Deribit moved 90% of client assets to Coinbase, then killed its daily proof-of-reserves check

Deribit will remove its public Proof of Reserves page on Sept. 1, ending a daily check customers could use to verify balance inclusion and compare aggregate liabilities with published wallet holdings. Regulator-required reserve, reconciliation and audit controls will remain, but they do not provide the same daily public visibility.

The exchange said the change reflects a wallet infrastructure overhaul during its integration with Coinbase. Deribit said roughly 90% of client assets have moved into Coinbase custody arrangements since Coinbase acquired the derivatives platform in August 2025. Its disclosures name Coinbase at the brand level but do not identify the specific Coinbase legal entity holding the migrated assets.

Deribit's existing system uses a privacy-preserving binary Merkle tree and a daily snapshot. Each client can use a unique proof identifier to find the hashed entries representing their balances, while anyone can sum the file's liabilities and compare the total with wallet balances published by Deribit.

The public snapshot was already narrower than Deribit's full custody footprint. Its methodology says assets held with third-party custodians are excluded because they are outside Deribit's direct control, naming Copper ClearLoop as an example. It does not say whether every Coinbase-held asset was already excluded.

After Sept. 1, Deribit has not promised a replacement public dashboard or continued client-level Merkle verification. It said clients and counterparties may request audited financial statements and other due-diligence material, a less frequent and less directly verifiable form of evidence.

The removal does not cancel the obligations applying to Deribit FZE. Dubai's Virtual Assets Regulatory Authority requires covered virtual asset service providers to maintain reserves equal to 100% of client liabilities, hold them one-to-one in the same asset, reconcile them daily and obtain an independent third-party reserve audit at least every six months.

Deribit's notice refers both to annual and twice-yearly Proof of Reserves audits. The VARA rule sets the reserve-audit minimum at once every six months. A separate VARA provision requires an annual financial-statement audit and says the annual report must be available to clients and the regulator on request.

Other evidence is regulator-facing rather than public. Covered firms must submit wallet addresses monthly and statements demonstrating compliance with financial requirements, including reserve assets, quarterly to VARA.

VARA's register lists Deribit FZE as an active exchange and broker-dealer VASP. Its membership terms allow assets to be held directly or through third-party custodians while requiring segregation from company assets and preserving clients' legal title. A separate service-provider list names Coinbase for custody and self-custody technology without specifying the Coinbase entity.

The page's removal is not evidence of a reserve shortfall. It is a reduction in what customers can test for themselves each day, leaving controls and reports that are less public, less frequent or available only on request.