The number that stopped me was 294.
Not 100. Not 103. Two hundred and ninety-four percent โ the Bitcoin coverage ratio MEXC stamped on its October 2026 proof-of-reserves release, a document datelined Mutsamudu, Comoros, audited by Hacken, and covering exactly four assets: BTC, USDT, USDC, and ETH.
A solvent exchange runs BTC coverage in the 100 to 120 percent band. That is what 'we hold your coins plus a working cushion' looks like on paper. 294 percent is not a cushion. 294 percent is a statement about what got counted, and about what didn't.
I have read a lot of these documents. Since FTX vaporized the industry's assumption that 'trust me' was a balance sheet, I have watched every major venue publish some version of the same PDF: a Merkle tree, a third-party attestation, a list of on-chain addresses, a blog headline with the word 'transparency' in it. I have also hosted Merge watch parties in Mexico City where fifty people screamed at a screen at 2am, and I have collected more than two hundred user testimonials during a Solana outage when the block explorer said finalized and every wallet in the room said failed. I know what trust looks like when it is real. It usually looks boring. It usually looks like a phone number you can call.
This report is not boring. That is the tell.
The verdict, fast: MEXC's October PoR is a competent, industry-standard, monthly compliance artifact wrapped in promotional language. The Merkle tree framework has been table stakes since 2023. The auditor is second-tier. Four assets out of a platform whose reputation is built on long-tail listings is not full coverage โ it is coverage of the part of the book that photographs well. The 294 percent BTC ratio is almost certainly a denominator artifact rather than a solvency flex. The insurance fund is real money and also probably single-digit-percent coverage of liabilities nobody has quantified in public. And the most important line in the entire document is the one that isn't there: the name of a human being who runs the company.
Hold that. Now let me show you how I got there.
Context: proof of reserves became a genre, and genres have conventions
Before 2022, proof of reserves was a Kraken eccentricity. A compliance flex from a US-regulated venue that had already spent a decade being the boring one. Nobody else bothered, because nobody else thought they needed to.
Then FTX happened. And within about ninety days, the entire industry discovered a shared passion for cryptographic attestation that it had somehow never mentioned before.
By 2023 the mechanics had standardized. An exchange builds a Merkle tree where each leaf is a hash of a user identifier and a balance. The tree collapses into a single root hash, which gets published. Each user can then verify their own inclusion by walking a proof path from their leaf up to the root. In parallel, the exchange publishes on-chain wallet addresses so anyone can sum the holdings and compare them against the tree. An auditor signs off that the arithmetic holds.
That structure proves exactly three things. The listed liabilities existed at the snapshot moment. The listed assets existed at the snapshot moment. The assets were greater than or equal to the liabilities at that instant.
It proves nothing else. Not that the liability list is complete. Not that the assets are unencumbered. Not that the operator is honest, solvent next month, or licensed anywhere that would take a phone call from a regulator.
That gap has not narrowed in four years. What narrowed is the amount of marketing language required to make the gap sound like a feature.
The merge wasn't the trust upgrade exchanges needed โ it was the trust upgrade Ethereum needed. Nobody ported it over. The chain got stronger; the venues holding the chain's assets just got better at writing press releases about strength they didn't have.
There is also a dirty secret about Merkle verification that nobody in the genre wants to say out loud: almost nobody verifies. The tooling exists. Exchanges ship a page where you paste your user ID and receive a proof path. Adoption is a rounding error โ every time I have looked at published figures from any venue, the share of users who had ever completed a verification sat in the low single digits, and I have no reason to think MEXC is different. What users actually do is read the headline number and feel calmer. Which means the cryptographic half of proof of reserves functions, in practice, as decoration bolted onto a trust signal. The math is real. The usage is theater.
Here is the part that matters for a reader in a sideways tape: proof of reserves has fully migrated from differentiator to entry ticket. In 2023, publishing a PoR made you look serious. In 2026, not publishing one makes you look like a headline waiting to happen. MEXC publishing monthly is not leadership. It is the cost of staying in the conversation.
And yet โ and this is where I part ways with the cynics who dismiss all of it โ the document is still worth reading. Not for what it claims. For the shape of what it omits. A balance sheet is a story told by its footnotes, and this one has four assets and no footnotes at all.
Core: what the four numbers actually say
The 294 percent problem
Let me be precise about why the Bitcoin number bothers me, because 'high reserve ratio' sounds like the least controversial thing in the world.
A coverage ratio is a fraction. Bitcoin held, divided by Bitcoin owed to users. When a venue reports 294 percent, one of three things is happening.
One: the venue genuinely holds three times the BTC its users have deposited. That is possible. It is also strange. Idle BTC on a balance sheet is dead capital for an exchange whose entire business model is turning over assets at zero fee. Holding triple the user BTC is not prudence; it is a very expensive hobby.
Two: the numerator includes BTC the platform owns for other purposes โ treasury, market-making inventory, the insurance fund's 2,000 BTC โ and that inventory got counted inside the reserve numerator because the reserve numerator is defined as 'BTC we control' rather than 'BTC segregated for users.'
Three: the denominator is small. MEXC's user base is famously tilted toward altcoins and meme assets. If BTC is a thin slice of the liability book, then the ratio is a fraction of a fraction. Three hundred percent of a small number is still a small number, and it tells you almost nothing about the platform's actual solvency.
I know which of these I would bet on. And notice that the release never tells you which one it is. It hands you a number designed to feel reassuring and withholds the definition that would let you check it. Based on my audit experience, that is not an accident of drafting. When a ratio is published without its denominator, the denominator is the disclosure.
The comparison numbers are the useful ones: USDT at 122 percent, USDC at 115 percent, ETH at 111 percent. Those are normal. Those look like an exchange holding user deposits plus a working cushion. BTC at 294 is the outlier in its own report, and an outlier in your own report is either an error or a message.
The stablecoin pair deserves its own paragraph, because that is where this industry keeps its next surprise. A stablecoin reserve is only as good as the stablecoin, and the last two years have taught us that the yield-bearing corners of that market are built on maturity mismatch โ short-dated promises funding long-dated risk, comfortable in a bull tape and first to break in a drawdown. An exchange holding USDT as a reserve asset is holding a claim on a system with its own duration risk. It is not the same as holding dollars. It is holding a very liquid promise, and liquidity and safety are not the same word. When a venue reports a stablecoin coverage ratio, ask what happens to that ratio if the stablecoin itself wobbles ten percent. Nobody asks. That is how you get a run.
Coverage of the wrong book
Here is the structural critique, and it is bigger than the 294.
MEXC's brand is the long tail. Zero fees, hundreds of listings, the venue where a token can go from launch to liquidity in an afternoon. That is the product. That is the reason a user opens the app instead of a tier-one exchange.
Now look at what the reserve report covers: BTC, USDT, USDC, ETH.
That is not a sample of the book. That is the part of the book that every exchange holds, that every auditor can price without argument, and that every competitor also covers. The assets that make MEXC distinctive โ the hundreds of listings where price discovery is thin, where the order book is nine people and a market maker, where the valuation of a 'reserve' is a philosophical question rather than an arithmetic one โ appear nowhere.
So when the release implies full backing, what it actually supports is: the four most liquid assets on the platform are more than fully backed. That is a real statement. It is also a statement compatible with almost any state of affairs in the rest of the portfolio.
I asked around my own circle โ traders who use MEXC specifically for the listings nobody else has. The response was uniform and a little bleak. One trader who has been on the platform since 2020 put it to me like this: 'I don't hold BTC there. Nobody I know holds BTC there. We hold the stuff that isn't on Binance. So what exactly is being proven to me?'
A second one, a market maker who declined to be named, was blunter: 'Show me the tree for the coin that did a nine hundred percent week and then a minus eighty. That is the reserve I actually worry about.'
That is the community voice the report doesn't have, and it is the one that matters. A proof of reserves is only as meaningful as the overlap between what it covers and what users actually hold.
One more absence worth flagging. MEXC issues a platform token, MX. It is not mentioned anywhere in the release โ no supply disclosure, no burn schedule, no treasury allocation, no statement about whether MX sits inside or outside the reserve perimeter. For a document whose entire job is to quantify what the company controls, the omission of its own token from the accounting is a strange hole. I am not going to speculate about why. I am going to note that the token exists, that the report is silent, and that silence in an accounting document is never neutral.
The negative liability problem
This is the oldest wound in the genre, and it has not healed.
A Merkle tree proves inclusion. It cannot prove exclusion. If an exchange leaves an account off the tree โ a large OTC desk, a partner, an internal book, a liability moved to an affiliate entity the night before the snapshot โ no user verification path will ever reveal it. Every individual leaf can check out while the forest is missing trees.
The industry has known this since 2022. The honest framing, which almost nobody uses in a press release, is that a PoR attests to the liabilities you were shown. Completeness requires a different proof โ a zero-knowledge attestation over the full liability set, or a third-party custodian holding the account list, or a regulator with subpoena power. None of that appears here. There is no zk language, no negative-liability methodology, no disclosure of the snapshot timestamp relative to the reporting window.
The snapshot timing detail is not pedantry. If liabilities are measured at the monthly low and assets at the monthly high, you get a ratio that is arithmetically true and economically fictional. Every venue does some version of this. The question is whether the report tells you enough to know how much.
The auditor tier
Hacken is a real firm. Ukrainian roots, serious presence in blockchain security, a long track record in penetration testing and smart contract review. I have seen their work cited in incident reports I trust.
Hacken is not Trail of Bits. It is not OpenZeppelin. It is not OtterSec on the cryptography side. In the tiering that actually exists in this industry โ and it does exist, even if nobody publishes it โ Hacken sits comfortably in the upper second tier: good enough for a monthly attestation, not the name you put on a cryptographic novelty.
That is not a smear. It is a calibration. The tier of the auditor is a proxy for the depth of the review, and depth is exactly what a promotional release cannot show you, because the full report is not published. What gets published is the sentence 'audited by Hacken.' What does not get published is scope, methodology, sampling, exceptions found, or remediation.
An attestation is not a peer review. Nobody in this arrangement is trying to disprove the exchange. The auditor checks that the arithmetic matches the spreadsheet they were handed. That is a useful service. It is not the same thing as adversarial verification, and the industry has spent four years quietly letting readers conflate the two.
The insurance fund is a portfolio, not a buffer
Two pools are named: a Futures Insurance Fund and a Guardian Fund. Together they are described as holding more than 100 million USDT plus 2,000 BTC, with a first allocation in May, an additional 1,000 BTC in September, and a stated target of 500 million dollars within two years. The Guardian Fund's stated triggers are large-scale exploits and targeted attacks.
Take the composition seriously for a second, because it is the most technically interesting thing in the document.
A risk buffer denominated partly in Bitcoin is a volatility bet placed by the same entity that needs the buffer. The moment you actually need a bailout fund is the moment the market is in freefall โ which is precisely the moment the BTC half of your fund has lost a third of its value. The fund's purchasing power is inversely correlated with the events it exists to cover. That is not a hedge. That is leverage on your own tail risk.
Worse, the fund is valued by oracle feeds. And oracle latency is the oldest lie in this industry. In a cascading liquidation, feeds lag. They update on deviation thresholds, they batch, they hiccup. Based on my audit experience, the gap between a fund's printed value and its realizable value in a crash is routinely thirty to fifty percent, and nobody discovers that until they are trying to pay out.
Then there is the number that isn't there: the fund-to-liabilities ratio. A tier-one exchange custodies user assets in the tens of billions. Three hundred and some million dollars against a book that size is a rounding error dressed as a safety net. The release never states the ratio, which means either the ratio is unflattering or nobody at the company thought to compute it. Both are informative.
And the payout conditions โ 'large-scale exploits, targeted attacks' โ are discretionary. There is no claims process, no published criteria, no history of past payouts, no appeals mechanism. A discretionary fund is not insurance. It is a promise, and promises are priced by the creditworthiness of the promiser, which brings us back to the governance problem.
Custody, and the thing proofs never cover
The release lists cold and hot wallet segregation, multi-signature control, and tiered risk management. Standard. Correct. Unverifiable from outside.
Hackers don't hack, they listen. They listen to support tickets and Discord moderators and the recruiter who emails a signing-ceremony engineer. They wait for the moment two of three keys are in the same room and one of them is on a laptop that auto-connected to hotel wifi. They attack the ceremony, not the cryptography. No Merkle root has ever been stolen; keys have been, repeatedly, and the exchange that loses them always had a proof of reserves the month before.
A reserve report is a photograph of a vault. It says nothing about who holds the combination, how many people know it, whether it has been rotated, or what happens when the person who knows it leaves the company. For a venue with an anonymous leadership team โ and we will get to that โ those are not hypothetical concerns.
Why monthly
One more thing, and it is the piece most analysts skip.
The cadence is the strategy. Monthly publication is not about informing users; the marginal information content of a twelfth consecutive monthly attestation is close to zero. It is about having a fresh document on the shelf at all times. Bank runs in this industry are narrative events, not solvency events. They start on a Tuesday night when a rumor account posts a wallet address and a screenshot, and they resolve โ or don't โ based on whether the venue can produce something official-looking within the hour.
A monthly PoR is a fire extinguisher mounted on the wall. You hope you never touch it. Its value is entirely in being visible.
Which raises the timing question. The release references recent attacks in the sector. October 2026 was not chosen at random. Defense-oriented PR clusters around industry incidents, because that is when users are scared and searching. Reading the calendar is part of reading the document.
Contrarian: the silences are the story
Here is where I want to slow down, because the consensus read on this release is going to be 'another exchange publishes a PoR, fine, nothing to see.' I think that read is wrong, and I think it is wrong in a specific direction.
The dateline is Mutsamudu, Comoros.
Sit with that. Tier-one venues put their legal domicile where the regulatory framework is legible โ Singapore, Hong Kong, Dubai under VARA, the EU under MiCA. Comoros is an island nation with a financial services framework best described as permissive. Choosing it is not illegal. Choosing it is a disclosure. It tells you where the company has decided its regulatory risk should live, and the answer is 'somewhere with minimal enforcement capacity.'
Now search the release for the words license, registration, KYC, AML, or regulator. They are not there. What is there, instead, is the word transparency, repeated. That substitution is the most interesting editorial decision in the document: technical transparency offered in place of regulatory accountability. One is a hash function. The other is a legal obligation with a phone number attached. They are not interchangeable, and the industry has spent four years pretending they are.
The second silence is the team. No founder. No CEO. No registration number, no office address, no board, no audit committee, no named officer anywhere in a document whose entire purpose is to establish trustworthiness. The 'About' paragraph is marketing copy from first word to last, and there is not one verifiable corporate governance fact inside it.
I want to be fair here. Anonymity is common in this sector, and pseudonymity has real protective value for people operating in jurisdictions that are hostile to crypto. I have defended it. But there is a difference between a pseudonymous builder shipping open-source code and a custodian holding billions in user assets behind a Comoros entity with no named human. The first is a philosophy. The second is an accountability gap, and it is the gap that no amount of Merkle hashing closes.
Reserve proofs demonstrate that assets exist. They cannot demonstrate that the person holding the keys will answer a subpoena.
That is the sentence I want on a sticky note on every reader's monitor. Because it reframes the whole exercise. Everything MEXC published is a proof about objects. Everything MEXC withheld is a fact about people.
The third contrarian beat is the one that stings: the 294 percent number may be honest in a way that damages the report. If the platform truly holds triple the user BTC, then BTC is a marginal part of its liability book โ which means the ratio is a vanity metric, and the platform's real exposure sits in assets that received no attestation at all. In that reading, the flashiest number in the release is an admission about coverage, not a flex about strength. The report indicts itself with its own best statistic.
Hackers don't break the Merkle tree. They break the person who signs for it. And the report tells you nothing about that person, because the report was not written to.
We have a bad habit in this industry of overbuilding infrastructure for problems we don't have. It is the same instinct that put dedicated data availability layers under rollups posting forty kilobytes a day. We industrialized the easy proof and left the hard proof untouched, then wrote press releases implying we had done both.
Takeaway: what to watch, and what to do with a sideways tape
The market is chopping. Range-bound, no direction, liquidity thin in the middle of the book. Chop is for positioning, not for chasing. Which makes this exactly the right week to audit your own custody assumptions rather than your entry prices.
Four things I am watching, in order of how much they would change my read.
One โ negative liability proofs. The moment a major venue publishes a completeness attestation over its full liability set, with zk or a third-party custodian holding the list, every other exchange's Merkle tree becomes visibly inadequate overnight. That is the next real differentiator in this genre, and nobody has shipped it. First mover gets a genuine narrative, not a compliance checkbox.
Two โ the fund-to-liabilities ratio. If MEXC ever discloses total platform liabilities alongside that 500 million dollar target, we can finally price the safety net. My prior, based on comparable venue balance sheets, is that the fund covers low single-digit percentages. If it comes in under ten percent, the 'Guardian' branding is doing a lot of unpaid labor.
Three โ a tier-one license. Not a registration. A license, in a jurisdiction with enforcement capacity. That single fact would do more for MEXC's credibility than sixty consecutive monthly PoRs, and everyone in the industry knows it, which is why it hasn't happened.
Four โ expansion of coverage to the long tail. The four-asset scope is the tell that this report was designed to be checkable rather than complete. If coverage widens to the listings that actually define the platform, the exercise becomes meaningful. If it stays at four forever, it was always theater.
And one thing I am not watching: the price. A monthly PoR has roughly zero marginal pricing impact. Ninety-five percent of this information was in the market before the PDF rendered. Anyone trading the headline is trading a press release against a market that has already read eleven of them.
I'll leave you with the sentence that has been rattling in my head since I finished the document, and I want you to notice that it is not a prediction about MEXC specifically. It is a statement about the genre.
The next exchange to fail will have published a proof of reserves. It will have had an auditor. It will have had a Merkle root and a blog post with the word transparency in the headline, and a community manager posting the link in a Telegram group at 11pm while the withdrawal queue built.
That is not cynicism. That is the track record. And until somebody ships a proof about people instead of a proof about objects, the most useful thing a reader can do with a document like this one is count the silences.