A customer opens an exchange account, copies a string of numbers and follows a path through a Merkle tree. The page processes the request and returns a reassuring result: the customer’s balance was included in the exchange’s proof of reserves.

The verification is most likely technically sound, establishing that the account appeared in a dataset and that the exchange controlled wallets that contained enough of a particular asset to cover the balances represented there.

However, it can easily leave out whether every customer appears in that dataset, how much the exchange owes to lenders, whether the displayed coins have been pledged as collateral, and whether the company actually controlling the wallet is the same company that’s legally…