Bitget shipped its 47th monthly Proof of Reserves this week. The number at the top of the page is 131%. Nineteen asset classes. A trailing average above 120%. On a press release, this is the cleanest balance sheet in the exchange business.
I opened the announcement looking for one thing. Not the ratio. A string of sixty-four hexadecimal characters. The Merkle root โ the single hash that anchors every user's balance into one verifiable tree. It wasn't there.
Neither was the name of the auditor.
So before you read another paragraph of praise about "19 assets" and "131%," understand what you are actually holding: a number that Bitget computed, about Bitget, verified by nobody you can name. That is not a proof. That is a press release with a decimal point bolted onto it.
Context
Proof of Reserves did not exist as a mass-market ritual before November 2022. Then FTX collapsed, and roughly eight billion dollars of customer assets turned out to be a footnote in a balance sheet nobody could read. The industry needed an antidote to opacity, and it reached for the oldest tool in cryptography: the Merkle tree.
The idea is elegant. Every user's balance becomes a leaf. Leaves are hashed in pairs, pairs are hashed again, and the cascade bottoms out in one root hash. Publish the root, and any user can prove their own balance is inside the tree without exposing anyone else's data. It is the closest thing centralized finance has ever produced to a self-audit.
Bitget has been running this ritual monthly since roughly December 2022. The 47th iteration places it near the front of the pack on cadence โ only a handful of exchanges publish on a strict monthly clock. In September 2024, Bitget expanded coverage from four asset classes to nineteen. That expansion is the only genuinely new technical fact in this entire disclosure. Everything else is a repeat.
Here is the trap. "Covering more assets" and "covering more liabilities" are different claims that sound identical in a headline. The first is a breadth metric. The second is the thing that actually bankrupts an exchange. Bitget is selling you the first and letting you assume the second.
I have audited contract code by hand. In late 2017 I spent six weeks inside the 0x Protocol v2 repository, and I found three re-entrancy vulnerabilities that nobody had flagged. The lesson from that work was not that I was clever. It was that the gap between what a project claims and what its code does is where every disaster lives. So when an exchange hands me a transparency report, my first instinct is not to read the summary. It is to look for the parts that were left out.
Core
A credible Proof of Reserves needs three pillars. Bitget's 47th disclosure stands on one of them, wobbles on the second, and is missing the third entirely.
Pillar one: a named, independent auditor. Missing. The announcement references no audit firm. This matters more than it sounds, because the auditor is the only party in the whole structure with an incentive to find bad news. The industry's recognized names โ Armanino, Mazars, Hacken, and a short list of others โ shrank sharply after late 2022, when Mazars paused its crypto attestation practice and Armanino pulled back. That contraction is real. But it is not an excuse. OKX and Binance both name firms. If Bitget had an attestation from a firm a reader would recognize, the name would be the loudest word on the page. Its absence is a signal, not an oversight.
Pillar two: a Merkle tree with a user-verifiable leaf. The mechanism is claimed. The verification path is not shown. Here is what a real proof requires โ and what is missing:
# What a user actually needs to self-verify
root_hash = ??? # not published in Bitget's disclosure
my_leaf = hash(balance + salt + user_id)
sibling_hashes = [...] # the path from my leaf to the root# The check the user runs locally: node = my_leaf for sibling, side in path: node = hash(node + sibling) if side == 'right' \ else hash(sibling + node) assert node == root_hash # <-- impossible without the root ```
Look at that last line. Without the published root hash, the user cannot run the check. The "Merkle tree" becomes a word in a document rather than a mechanism in a browser. You are told a tree exists. You are never handed the branch to climb it. Code doesn't care about your feelings, and it also doesn't care about your press release โ it only accepts a matching hash.
Pillar three: liability-side completeness. Absent, and this is the structural flaw that no amount of cadence fixes. Proof of Reserves, as practiced by nearly every CEX, proves the asset column. It is silent on the liability column โ the sum of what the exchange owes depositors. An exchange can prove it holds X in BTC while quietly owing 1.4X in BTC to users across margin, futures, and internal transfers that never touch the published snapshot. Proving assets without proving liabilities is like a bank publishing its vault inventory while refusing to show its loan book.
Now the number itself. The 131% figure has no disclosed calculation method, and the method is where the risk hides. Is it a simple average across nineteen assets? A weighted average? Weighted by what โ token count, or USD value? Consider the difference. Suppose Bitget holds BTC at 180% and a major stablecoin at 94%. A simple mean across the basket can print a comfortable "131%" while one of the most systemically important assets on the books is under-reserved. A blended ratio is a statistical laundering machine โ it lets one over-funded asset camouflage one under-funded asset, and the headline stays green. Until Bitget discloses per-asset reserve ratios and the weighting formula, 131% is an un-auditable average of numbers you cannot see.
Then ask what is inside the reserves. The disclosure does not break down the asset composition. This is not a small omission. If a meaningful slice of that 131% is Bitget's own BGB token, the "over-collateralization" is circular โ the exchange is backing customer deposits with an asset whose value it controls and whose liquidity it depends on. FTX did exactly this with FTT, and FTT's collapse is what turned a liquidity problem into a bankruptcy. Yield is the bait, rug is the hook โ and a self-issued token in the reserve column is the hook wearing a promise. A reserve that cannot be sold at the quoted price in a stressed market is not a reserve. It is a valuation.
Compare the field. OKX has been building toward zk-STARK-based reserves, which allow cryptographic proof of solvency properties without trusting the exchange's own arithmetic. Binance publishes against a recognized audit relationship and the largest balance sheet in the sector. Kraken is known for audit rigor over cadence. Bitget's differentiation is breadth โ nineteen assets โ not depth. And breadth is the cheapest thing to buy. Adding asset classes to a disclosure is an engineering task measured in days. Adding zero-knowledge provability, or a liability commitment, is a task measured in quarters. One of these shows up in a marketing cycle. The other shows up in a technical roadmap. Guess which one this press release is.
Contrarian
Here is the part the timeline gets wrong. Everyone treats a high, frequent reserve number as reassurance. The opposite reading is defensible: the louder and more regular the announcement, the more it may be compensating for something the exchange cannot show. Forty-seven monthly reports is not a security guarantee. It is a content calendar. Frequency is a marketing cadence dressed in the language of auditing.
The market has already figured this out, even if it cannot articulate why. Two years after FTX, CEX transparency news moves nothing. The reserves narrative is in its decline phase โ the attention has migrated to restaking, RWA, and AI-agent trading. Panic sells, liquidity buys, and right now there is no panic in a monthly PoR, so there is no liquidity event to trade. A single disclosure like this has an expected price impact near zero. Anyone telling you the 131% is bullish for BGB is selling you a narrative hook, not a fundamental.
And the deepest counterintuition: Proof of Reserves was never designed to prove solvency, because solvency is a flow and PoR is a stock. Solvency is whether an institution survives a run โ whether it can meet withdrawals on a Tuesday afternoon when half its depositors want out at once. A 131% snapshot at 23:59 UTC says nothing about the 131% at the next bank run. It is a photograph of a river. The water has already moved.
This is why the FTX lesson keeps getting misread. FTX also showed healthy reserves right up until it didn't. The failure was never in the asset snapshot. It was in governance, in fund segregation, in private-key control, in the flow between customer money and the trading desk โ none of which a Merkle root can touch. PoR is a patch, not a replacement, for the thing it is pretending to fix.
Takeaway
Treat the 131% as an unverified input, not a safety certificate. The signals that would actually change my assessment are specific and trackable: a named audit firm on the disclosure page; a published Merkle root with a working user-verification tool; a per-asset reserve breakdown that shows whether BGB sits in the collateral; and any movement toward liability-side proof or a zk-based scheme like OKX's. Watch the next monthly window for the auditor name. Watch the whole sector for the liability commitment โ that is the real frontier, and whoever ships it first redefines the game.
Until then, the arithmetic is simple. A number computed by one party, about itself, checked by no one, is a claim. Not your keys, not your coins โ and not your reserves either, no matter how clean the ratio looks on a Tuesday.
