OKX began publishing Proof of Reserves (PoR) reports in November 2022, and the September 2026 report is its 47th. The latest snapshot was taken at 16:00 UTC on 7 September 2026 (00:00 on 8 September, UTC+8). The official page shows US$27.4 billion in primary assets and reserve reports for 22 coins. The method is a zk-STARK zero-knowledge proof, and the whole PoR system and its verification tools are open source.
This guide covers the latest figures on the official page, how the last seven reports moved, the three rules the zk-STARK proves, three ways to verify for yourself, and the wallet setup and withdrawal protections you can switch on. Worth knowing: binding a fee rebate only takes your UID, and your assets stay in your own account.
Key points
- Report 47 (snapshot 2026-09-08, UTC+8): BTC 109%, ETH 101%, USDT 105%, USDC 100%. All 22 coins in this report are at 100% or above.
- Two kinds of wallet assets: the exchange's own on-chain wallets plus third-party custody. The page notes custodian balances must be confirmed with the custodians.
- Method: the zk-STARK proves three constraints (total balance, non-negative, inclusion), and wallet addresses carry a signed "I am an OKX address" message.
- Third parties: no accounting firm is listed on the PoR page. Verification relies on open-source tools anyone can rerun.
- Account protection: a withdrawal allowlist, a 24-hour lock on new addresses, and Offline Mode (launched July 2026), which blocks withdrawals during a custom window of up to 12 hours.
Report 47: major assets
Figures below come from the official Proof of Reserves page and its public endpoint. Snapshot 2026-09-07 16:00 UTC; checked 2026-09-28.
| Asset | User account assets | Total wallet assets | Exchange wallets | Third-party custody | Reserve ratio |
|---|---|---|---|---|---|
| BTC | 139,865 | 153,151 | 146,359 | 6,792 | 109% |
| ETH | 1,785,866 | 1,796,024 | 1,716,056 | 79,968 | 101% |
| USDT | about 8.49 billion | about 8.95 billion | about 8.82 billion | about 0.14 billion | 105% |
| USDC | about 1.91 billion | about 1.92 billion | about 1.70 billion | about 0.22 billion | 100% |
Amounts are in units of each asset. Reserve ratio = total wallet assets ÷ user account assets, rounded to whole percent on the official page. The live page prevails.
USDC reads 100%, but the raw figures are about 1.922 billion in wallets against about 1.913 billion of user assets. That is roughly 8.2 million USDC extra, a ratio of about 100.4% before rounding. A ratio of 100% or more means the wallets covered user assets at the snapshot. How far above 100% it sits says nothing about the exchange's overall finances.
The disclaimer on the page is explicit. The report shows that customer and corporate digital assets held globally by the group's entities are fully reserved. Third-party custody balances sit with custodians and should be checked with them. Some assets or products may not be available in every jurisdiction.
How the last seven reports moved
The official endpoint keeps every past report, going back to November 2022. The table shows the four major assets across the seven most recent reports in 2026 (snapshot dates in UTC+8):
| Snapshot date | BTC | ETH | USDT | USDC |
|---|---|---|---|---|
| 2026-09-08 | 109% | 101% | 105% | 100% |
| 2026-08-11 | 111% | 101% | 106% | 101% |
| 2026-07-07 | 105% | 103% | 112% | 101% |
| 2026-06-19 | 106% | 103% | 112% | 100% |
| 2026-05-07 | 106% | 102% | 110% | 100% |
| 2026-04-20 | 106% | 103% | 110% | 100% |
| 2026-03-03 | 106% | 107% | 109% | 102% |
Two observations. First, snapshot dates are not fixed to one day of the month; in 2026 the gap between reports ranged from just over two weeks to about seven weeks. Second, none of the four major assets fell below 100% in these seven reports. Some movement is normal, since wallet balances and user assets change every day.
What the zk-STARK proves
The process has three steps: prove and verify all user account assets with a zk-STARK, prove ownership of the on-chain wallet addresses and total their holdings, then compare the two to get the reserve ratio.
At the snapshot, each user's balance goes into a trace table and an encrypted Merkle tree, creating a tamper-proof record. The page sets three constraints; if each is proven true, the claims hold:
- Total balance: the total user assets claimed equal the sum of every account's total assets.
- Non-negative: every account's total balance is above zero, so each account's assets cover its liabilities.
- Inclusion: every account's balance is included in the calculation and verification.
The T in zk-STARK stands for Transparent. According to the page, it uses the FRI protocol to verify data and prove the reports are authentic, without disclosing anyone's specific amounts, values or addresses. The code is public on GitHub.
The non-negative rule matters. If some accounts were allowed to go negative, a few "negative" accounts could shrink total liabilities and flatter the ratio. This constraint rules that out.
Three ways to verify for yourself
The PoR page offers three checks, each covering one part of the report:
1. Confirm your own assets were included
- Log in, open "PoR reports" and click [Details] to see your report data.
- Click [Copy data] and save the string as a file whose name ends in "_inclusion_proof.json" in a new folder.
- Download the open-source zk-STARK Validator from GitHub into the same folder and run it.
- A pass shows "Inclusion constraint validation passed"; a failure shows "Inclusion constraint validation failed".
This applies to reports from September 2024 onward. Earlier Merkle tree, Merkle tree v2 and older zk-STARK periods have their own official guides.
2. Verify the total balance and non-negative constraints
Under "Proof of Reserves files", download the zk-STARK file from the "Liability report" tab. Unzip it to get sum_proof_data.json, put the zk-STARK Validator in the same root folder and run it. A pass shows "Total sum and non-negative constraint validation passed".
3. Verify wallet ownership and balances
The published wallet list includes the coin, amount, signature and a message, "I am an OKX address", signed with the matching private key. You can check single addresses with a third-party signature tool, or all of them at once with the official VerifyAddress tool. The CheckBalance tool then compares balances against the snapshot block height (official guide).
Limits to keep in mind
These are general limits of the PoR method, not a judgment of this exchange:
- Point-in-time snapshot: the page itself notes the report reflects balances at the time of capture, and tokens out of scope or later transactions are not included.
- Listed coins only: this report covers 22 coins; other assets are outside the ratio.
- Not full financial statements: it shows the user-asset side is fully reserved, but says nothing about other liabilities or operations.
- Custody needs separate checks: the page states custodian balances should be verified with the custodians.
- No accountant sign-off: no audit firm is listed on the PoR page; it is a cryptographic self-attestation with open-source tools.
A PoR answers "were the wallets enough at the snapshot". It is not regulation, and it is not deposit insurance.
Hot and cold wallets
From the security of funds page:
- Most assets in cold storage: kept fully offline and air-gapped, with access requiring several authorized people, plus offsite backups and vault protection.
- Semi-offline multisig hot wallet: an in-house semi-offline signing mechanism that avoids typical TCP/IP when processing transactions. Private keys sit in volatile memory rather than non-volatile storage, and transfers need keys held in separate geographic locations.
- Layered risk checks: deposits are checked for blacklisted source addresses, enough confirmations, risk-rule hits and abnormal account behavior. Flagged transactions are investigated first.
As for a dedicated user protection fund with a published size, we did not find a specific figure on the PoR page, the security of funds page or the protection page, so this article does not list one.
Offline Mode and other withdrawal protections
Offline Mode launched in July 2026. KYC-verified users can set a daily window of up to 12 hours, in whole hours (for example 22:00–08:00). Any withdrawal started in that window is blocked regardless of amount, covering on-chain withdrawals, P2P selling, API withdrawals and Pay top-ups. The window cannot be changed or switched off while it is active, and changes outside it require facial verification (official announcement).
Offline Mode is simple to use: set your sleeping hours as the window, and even if the account is compromised during that time, withdrawals are stopped.
The withdrawal allowlist, the 24-hour lock on new addresses, the anti-phishing code and the 24-hour withdrawal hold after changes such as a password reset are covered in OKX deposits and withdrawals. For login and withdrawal verification, an authenticator app or a passkey is recommended (account security guide).
A note for users in Taiwan
OKX is not on Taiwan's Financial Supervisory Commission (FSC) list of virtual asset service providers that have completed AML registration. See Offshore Crypto Exchanges in Taiwan: FSC Register Check. A PoR is voluntary disclosure and a separate matter from regulatory supervision.
Does a fee rebate affect asset safety?
No. A rebate only needs your UID; no password, API key or asset permissions. The details are in Are Crypto Fee Rebates Real? Is Binding a Code Safe? Sign up on OKX with code NOVA888 for a 20% auto-rebate, paid straight back to your account; for our exclusive OKX rewards and promotions, contact support. Binding steps are in the OKX fee rebate guide.
FAQ
How often does OKX publish its Proof of Reserves?
The page describes the reports as monthly, but snapshot dates vary. In 2026 the gap between reports ranged from just over two weeks to about seven weeks.
Is the OKX PoR audited by an accounting firm?
No accounting firm is listed on the PoR page. It uses a zk-STARK and public wallet addresses, with open-source tools anyone can run.
How is a zk-STARK different from a Merkle tree?
A Merkle tree lets you confirm your balance is in the tree. The zk-STARK also proves the total is correct and that no account is negative, without revealing anyone's amounts. The upgrade to zk-STARK came in March 2023.
How can the third-party custody part be verified?
Not from on-chain addresses alone. The page states those balances are held with third-party custodians and should be verified with them.
Further reading
- OKX fee rebate guide: 20% auto-rebate, binding, rebinding.
- OKX deposits and withdrawals.
- Are crypto fee rebates real and safe?
- Taiwan FSC register and the status of 11 exchanges.
Reserve ratios and rules come from the official Proof of Reserves page, its public endpoint, the security of funds page and the help center, checked 2026-09-28. Figures may change; the live official pages prevail. This article is for information only and is not investment advice.
