How exchanges store crypto—and what proof of reserves cannot prove

Why it matters

Customers experience a balance in an account. Security depends on the whole chain from legal claim and internal ledger to keys, withdrawal approval and solvency.

Hot for movement, cold for exposure reduction

Hot wallets support deposits, withdrawals and operational liquidity through connected systems. Cold or hardware-isolated systems reduce direct online exposure and usually add approval and transfer friction.

A venue chooses an operating buffer and replenishment process. Too much hot liquidity increases exposure; too little can delay withdrawals. The ratio alone cannot prove good controls.

Blockchain addresses are not customer accounts

Many venues use omnibus addresses and track customer entitlements in an internal database. Segregated addresses can improve traceability but do not automatically establish legal segregation in insolvency.

Key control may use multisignature, multiparty computation, hardware modules and layered human approvals. The important facts are authorization, independence, recovery, audit logging and emergency governance—not the label alone.

What proof of reserves can show

A well-designed exercise can demonstrate control of specified addresses and let customers check inclusion in a liability set without revealing every balance. It can improve transparency relative to an unsupported assertion.

The Investor.gov bulletin warns that such reports may omit the complete liability picture, vary in scope and assurance, and are not equivalent to financial-statement audits. Assets can also be borrowed, pledged or moved outside the observation window.

Where large holdings live

A wealthy individual may use self-custody hardware, a professional custodian, a trust structure or a combination. An institution may add legal segregation, policy engines, independent approvals, insurance conditions, reconciliations and multiple trading venues.

Large investors often separate custody from execution and spread activity across venues to manage liquidity, counterparty limits and operational continuity. Complexity can reduce one concentration while creating more interfaces to govern.