Where the money sits: hot wallets, cold storage and what “proof of reserves” proves

What a deposit actually is

Crypto’s foundational property is that whoever holds the private key controls the coins. Everything else — balances, statements, dashboards — is bookkeeping on top of that fact.

So when you deposit anywhere, the coins genuinely leave you. They move to an address the operator controls, and your balance on their screen becomes a claim against them: a promise to send coins back when you ask. That is a different kind of object from the coins themselves, and the difference is invisible right up until it isn’t.

This is not an argument against depositing — the same is true of every bank account, and self-custody has its own well-documented failure mode of people losing their own keys. It is an argument for being precise about what you are holding, because the precision changes how much of it you should hold there.

Hot and cold, and why the split exists

Any platform paying withdrawals needs keys that a machine can sign with automatically. Keys reachable by an internet-connected machine are also reachable by whoever compromises that machine. This tension has no clean solution, so the industry manages it by splitting the money.

• Hot wallet. Online, automated, holds a deliberately small working balance — enough for normal withdrawal flow. This is the portion genuinely at risk from a breach, and it is sized on the assumption that one day it will be lost.
• Cold storage. Keys held offline, often on dedicated hardware in physical custody, moved only by a human process. Slow by design, because the slowness is the security.
• Multi-signature. Requiring several independent keys to authorise a move, so compromising one person or one machine is not enough.

Most famous exchange losses are a variation on the same story: too much in the hot wallet, or the cold process quietly bypassed for convenience until it was not a cold process any more. The architecture is well understood; the failures are operational.

What proof of reserves proves — and what it does not

After 2022’s collapses the industry converged on “proof of reserves” as the reassurance of choice. It is worth understanding precisely, because it is quoted far more often than it is examined.

A proof of reserves demonstrates that a platform controls certain assets, usually by signing messages from its addresses or publishing a Merkle tree that lets each user verify their own balance is included in a claimed total. That much is genuine cryptography and genuinely useful.

The limit is that a balance sheet has two sides. Reserves are the assets. Solvency depends on assets minus liabilities — what the platform owes everyone. A venue can prove it holds a billion and still be deeply insolvent if it owes two.

1. Assets alone: proves control at a moment. Says nothing about obligations.
2. Assets plus a liabilities attestation: much stronger, and much rarer, because liabilities cannot be proven cryptographically — they rest on the completeness of the platform’s own books.
3. Point-in-time versus continuous: a snapshot can be arranged. Borrowing assets to pass an audit and returning them afterwards has happened.

So the honest framing is that proof of reserves raises the cost of a particular lie. It does not make a platform safe, and treating it as though it does is how the reassurance becomes the risk.

The part that is actually in your control

You cannot audit a custodian from outside, and any article that suggests otherwise is selling something. What you can control is exposure.

1. Keep the platform balance to what you intend to play with. This is the whole defence, and it works regardless of how the platform is run. Winnings you have no plans for belong in your own wallet.
2. Withdraw early once, deliberately. Testing the withdrawal path with a small amount tells you more about a platform than any published document.
3. Treat account security as your job. Most individual losses are not exchange failures — they are compromised accounts. Two-factor authentication and a unique password do more for your money than any reserve attestation.
4. Check the network before sending. Custody arguments are irrelevant against a deposit sent on the wrong chain, which is often unrecoverable by anyone.

The general principle is the same one that applies to everything else on this site: prefer the safeguards that do not require trusting anybody. A published payout table you can check beats a promise about fairness; keeping your own coins beats a proof that someone else has some.