On page one of Kraken's proof-of-reserves disclosure covering its June 2026 snapshot, the exchange publishes two exhibits: a schedule of wallet addresses and balances it controls, and a schedule of customer liabilities derived from its internal ledger. Two tables. Two totals. One implied subtraction.
The ratio that follows โ the number that gets screenshotted, quoted, and reposted as though it carried the weight of a credit rating โ is arithmetic performed by the reader. It is not a conclusion certified by anyone. That layout is simultaneously the most honest thing in the document and the most thoroughly overlooked. And before any of it can be discussed, one field has to survive a basic procedural check: the snapshot date itself, which in the copy under review reads as June 2026. A forensic process begins with chain of custody. If the timestamp cannot be reconciled against publication and attestation dates, every downstream judgment about currency and relevance inherits the error.
Set the timestamp question aside for a moment and something more interesting surfaces. The document's real contribution is not evidentiary. It is taxonomic. It forces four concepts apart that the industry has spent a decade welding together: whether your balance is included in the liability total, whether the addresses are genuinely under the firm's control, whether assets exceed liabilities on a complete basis, and whether you can actually withdraw. Four links in a chain. No link implies the next. That is the entire finding, and it is bigger than Kraken.
The decade spent proving the wrong proposition
Kraken was early to this format. Merkle-tree reserve commitments date back to 2014, when a handful of exchanges โ Kraken among them โ began publishing address lists and liability roots as a gesture toward transparency. The gesture was never formalized. No standard emerged for what a leaf should contain, which accounts must be enumerated, how affiliate balances should be treated, or what an auditor's signature on such a document would even mean. For eight years the practice remained decorative.
Then November 2022 happened, and proof of reserves was drafted into service as a fraud-detection instrument. Within weeks of FTX's collapse, every major exchange published something. The rush produced the format's most instructive failure: the Mazars engagement with Binance, an agreed-upon-procedures report whose own disclaimer stated that the firm had not evaluated the completeness of liabilities. Readers saw a logo and a number. The disclaimer said the number meant less than nothing without scope. Both were true simultaneously, and the second was ignored.
That episode taught the industry a lesson it learned incorrectly. The lesson taken was that assurance providers are a reputational liability and should be replaced with cryptography. The lesson available was that a report without an enumerated scope is a press release with a checksum.
There is a structural reason for the confusion. Attestation, audit, and proof are three different instruments with three different burdens of proof. A financial statement audit expresses an opinion on whether statements are fairly presented, under a framework, with materiality thresholds and going-concern language. An agreed-upon-procedures engagement reports factual findings without any opinion at all โ the accountant performs specified tests and disclaims everything else. A cryptographic proof establishes a mathematical relation between committed data and a root. The first is expensive and slow. The second is cheap and hollow. The third is precise about a narrow thing and silent about everything adjacent. Proof-of-reserves disclosures routinely borrow the credibility of the first while delivering the third, with the second's disclaimer buried in an appendix.
There is also the decay problem, which is not a flaw anyone can fix. An exchange balance sheet is not a stock photograph. It is a running process. Customer deposits arrive and leave continuously; hot wallet floats are rebalanced hourly; collateral is posted and recalled; lending desks move inventory between venues. A snapshot at 23:59 UTC on a given date is a frame from a film, and the reader has no way to know whether that frame sat on an ordinary Tuesday or two hours before a large client's withdrawal. When liquidity is finite and imagination is not, the frame always looks better than the film.
So why publish at all? Three reasons, none of them epistemic. Marketing, because a ratio above one is a billboard. Regulatory drift, because jurisdictions are beginning to gesture at reserve disclosure without yet defining it. And counterparty confidence, because institutional clients ask, and "we publish a Merkle root" is a cheaper answer than a full audit. None of these reasons require the document to answer the question a depositor actually has. Which is: if I asked for my money now, would I get it?
Layer one: inclusion is not completeness
The liability side is built from a Merkle tree. Each customer account becomes a leaf containing an identifier and a balance; the leaves are hashed pairwise up to a root. If your leaf is in the tree, you can verify that your balance was included in the aggregate. This is a genuinely useful property, and it is the one thing in the entire document that a user can check independently.
Now enumerate what the construction excludes by default. Sub-accounts, unless explicitly flattened. Margin and derivatives accounts, where the customer's claim is on unrealized profit and loss and posted collateral rather than on a spot balance โ a category for which "balance" is not even well defined. Borrow-and-lend positions, where the customer's relationship to the exchange is a receivable or payable, not a deposit. Accrued but unsettled trades. Pending withdrawals in the queue. Fiat held at banking partners, which is off-chain and outside any Merkle tree. Custody arrangements for other institutions. Balances of affiliated entities, which may be liabilities of one legal person and assets of another, and whether they net or gross is a question the reader cannot answer.
The aggregate can be mathematically immaculate and economically incomplete at the same time. This is where my own history shapes how I read these documents. In 2017, working through 45 whitepapers from projects that had each raised more than $2 million, I almost never found arithmetic errors. The numbers added up. What failed was the assumption layer โ supply schedules that implied a terminal inflation rate the team had never calculated, vesting cliffs whose dilution was never modeled, bonding curves whose parameters guaranteed insolvency at a predictable date. The math was fine. The frame was wrong. Proof-of-reserves documents fail in exactly that register.
Here is the asymmetry that matters, and it is the one most commentary misses. Liability completeness is a negative claim: not merely "these balances are included" but "no material liability class is excluded." Proving a negative from outside the firm is close to impossible. I can audit a hash. I cannot audit a chart of accounts I have never seen. The only external evidence of completeness is a named assurance provider making an explicit scope representation โ and in the version of this disclosure I reviewed, no such provider appears and no such representation is made. That is not an accusation. It is an observation about the document's ceiling.
Layer two: control is not custody
Logic does not bleed, but code leaves traces. The asset side leaves traces in a way the liability side never will, which is why it deserves harder scrutiny rather than softer.
The standard technique is address ownership proof: the exchange signs a message with a private key associated with a listed address, demonstrating control at that moment. The proof is real. It is also narrowly bounded. A signature establishes possession of a key. It says nothing about encumbrance โ whether the assets behind that address are staked, lent out, posted as collateral against a loan, deposited into a liquidity pool, wrapped into a liquid staking derivative, or promised forward under an OTC agreement. An address that holds a billion dollars of a token and has borrowed eight hundred million against it shows as a billion on the asset schedule. Economically it is a leveraged position.
Some of this is visible on-chain, and this is where my 2021 work becomes directly applicable. When I spent three months reconstructing volume for a top-tier profile-picture collection claiming a billion-dollar market cap, the finding was not that the trades were fake in a technical sense โ they settled, they paid gas, they were irreversible. The finding was that roughly 60 percent of reported volume traced to a single wallet cluster cycling assets through itself. The tokens were real. The demand was not. Volume is noise; the wallet cluster is signal. The same discipline applies here: an exchange's disclosed addresses can be examined for DeFi positions, staking contracts, lending protocol deposits, and outbound transfers to venues. What the schedule reports as a balance may be a claim on a protocol, not a coin in a vault.
The distinction the industry collapses is between legal title and beneficial ownership, and between ownership and availability. Rehypothecation โ lending out customer assets โ is legal in many jurisdictions under specific conditions and catastrophic in others under no conditions at all. A reserve report that lists addresses proves the first link. It does not touch the second. Gas fees are the price of truth: a signature costs nothing, an actual transfer costs something and leaves an irreversible trace. A firm that signs and never moves has demonstrated key possession. It has not demonstrated that the assets are free.
Layer three: solvency is a valuation argument wearing a percentage
Assets exceed liabilities. The subtraction is trivially checkable once both sides are accepted. The problem is that accepting both sides requires three commitments the document cannot supply: that liabilities are complete, that assets are correctly valued, and that both are denominated in the same unit of account with the same liquidity assumptions.
Valuation is where this breaks hardest, and I have spent enough time inside a depeg to be unfashionably strict about it. During the Terra collapse I retreated for four weeks and modeled the feedback loop that destroyed forty billion dollars of nominal value โ not the price chart, the mechanism. What that exercise produced, more than any trading insight, was a permanent suspicion of mark-to-market accounting for assets that cannot be sold at the mark. An illiquid token valued at the last trade is valued at the last trade of a size nobody needs to move. Scale that mark to an exchange's entire position and the number becomes fiction with a decimal point.
The stress test is a haircut schedule, and almost nobody publishes one. Take the long tail of an exchange's listed assets โ the tokens with thin order books, the governance tokens in treasury, the venture positions marked at the last funding round โ and apply a 30, 50, 70 percent discount depending on depth. Then recompute the ratio. In every disclosure I have reconstructed, the headline ratio survives the top ten assets and deteriorates sharply past them. The deterioration is not fraud. It is the ordinary difference between book value and realizable value at scale, and it is invisible in a document that reports one number.
There is a second mismatch, structural rather than accounting. Liabilities to customers are payable at par, on demand, instantly. Assets liquidate over days, at a discount, into a market that moves against the seller. That is maturity transformation โ the same function banks perform, with the same fragility, and with none of the same prudential machinery. A proof-of-reserves report is a point-in-time stock measure applied to a flow problem. It answers whether the firm was solvent at a moment. It cannot answer whether the firm remains solvent under a withdrawal rate it has never disclosed.
Layer four: withdrawal access is not a cryptographic property
And here the chain ends, because the last link cannot be evidenced by the instrument at all.
Withdrawal access is behavioral and operational. It depends on the hot wallet float available at the moment of request, the banking partners that settle fiat and their hours and their risk appetite, compliance holds and re-verification triggers, jurisdictional restrictions, per-day and per-account limits, and the firm's willingness to release funds under stress. None of these are cryptographic. All of them can fail while reserves are fully intact. A solvent exchange with a thin float and a slow fiat rail can gate withdrawals for a week without a single satoshi going missing โ and during that week, for the depositor, solvency and insolvency are indistinguishable.
This is exactly the boundary I ran into auditing an AI trading platform in 2026 that lost fifty million dollars to prompt injection. The failure was not a broken signature. Signatures verified perfectly. The failure was that unverified model output was interpreted as a valid contract command โ the system proved the mechanism and never checked the authority. A withdrawal proof has the same shape. Confirming that a transaction could be signed is not confirming that it will be authorized, queued, processed, and settled within a period the customer can survive.
The only instrument that measures this is telemetry, and it is the one nobody publishes: median and 99th-percentile withdrawal latency, published continuously, segmented by asset and by rail, covering both fiat and crypto, over a rolling window long enough to include a stress event. That dataset would say more about an exchange's real health than any Merkle root ever constructed. Its absence is not an oversight. It is the disclosure that would actually be costly.
The methodological error both sides make
Here is the part that separates a real critique from commentary.
The two central claims in circulation โ that liability inclusion is insufficient and that asset control is insufficient โ are symmetrical in rhetoric and profoundly asymmetrical in evidence. Asset availability is partially verifiable from outside: I can inspect addresses, trace DeFi positions, look for staking contracts, follow outbound flows to lending venues. Liability completeness is essentially unverifiable from outside: I can only rely on scope statements and independent assurance. Treating both with identical force is a simplification, and it flatters the critic while telling the reader nothing actionable. The honest formulation is narrower and harder: one side of the balance sheet is inspectable, the other is taken on trust, and the trust side is the side that determines solvency.
Verdict on the document itself: directionally correct in its taxonomy, thin in its evidence. The framework holds. The specific claim that this particular disclosure is unusually weak does not, because no baseline has been established against a peer, no scope statement has been produced, and no assurance opinion has been located. Without those, the critique lands on the format, not the firm.
What the defenders get right
It would be intellectually cheap to leave this as an indictment, and intellectually cheap is a failure mode I try to avoid.
The strongest case for proof of reserves is that it eliminates a specific, recently demonstrated class of fraud: a firm claiming assets it never held. FTX's balance sheet was not merely illiquid; it was fabricated. A reserve disclosure with signed addresses cannot be fabricated the same way, because a signature is not a press release. Against that benchmark, the instrument performs. It is a fraud detector, and it detected nothing here, which is a data point in Kraken's favor rather than against it.
Kraken's own record matters too. It was publishing when publishing was unfashionable, and it has navigated multiple industry-wide stress events without a withdrawal freeze of the kind that defines reputational death. If the framework critique applies equally to every exchange that publishes a Merkle root โ and it does โ then presenting it as a Kraken-specific finding is a category error dressed as skepticism.
And the alternative is not obviously better. Full financial statement audits are also snapshots. They also carry materiality thresholds, they also rely on management representations about completeness, and they also say nothing about withdrawal latency. Demanding "a real audit" instead of "a proof" swaps one point-in-time instrument for another and calls the substitution rigor. The rug is not pulled; it was never tied โ the scope was never defined, so there was never anything to violate. That is a criticism of the standard, not of the company meeting an undefined one.
What to demand instead
Three things, and none of them are cryptographic.
First, a scope statement enumerating which liability classes are included โ spot, margin, derivatives, lending, fiat, affiliate, custodial โ with an explicit list of exclusions. Second, an asset schedule with classification and haircuts, distinguishing between assets held outright, assets encumbered, assets staked, and assets loaned, valued at realizable rather than marked price. Third, continuous withdrawal latency telemetry, because that is the only metric that measures the thing depositors actually care about.
The direction of travel makes this more urgent, not less. As tokenized treasuries, restaking derivatives, and agent-executed flows enter exchange balance sheets, the distance between what can be attested and what can be realized will widen. A cryptographic proof of a leveraged, illiquid, partially encumbered position is not a weaker proof. It is a precise proof of a misleading number.
So the question is not whether Kraken's reserves exceed its liabilities. The question is which of the four links in that chain the next disclosure will finally choose to certify โ and whether anyone will notice if the answer is still the first one.