What exchange reserve data shows, and what it hides

An exchange’s reserve figure, as DefiLlama publishes it and this site’s exchange pages repeat, is a sum: the balances at a list of blockchain addresses that someone has tied to the exchange, converted to dollars. It is a real measurement of real balances, read from a public ledger rather than taken on trust. It also covers one side of a balance sheet, through a list that can be wrong in both directions, in a unit that moves with price.

Where the number comes from

Two things produce the figure: a list of addresses said to belong to an exchange, and a rule for adding up what sits at them. Neither is as settled as a single dollar total suggests.

The list begins with what exchanges publish. DefiLlama’s methodology page for its exchanges dashboard, read on 3 October 2026 like the other sources cited here, says that it welcomes wallet addresses from exchanges as evidence it verifies, and does not accept their own reserve figures; the page does not say how the verification is done. The Methodology note on an exchange’s own DefiLlama page can then record where that exchange’s list came from. Binance’s note says the count includes the wallets named in Binance’s proof-of-reserves interface and the wallets backing its pegged tokens, and excludes its recovery-fund wallet. Several other notes name the exchange’s own disclosure as the source: a proof-of-reserves download, a repository the exchange maintains, a blog post, or a list the exchange handed over on a stated date. A few point elsewhere, and one says its addresses were “provided based on public information and verified activity”.

Where an exchange publishes nothing usable, the other route open to any tracker is inference from the chain itself. Meiklejohn and colleagues’ 2013 study of bitcoin is an early academic account of how that goes. Its first heuristic (section 4.3), that addresses spent together in one transaction share a controller, the authors call quite safe; its second, that a transaction’s change address is the sender’s, significantly less safe. Both kinds of error appear. Under the first, twenty clusters were tagged as one exchange, Mt. Gox, because, as the authors note, large services appear to spread their funds across a number of accounts, so a list built from any one would have missed the others. The second, even modified, merged an exchange, a payment processor, a wallet service and a marketplace, among others, into one cluster of 1.6 million keys (section 4.5).

That study concerns bitcoin in 2013, and DefiLlama’s pages do not say whether any of its lists were built this way: it shows what inference can get wrong, not what DefiLlama does. Either error carries straight into a total: an address missing from a list contributes nothing, an address wrongly on it contributes in full, and the total does not show which has happened.

The sum is a list of tokens priced in dollars. In DefiLlama’s open-source code for exchanges (the helper file cex.js in its adapters repository), an exchange’s entry is a set of addresses per chain; an entry that names no tokens is given a default list for the chain (Solana is handled separately), and a chain with no default list counts only its native coin. A balance in a token the code does not look for is not in the figure. This site’s pages value the balances found on the snapshot date at that day’s prices.

What the figure is meant to cover is stated on DefiLlama’s data definitions page: the assets an exchange holds in its own custody, excluding any that sit with a different custodian and are credited inside the exchange as collateral. The FAQ gives the reason. DefiLlama reads the figure as a sign of how much capital the market trusts an exchange with, and counting an outside custodian’s holdings could make an exchange look more trusted when its customers had in fact paid to keep their assets elsewhere.

The notes also record the limits of DefiLlama’s own coverage. One says it tracks only part of that exchange’s cold wallets; another, only bitcoin wallets above 0.1 BTC and Ether wallets above $100; another, that positions in DeFi protocols are not counted; another, that the exchange’s Ether validators are not tracked. Each is a balance that exists and is not in a total.

Assets without liabilities

The figure is the asset side of a balance sheet, and the pages that publish it say so. The note on this site’s exchange pages lists what it leaves out: customer liabilities, loans, off-chain assets, and anything held through a custodian under another name. DefiLlama’s own description of its exchange reserves page states that reserve assets do not include exchange liabilities. Solvency is a comparison between assets and what is owed, so a number with only one side in it has nothing to say about the comparison. What proof of reserves actually proves sets out the same gap for attestations, and it applies here unchanged: an exchange can hold a great deal and owe more. A large figure and a small one are both compatible with any position against liabilities.

The figure also cannot say whose assets they are. A wallet holding customer deposits, a wallet holding the company’s own money and a wallet backing a token the exchange issues are added together in the same way, and DefiLlama’s note for Binance counts the last of those. On a chain the three look alike. Whether customers hold a claim on particular assets or stand in a queue behind other creditors is set by contract and by law, which what happens to your crypto when an exchange fails works through, and what a provider is required to do about keeping customer assets apart from its own depends on what it is authorised for, as what a regulated exchange is regulated for sets out. The word “reserves” suggests assets set aside against what is owed. The figure does not show that any were.

A price series wearing a balance’s clothes

A reserves figure is units multiplied by prices, summed. Between two dates it can change because units moved or because prices did, and the total does not say which. An illustration with invented numbers: if 60% of a figure is held in one asset and that asset’s price falls 10%, with every other holding unchanged in dollars, the figure falls 6% and nobody has withdrawn anything. A holding in a token that targets a dollar contributes about the same number of dollars whatever the rest of the market does, for as long as the peg holds (what holds a stablecoin’s peg), so the more of a figure sits there, the less price moves it.

DefiLlama makes the same point about its own charts. Its data definitions page says that a protocol’s total can fall while deposits rise when prices fall, so the chart alone cannot show whether money is arriving or leaving. It defines USD inflows as each asset’s balance change between two days multiplied by the asset’s price, summed, and gives the case of a protocol held wholly in ETH: the total falls 20% with the price while the inflow stays at zero. That page defines the measure for protocols. DefiLlama’s exchange table has inflow columns for 24 hours, 7 days and a month, and the pages read do not define them separately for exchanges. The 7-day and 30-day changes on this site’s exchange pages are changes in the dollar figure, so they carry price in them.

There are three ways to separate the two. The first uses what the pages here show. Each exchange page lists its largest holdings by token in dollars; take what each holding’s price did over the same 7 or 30 days from any price source, weight it by that holding’s share of the figure, and the result is roughly the part of the change that price alone would produce. The weights are current ones, so the estimate is rough, but it is enough to tell a move that price explains from one it does not. The second is to read units rather than dollars, which the pages here do not show. DefiLlama’s API documents a per-protocol endpoint, which also serves exchange entries, as returning “breakdowns by token and chain”, and the response read on 3 October 2026 for one exchange carries token amounts alongside the dollar values. In that response the price implied by a token’s dollar value and its amount differs from date to date, so DefiLlama’s dollar history, and this site’s chart, are valued at each day’s prices. The third way is the inflow columns, with the caveat above.

One holding is not independent of the exchange. DefiLlama’s table carries two totals, Assets and Clean Assets, and its exchanges methodology describes clean reserves as holdings with the venue’s own token excluded. The pages on this site show the first, so the largest holdings by token can include the exchange’s own token where the exchange has one. The pages read give no reason for the exclusion where exchanges are concerned; the mechanism supplies one. A token an exchange issues is worth what the market will pay for it, and what the market will pay can depend on its view of that exchange, so the larger that holding is within the total, the more of the figure moves with the very thing it is offered as evidence about.

Snapshots and schedules

On a public chain such as Ethereum, a balance is observable at every block. Ethereum’s documentation describes the state its clients maintain as including account balances, and an archive node as a client configured to keep an archive of all historical states, where an ordinary full node caches only the past few (ethereum.org). Once an address is on a list, its balance at a past moment on such a chain can be read from the chain without asking the exchange. What a tracker keeps of that is coarser. DefiLlama’s FAQ says exchange assets update every hour; the history it serves for one exchange, read on 3 October 2026, is one point a day, with a few gaps; and the history on this site’s exchange pages is a dated snapshot, drawn as weekly points for the last two years and monthly points before that.

The difference from an attestation is the schedule. A point-in-time check can be arranged around, which is why it matters how often and on what schedule an attestation is made: assets that arrive before it and leave after it were present for the measurement. A series sampled often makes that harder, because a balance that appears for the count and then leaves has to survive in the record as a rise and a fall. The advantage is bounded by the sampling. A balance that sat there for a day or two would appear in DefiLlama’s daily series and could fall between the weekly points on this site’s pages.

Continuity is still not an audit. An address is on a list because the exchange or the tracker says it belongs to the exchange. The stronger form of attestation signs a message with the corresponding keys, which demonstrates control rather than asserting it, and a tracker’s list does not do that. The list may be incomplete, the figure carries no liabilities, and nobody independent has tested a set of books and put a name to the result. DefiLlama’s methodology for its exchange score states the sampling limit in its own words: reserves are point-in-time at best, and a venue moving funds between snapshots is not caught by the score.

What a sudden change means, and does not

A sharp fall in the line is a question. Several different events draw the same line, and the line cannot say which. Price comes first, by the method above: a fall that the prices of the largest holdings account for needs no movement of coins to explain it. After price, five candidates remain.

The exchange moved its holdings. Custody addresses change, and a tracker’s list may not follow at once. River, a bitcoin firm that holds client assets in custody and publishes a proof of reserves, announced on 31 March 2025 that it would move its cold storage to a new address over the following week. The notice gave the new address, said clients would see bitcoin move from the old cold-storage address to the new one, and said a new proof of reserves would follow the move. It added that River expected to change its custody address routinely, for reasons such as key rotation and upgrades to its custody architecture. On a tracker that lists only the old address, a move like that is a fall until the new address is added.

Customers withdrew. DefiLlama’s FAQ frames the figure as a reading of the market’s trust in an exchange, and its worked example of an exchange in difficulty is a run, with balances leaving the exchange’s wallets. Two checks help. One is where the balance went: to a few addresses that the exchange later lists, or to many that it does not. The other is whether withdrawals are still being processed, which the exchange’s own status notices speak to.

Theft. On 21 February 2025 Bybit published a notice saying it had detected unauthorised activity in one of its Ethereum cold wallets at about 12:30 UTC, during a routine transfer to its hot wallet, and that over 400,000 ETH and stETH had been moved to an unidentified address. It said that withdrawals were being processed. On 26 February the FBI published a public service announcement attributing to North Korea the theft of about $1.5 billion in virtual assets from the exchange on or about 21 February (DefiLlama’s hacks record lists it at $1.4B; see how crypto gets hacked). The announcement said that some of the assets had been converted to bitcoin and other virtual assets and dispersed across thousands of addresses on multiple blockchains. On a chart that is a step down, as a migration is. What differs is the aftermath: the destinations are addresses the release describes as operated by or closely connected to the attackers, and the release says the assets were still being converted and dispersed.

The tracker changed its list. An address added or dropped changes the figure on that day whatever the exchange did: a removal reads as an outflow and an addition as an inflow. Where a note carries dates, they show this. One records an exchange supplying wallets on 7 February 2023, new wallets on 14 July and a further one on 15 December of that year. Each is a day on which the set of addresses behind the figure changed, and the pages read do not say whether the series before such a day is recomputed.

The holdings moved outside the definition. By DefiLlama’s definition, assets held under a different custodian are not part of the figure, so a move of holdings to one lowers it, whatever happened to the assets themselves.

A sharp rise has mirror-image explanations: deposits, a list extended, a price rise. Read from the line alone, none of the five says whether the exchange can meet what it owes; the figure never could. In order of cost, check price, then the exchange’s own notices, then the tracker’s note and its dates, then where the balance went.

Reading a reserves page in order

The exchange reserves table holds the figures from the latest snapshot, and each row opens a page with the same layout. Read it in this order.

1. The total and its date. The figure is the sum of attributed balances at the snapshot date’s prices, and the page states the date. The rank among exchanges orders the size of the figure and carries no other meaning.
2. The change, in dollars or in units. The 7-day and 30-day changes are dollar changes. Separate price from flows, as above, before reading a move as customers or an exchange acting.
3. Composition, by token and then by chain. Note how much sits in the exchange’s own token, in dollar-pegged tokens and in any single volatile asset, because those decide how far price can move the total. The chain table shows where the listed addresses hold balances and cannot show balances at addresses that are not on the list.
4. Whether the exchange itself publishes addresses. Each page links to the exchange’s site. On DefiLlama’s own page for an exchange, the Methodology note names the source of the list for some exchanges and for others is a generic sentence about coins held in a protocol’s smart contracts; one exchange’s was the generic kind. A list the exchange publishes is its own assertion; a list with no stated source is the tracker’s assertion alone.
5. Then the four questions from what proof of reserves actually proves. Whether liabilities are included, whether a customer can verify their own inclusion, who attested and whether they signed, and how often. A continuous tracker speaks to the last one, in part, and to none of the others.

The figure is a first question about an exchange, which is how the pages themselves describe it. It shows how much sits at addresses someone has tied to the exchange, and how that has moved. What it cannot show, whether that covers what is owed, whose assets they are and whether the list is whole, decides more about holding assets there, and that decision is covered in exchange or self-custody.