Proof-of-reserves attestation

1. Scope

This attestation covers customer balances and on-chain reserves for the five largest assets on the platform: BTC, ETH, USDT, USDC, SOL. Together these represent 91% of customer assets under custody. The remaining 9% (long-tail listings) is covered by the same methodology in a quarterly internal report — published version available on request.

2. Methodology

Customer balance side

The Network Firm receives a hashed snapshot of every customer account balance at the snapshot timestamp. The snapshot is a Merkle tree where each leaf is SHA-256(account_id || asset || balance || salt) — one leaf per (account, asset) pair, with a per-account random salt to prevent balance enumeration. The Network Firm verifies the tree root matches the platform's published root, then samples 5,000 random leaves and reconciles them against the platform's accounting database.

Each customer can independently verify their own leaf is included via the customer dashboard's "Verify my balance in attestation" tool, which produces a Merkle proof for their account.

Reserve side

The Network Firm receives a list of every blockchain address controlled by bitexasia. Each address has a signed message proving control (signed by the address's private key with a nonce supplied by The Network Firm). The Network Firm then queries each chain's public node infrastructure to confirm balances at the snapshot block. No reliance on the platform's internal databases for reserve numbers.

3. Results

Coverage above 100% reflects exchange operating reserves on top of customer balances — required to handle in-flight settlements, margin engine collateralisation, and a small operational float.

4. The Network Firm's opinion

"Based on the procedures described in Section 2, we found the on-chain reserves controlled by bitexasia as of 2026-04-30 23:59 UTC to be sufficient to cover the customer balances reported in the platform's Merkle snapshot for the five assets in scope. We identified no material discrepancies. This attestation does not constitute an audit under PCAOB or SOX standards; it is a point-in-time proof-of-reserves engagement under the AICPA SSAE 18 framework."

Signed: The Network Firm — 2026-05-04. Engagement letter and full attestation report available at support contact on request.

5. What this does NOT prove

Three honest disclaimers:

• This is a snapshot. The next day, balances change. Quarterly cadence catches systematic divergence; not real-time fraud.
• It does not prove the platform is solvent in the broader sense (off-balance-sheet liabilities, future obligations). It proves on-chain coverage of stated customer balances at the timestamp.
• It does not cover the long-tail 9% of assets. Those are covered in an internal quarterly report; published version available on request.

6. Contact

Engagement letter and full PDF of the Network Firm report: audits@bitexasia.com. Response within 48 hours during business days.