCAOB describes. After FTX, many exchanges started publishing PoR reports. They're a useful step; they're not a guarantee.

If it happened to you

1. If your exchange account was taken over, use the exchange's account-lock option or contact it through the official app, secure your email first, then reset the exchange password and two-factor and remove unknown devices, API keys and withdrawal addresses.
2. If the exchange itself has frozen withdrawals or failed, follow only official notices and the court-appointed claims process. Ignore anyone offering to buy or speed up your claim through unsolicited messages.
3. Write everything down before anything gets deleted: wallet addresses, transaction IDs (hashes), website addresses, usernames, phone numbers, screenshots of chats, dates and amounts.
4. Report it to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. Reports are free. If funds land at a regulated exchange, law enforcement can sometimes freeze them, and speed matters. A local police report gives you a reference number for your bank or insurer.
5. Contact the exchange you sent from, and the receiving exchange if the blockchain shows one, through its official website or app (never a number or link from a search ad or a stranger). Ask them to flag the addresses and the transactions.
6. Expect a second scam. Victims are targeted again by fake "recovery" firms, fake lawyers and fake FBI agents. Real law enforcement never charges a fee. Read crypto recovery scams.

Need the steps in order? Use the emergency checklist for a compromised wallet or account.

Frequently asked questions

Where to next

Sources

1. Investor Advisory: Exercise caution with third-party verification/proof of reserve reports (PCAOB, March 8, 2023)
2. The potential pitfalls of purported crypto "assurance" work (SEC Chief Accountant, July 27, 2023)
3. Samuel Bankman-Fried sentenced to 25 years (US Department of Justice, March 28, 2024)

Written for beginners and checked against the sources listed. Last reviewed November 5, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.