Deribit Moves 90% of Client Assets to Coinbase and Retires Its Daily Proof-of-Reserves Check

Deribit will remove its public Proof of Reserves page on Sept. 1, bringing an end to a daily check that customers could use to verify that their balances were included and to compare aggregate liabilities against the exchange's published wallet holdings. Reserve, reconciliation and audit controls required by regulators will remain in place, but those mechanisms do not offer the same day-to-day public visibility. The move comes as daily or periodic proof-of-reserves disclosures became a common industry practice after the collapse of FTX in late 2022, when customers of that exchange discovered that assets they believed were held one-to-one were not.

The exchange said the change reflects an overhaul of its wallet infrastructure as it integrates with Coinbase. Deribit stated that roughly 90% of client assets have been moved into Coinbase custody arrangements since Coinbase acquired the derivatives platform in August 2025. The company's disclosures refer to Coinbase at the brand level but do not identify the specific Coinbase legal entity that now holds the migrated assets.

Coinbase's 30-Minute Deribit Switch Will Force-Settle and Rebuild Institutional Positions

Deribit's current proof-of-reserves system relies on a privacy-preserving binary Merkle tree and a daily snapshot. Each client receives a unique proof identifier that lets them locate the hashed entries representing their balances, while anyone can sum the file's liabilities and compare that total with the wallet balances Deribit publishes. Similar Merkle-tree-based systems have been adopted by major exchanges including Binance, OKX and Kraken since 2022, and critics of the method have long noted that it verifies liabilities against wallet holdings at a point in time without proving ownership of the wallets or the absence of borrowed funds.

Even before the removal, the public snapshot covered less than Deribit's full custody footprint. The methodology states that assets held with third-party custodians are excluded because they lie outside Deribit's direct control, naming Copper ClearLoop as one example.

The page's removal does not cancel the regulatory obligations that apply to Deribit FZE. Dubai's Virtual Assets Regulatory Authority requires covered virtual asset service providers to maintain reserves equal to 100% of client liabilities, hold them one-to-one in the same asset, reconcile them daily, and obtain an independent third-party reserve audit at least every six months.

Deribit's notice refers to both annual and twice-yearly Proof of Reserves audits. The VARA rule sets the minimum frequency for reserve audits at once every six months. A separate VARA provision mandates an annual financial-statement audit and requires that the annual report be made available to clients and the regulator upon request.

Other compliance evidence is submitted to the regulator rather than published publicly. Covered firms must provide wallet addresses to VARA on a monthly basis and file quarterly statements demonstrating compliance with financial requirements, including reserve assets.

VARA's register lists Deribit FZE as an active exchange and broker-dealer VASP. Its membership terms permit assets to be held directly or through third-party custodians, while requiring segregation from company assets and preserving clients' legal title. A separate VARA service-provider list names Coinbase for custody and self-custody technology, again without specifying which Coinbase entity is involved. The shift also fits a broader pattern of crypto trading venues consolidating custody with large regulated custodians such as Coinbase Custody, which serves numerous institutional clients and is licensed as a qualified custodian in the United States, as opposed to holding assets in proprietary hot and cold wallets.

The removal of the page is not in itself evidence of a reserve shortfall. What it represents is a reduction in what customers can independently verify each day, leaving in place controls and reports that are less public, less frequent, or available only on request. For customers, the practical difference going forward is that verification of reserves will depend on VARA-supervised audits and private reporting rather than a public daily snapshot, and the six-month minimum audit interval means long gaps between independent attestations.

Source: CryptoNews | CryptoSlate