Proof of reserves at a crypto casino: what the evidence does not prove

Short answer

A reserve claim is only as strong as its scope, liabilities and date

A block explorer can show coins at an address. It cannot identify every beneficial owner, every debt or every contractual claim against those coins. Proof of reserves becomes useful only after the publication explains which legal entity is reporting, which assets and wallets are included, how control was tested, when the observation occurred, what player liabilities were counted and which procedures an independent provider performed.

The PCAOB Office of the Investor Advocate warns that proof-of-reserve engagements are not financial-statement audits and may not address liabilities, customer rights, borrowed assets, later asset movement, internal controls or governance. Its advisory tells customers to use extreme caution before concluding that assets are sufficient to meet customer liabilities.

This guide applies that caution to a crypto casino. It does not assume that a casino with no public PoR is insolvent, and it does not certify one that publishes wallet balances. The conclusion may simply be that the available material proves a narrow asset snapshot while solvency and player-fund protection remain unverified.

Keep reserve evidence separate from custody design. The casino custody guide explains internal balances and key arrangements. This page evaluates whether published financial evidence supports claims about assets and obligations.

Asset perimeter

Start with the wallets, custodians and asset types actually included

A report should list covered assets and how each balance was obtained. On-chain assets may be tied to public addresses; custodial balances may require direct confirmation from the custodian. Fiat, receivables, tokens on other chains and operational accounts can fall outside a crypto-address list.

Check whether the reporting entity selected the wallets. Management-selected addresses create a completeness problem: the verifier may confirm everything supplied without knowing whether omitted wallets or negative accounts exist. The methodology should describe how completeness was tested.

Values also need a pricing policy. A token quantity is observable on-chain, but a headline dollar value depends on price source, timestamp, liquidity and haircuts. Thin or related tokens can make an asset total look larger without providing equivalent withdrawal liquidity.

Do not add unrelated company assets to customer reserves unless the legal report includes them and explains availability. Assets owned by an affiliate may not be accessible to the casino entity.

Keys and custody

Existence at an address is not the same as control by the operator

A wallet balance proves that a blockchain records assets at an address. It does not identify the person who controls the private key. A credible procedure might require a signed message, a challenge transaction, direct custodian confirmation or another test linked to the legal entity.

The test itself needs a date and safeguards. Sending assets briefly can demonstrate access but not sole beneficial ownership. Multisignature arrangements may involve several parties, and a custodian can control keys while the casino has a contractual claim.

Never ask a casino—or any user—to reveal a seed phrase or private key as proof. New Zealand’s Own Your Online guidance emphasises secure wallets and protection from theft; reserve verification should test control without publishing recovery secrets.

Control also does not prove freedom from liens. The entity could control an address while having pledged the assets or owing them to another party.

Snapshot risk

The observation timestamp is not a continuing balance guarantee

Most PoR evidence concerns a point in time. Record the timezone, block height, custodian confirmation date and liability snapshot. Asset and liability observations should be aligned closely enough to make the comparison meaningful.

Assets can be moved, lent, lost or withdrawn after the snapshot. The PCAOB advisory specifically warns that a point-in-time report provides no assurance that assets remain available later.

Look for reporting frequency and historical archives. Regular publication can show a pattern, but repeated snapshots still do not prove what happened between dates. Continuous dashboards need independent controls over feeds and address lists.

A report without a clear observation time cannot support a dated ratio. Marketing that says “always fully backed” requires stronger evidence than one old page.

The missing denominator

Assets cannot be evaluated without complete obligations

Customer balances are liabilities from the operator’s perspective. A reserve ratio needs both numerator and denominator measured under defined rules. Assets of 100 units say little if obligations are unknown.

Check whether liabilities include withdrawable cash balances, unsettled wins, pending withdrawals, jackpots, locked deposits, bonus funds, affiliate amounts and negative accounts. Some categories may be excluded for legitimate reasons, but exclusions need explanation.

Completeness is the central problem. A verifier may recalculate a supplied file without proving that every account and database was included. The methodology should explain population extraction, duplicate accounts, dormant users and reconciliation to the general ledger.

Other corporate liabilities also matter to solvency even if they are outside a player-balance Merkle tree. Taxes, loans, supplier debts, litigation and operating expenses can compete for assets unless legal segregation protects customer property.

Inclusion proof

A Merkle proof can show inclusion without proving completeness

A Merkle tree can commit to many account balances while allowing a user to verify that a hashed record was included without seeing every other account. That is useful privacy-preserving evidence.

Inclusion does not prove that every customer is in the tree, that balances were calculated correctly or that the tree corresponds to the operator’s full ledger. A user can verify their leaf while omitted accounts make total liabilities look smaller.

The publication should explain snapshot time, balance definition, treatment of negative balances, hashing format and how users obtain their leaf. Independent reproduction instructions make the result more useful.

A Merkle root is not an auditor opinion. It is a cryptographic commitment to a dataset whose origin and completeness still need assurance.

Rights over assets

Borrowed, pledged or rehypothecated coins can inflate apparent reserves

The PCAOB notes that PoR procedures may not reveal whether assets were borrowed for the engagement. A balance can appear at the snapshot while another party retains a claim or expects repayment.

Look for disclosure of loans, liens, pledges, security interests, rehypothecation and related-party transfers. A public chain does not display every off-chain contract.

Unencumbered should be supported by legal and accounting evidence, not merely asserted beside a wallet address. Custodian confirmation can also identify restrictions where the custodian holds assets.

Sudden large inflows immediately before a snapshot and outflows after it deserve explanation, but transaction timing alone does not prove borrowing. Report the pattern and evidence limits rather than making an accusation.

Legal structure

Fund segregation is different from showing enough assets

Segregation asks whether customer property is held apart from operational funds and protected from use for expenses or creditors. A reserve ratio can exceed 100% while assets remain commingled.

Read the terms and legal structure. “Cold storage” describes a security arrangement, not necessarily a trust, statutory protection or bankruptcy-remoteness. A separate wallet can still belong to the operating company.

Evidence can include account titles, trust documents, custodian agreements, regulatory requirements and audited financial disclosures. Marketing phrases are not substitutes.

If segregation is not documented, say so. Do not infer legal priority from a label such as customer wallet.

Procedures performed

Read the methodology and exceptions, not only the conclusion

Identify who chose the procedures, who performed them, the standard used and the level of assurance. Agreed-upon procedures report factual findings for selected tests and do not express an opinion that the procedures were sufficient.

Check sampling, confirmations, address ownership tests, liability extraction, pricing, exclusions and subsequent-event work. An impressive asset total can rest on a narrow engagement.

Read qualifications and exceptions. A mismatch that management later adjusted is part of the evidence, not a footnote to omit. Scope limitations can prevent a broad conclusion.

Download the complete signed report from the provider or operator and confirm it has not been replaced by a marketing summary.

Assurance language

An accounting-firm logo does not turn PoR into a financial-statement audit

The PCAOB advisory states that PoR engagements are not audits under PCAOB standards and do not provide meaningful assurance equivalent to one. The provider may be an accounting firm, but the engagement type still controls.

Look for “audit”, “review”, “examination”, “limited assurance” or “agreed-upon procedures” and read the governing standard. Do not rewrite one term as another.

Independence, competence and the identity of the signing entity matter. Verify the report on the provider’s official site where possible and check whether management can choose what to publish.

A full financial-statement audit can address broader balances and controls, but it also has scope and date limits. PoR can supplement it; neither should be described as an unconditional payout guarantee.

Asset-by-asset reconciliation

Coverage must include networks, wrapped assets and fiat obligations consistently

Bitcoin on one network, wrapped Bitcoin on another and an exchange IOU are different assets. The reserve schedule should map each customer liability to eligible reserves and avoid double counting.

Stablecoins carry issuer and depegging risk. Counting one unit as one dollar requires a pricing and eligibility policy. Operator-issued tokens deserve particular scrutiny because their liquidity can depend on the same business.

Network choice matters. The same ticker can exist on multiple chains; addresses and block heights should identify which balance was observed.

If the report covers only selected large assets, the headline should not imply full-casino coverage. Publish the covered percentage or say it is unknown.

Operational reality

A successful withdrawal test is useful but not solvency evidence

One completed withdrawal shows that the operator processed one request at that time. It does not prove capacity to meet all customers in a run or that balances are segregated.

Withdrawal delays can arise from KYC, fraud review, network congestion or operational controls. Reserve assets can exist while a contractual dispute remains unresolved.

Aggregate wallet outflows may show activity but not whether all requests were honoured. Without internal account data, the observer cannot map every transaction to a liability.

Keep payment performance in operator reviews and use PoR only for the financial evidence it actually supplies.

Claims in failure

Reserve visibility does not establish bankruptcy priority

Insolvency outcomes depend on legal ownership, custody contracts, segregation and jurisdiction. Coins visible at an address may belong legally to the company, customers, a custodian or secured creditor.

A 100% snapshot does not prevent losses from hacking, fraud, market movement, operational expenses or claims arising later. It also cannot prove management controls.

Read terms for ownership of deposited assets and rights of set-off. Seek professional advice for a real dispute; this guide is not legal advice.

The safest editorial conclusion is conditional: asset evidence can reduce one information gap while leaving insolvency protection unresolved.

Security boundary

Do not expose keys to make reserves more transparent

Proof should use public addresses, signatures, challenge transactions or custodian confirmations. Publishing a seed phrase, private key or recovery file would destroy security.

Own Your Online advises protecting digital wallets and being alert to scams. The same boundary applies when evaluating casino reserve claims: verify public evidence without surrendering credentials or connecting a wallet to an untrusted checker.

Beware of fake PoR portals that request a seed phrase, wallet import or transaction approval. Inclusion checks should not require authority to move funds.

Security and solvency are separate. Strong key management can protect an inadequate reserve; sufficient assets can still be lost through weak controls.

Worked comparison

Why 120 coins against 100 player coins may still be incomplete

Suppose an operator shows 120 coins at named addresses and a Merkle root totalling 100 coins of player balances. The headline ratio is 120%. First verify address control and aligned snapshot times.

Next ask whether all player accounts, pending withdrawals and relevant assets are included. Check whether negative balances reduced the liability total and whether any coins were borrowed or pledged.

Then examine legal segregation and other corporate obligations. If the 120 coins are commingled and available to creditors, the ratio does not prove player priority.

The evidence can support a narrow statement—specified assets exceeded specified liabilities at the snapshot—without supporting “all withdrawals guaranteed”.

Warning signs

Reserve claims weaken when scope and reproduction are hidden

Warning signs include no date, no legal entity, screenshots instead of addresses, an unnamed verifier, no liabilities, inaccessible methodology, self-issued tokens at optimistic prices and a badge that cannot be reproduced.

Also question an old report presented as live, a report covering one asset while marketing says all funds, or ratios that omit pending withdrawals without explanation.

A missing PoR does not by itself prove insolvency. It means the public evidence does not resolve the question. State that limitation precisely.

Do not send more money to test a claim. Use read-only public records and protect account credentials.

New Zealand boundary

Reserve evidence does not determine New Zealand eligibility

A PoR publication is not a gambling licence and does not prove that an operator accepts New Zealand residents under current terms. Use the national legal-status guide separately.

New Zealand cybersecurity guidance helps readers protect their own wallets; it does not audit a casino’s reserve liabilities or certify overseas operators.

Check contracting entity, country restrictions, KYC powers and complaint route before any deposit. A visible wallet or successful IP connection is not permission.

If gambling causes harm, reserve research should not become a reason to chase losses. Use the responsible gambling guide.

Practical review

Crypto casino proof-of-reserves checklist

1. Identify the exact legal reporting entity.
2. Record report date, observation time, timezone and block height.
3. List every covered asset, network, wallet and custodian.
4. Check how control of keys or custodial rights was tested.
5. Confirm how wallet-list completeness was assessed.
6. Read the pricing and eligible-asset policy.
7. Identify all included player-liability categories.
8. Check extraction and completeness of the customer population.
9. Understand Merkle leaf, root and negative-balance treatment.
10. Look for borrowing, liens, pledges and rehypothecation.
11. Verify legal segregation and customer ownership claims.
12. Read the full provider report, procedures and exceptions.
13. Distinguish an audit from agreed-upon procedures.
14. Check frequency and what happens between snapshots.
15. Do not treat a ratio as a withdrawal or insolvency guarantee.

A responsible conclusion describes exactly what the evidence supports and lists the unanswered questions beside it.