More info:
> They only verify BTC and ETH
Click the link and you see this isn't true: "ADA ADA.S BTC BTC.M DOT DOT.S DOT.P etc etc"
> they don't audit liabilities at all
All liabilities were verified by the auditors and included in the merkle tree, and as mentioned, all users can independently verify that their specific liabilities are present. What more would you expect?
> the audit they did last December was the second in 8 years
Their most recent audit was end of Q2 this year. They do audits semi-annually.
Where in the report do they verify off-chain liabilities?
> 14) Compare the total liabilities from the Client Liability Report extracted from Kraken’s production database as observed within Procedure 5 to the total assets controlled by the Kraken custodied addresses (the “In-Kind Assets”) as of the specified date and time of the assessment time and calculate the collateralization ratio based on the In-Kind Asset-to-Client Liability mapping provided by Kraken Management
Ex: I am Kraken. Someone deposits 1 BTC with me. I then sign a contract with someone else saying "You give me 1 BTC now, I will give you 1.2 BTC in a year". I then sell 1 BTC. In my wallet, I will have 1 BTC, exactly matching my client liabilities. But my total liability is 2.2 BTC. And if those contracts start calling in early (IE, margin calls), I'll end up in a liquidity crisis.
Or more simply, what if Kraken just uses the BTC as collateral for normal loans from a bank? If they fail to pay them, then they'll fork over the client BTC.
Your defense against these tail risks is to remember, "not your keys, not your coins", and self-custody when you're not actively exchanging. In the end you do have to hope that the < 1 hour it takes you to exchange your coins and transfer them back to your own wallet doesn't overlap with the moment they decide to torpedo their 10+ year old business with no prior warning or red flags. But these are infinitesimally small tail risks.
But there is a very easy way to prove that there are not contracts external to the blockchain.
That's the whole point of an audit.
And it's very telling that they don't want their books audited, but repeatedly point to a clearly incomplete (from the perspective of someone who is concerned that the business might go under) as proof of solvency.
>Administered by Armanino LLP, the Proof of Reserves audit is the second of its kind conducted on our exchange since 2014, and it affirms that more than $19 billion worth of client bitcoin and ether is safely – and provably – on our platform. This includes the $3.5 billion worth of ether held in Kraken’s secure on-chain staking service, the industry’s leading ETH2 validator.
Though the audit covers just two of the over 100 assets available for trading on our exchange, it adheres to, and seeks to advance, recommended standards for new cryptographic audits that we hope will become widely embraced in the digital asset sector.
Nevertheless, from the most recent "audit" report:
>"We were not engaged to and did not conduct an examination or review engagement, the objective of which would be the expression of an opinion or conclusion, respectively, related to the platform account liabilities and asset balances represented by Kraken. Accordingly, we do not express such an opinion or conclusion. Had we performed additional procedures, other matters might have come to our attention that would have been reported."
So once again, they're not saying anything al all about Kraken's overall assets or liabilities, merely confirming that the customer accounts have the correct number of coins in them at a point in time.
> The procedure cannot identify any hidden encumbrances or prove that funds had not been borrowed for purposes of passing the audit.
In other words, this is a fancier version of the kind of attestation that Tether makes, the ones that leave loopholes you can drive dump trucks through.
100% and this just drives me bonkers. I'm not entirely unsympathetic to wanting to avoid financial regulation, like while I disagree it's a good idea, I can understand wanting to build a system that is built on math and not people. Fine.
But isn't the whole point of crypto radical transparency? As in: you know at all times where all the coins are and the details of every transaction that has ever occurred? Shouldn't this meet 100% of your auditing needs? Why are audits even useful? Well, they're really helpful if you want to run a shell game off chain, but still assure customers that you're not gambling with their money so they keep giving you more of it.
Like, arguing in good faith here, this is just a worst of both worlds situation. You have an extremely slow financial transaction system that you still have to hand audit.