On Tuesday, MEXC announced it had added another 1,000 BTC to its Guardian Fund, lifting the reserve to 100 million USDT plus 2,000 BTC. The press release arrived with three wallet addresses โ one on Ethereum, two on Bitcoin โ and a single promise: "users can independently verify."
I ran the addresses. The balances are real. That is where verification stops and theater starts.
Publishing a wallet address is not publishing a proof of reserves. A genuine PoR has three parts: an asset-side balance, a liability-side snapshot of user deposits rendered as a Merkle tree, and a third-party attestation reconciling the two. MEXC delivered roughly one-third of one part. It showed what it holds and stayed silent on what it owes. A reserve fund is only meaningful as a ratio โ reserves over liabilities. Publish the numerator, bury the denominator, and any number can be marketed as "protection."
This is the oldest move in the exchange playbook. Address transparency proves custody. It does not prove solvency.
The context nobody prints
The Guardian Fund is MEXC's answer to Binance's SAFU โ a self-funded reserve meant to compensate users after a hack, a drain, or a run. MEXC committed in May to growing it from $100 million to $500 million within two years. This week's addition is the second 1,000 BTC tranche, following an identical one in May. Two round-number allocations, spaced five months apart.
The narrative these funds live inside was born after FTX. In November 2022, a balance sheet no one had audited vaporized $8 billion of customer money in days. Every major exchange responded the same way: publish something, call it transparency, and hope the market stopped asking questions. Binance shipped a Merkle-tree PoR. OKX and Kraken followed with third-party attestations from firms like Armanino and Mazars. The bar was set: asset side, liability side, signature.
Here is the uncomfortable truth about protection funds in 2026: they are everywhere. Binance has SAFU. OKX, Bybit, and a dozen second-tier platforms have their own variants. When every exchange advertises a reserve, the fund stops being a differentiator and becomes table stakes. The only thing that still separates them is proof โ and proof is precisely what the cheaper disclosures avoid.
MEXC, founded in 2018 and serving 170-plus markets, now sits below that bar. It has the addresses. It does not have the attestation.
What the chain actually shows
Three addresses. One USDT. Two BTC. You can watch them move. You cannot see whether those coins are pledged, lent, or posted as collateral against some other obligation. Rehypothecation is invisible on a public explorer. A wallet holding 1,000 BTC that has been re-used as loan collateral looks identical to a wallet holding 1,000 BTC in cold storage. The chain shows the balance. It does not show the lien. The addresses prove existence, not independence.
There is also a verification-friction problem. The three wallets span two chains โ Ethereum and Bitcoin โ with no unified dashboard. A user who wants to "independently verify" the fund has to check each address on a separate block explorer, convert balances into a common unit, and hope MEXC's published list is complete. Verification you have to assemble yourself from scattered pieces is verification most people will never do.
A real PoR forces the exchange to do the one thing it least wants: count its own liabilities. The Merkle-tree method lets each user confirm their balance is included in a total without revealing anyone else's โ but it also forces the exchange to publish a number it can be sued over. That is exactly why thin disclosures exist. Not because the technology is hard, but because the accountability is. I have watched teams spend six figures on audits they quietly hoped would find nothing. The incentive runs against transparency, always.
Then there is the arithmetic problem. In my 2022 audit of an L2 bridge, the first thing I learned to distrust was a headline number that moved without new inputs. MEXC's fund is denominated in BTC and USDT. In May, when the first 1,000 BTC went in, bitcoin traded far below where it sits today. A large chunk of the fund's "growth" from $100 million toward its $500 million target is not fresh capital. It is the price of bitcoin doing the work. Roughly 40% of the second tranche's contribution to the fund's dollar value may be appreciation, not injection. The release lets readers infer that MEXC committed new money. The mechanism says the market did part of it for free.
And the size, taken generously: 2,000 BTC plus 100 million USDT, at a $60k-to-$120k range, is somewhere between $220 million and $340 million. Against 170-plus markets' worth of user deposits, that is a rounding error dressed as a safety net.
The rulebook that does not exist
Here is the part that should worry a depositor more than any hack. The release describes a fund. It never describes how the fund is used.
Who authorizes a payout? What event triggers one? Is there a per-user cap? A claims process? A timeline? An appeals path? None of it is disclosed. MEXC says the fund is "continuously strengthened." It does not say who holds the keys, whether a multi-sig is involved, or what happens when a user asks for compensation. A protection fund with no published trigger is a promise with no enforcement clause โ an insurance policy where the insurer writes the terms after the fire.
The CEO, Vugar Usi, is quoted saying security "is not a one-time investment but an ongoing commitment." That sentence contains no verifiable claim. It is a rhetorical shield. Meanwhile, the release never names a single auditor. Binance cites one. OKX cites one. MEXC cites itself. Audits check syntax; journalists check motive โ and the motive here is a press cycle timed against a season of exchange exploits.
There is a second silence worth flagging: MEXC operates its own token, MX. The release does not mention it once. Whether the Guardian Fund will ever be used to buy back or defend MX is left unstated. For a platform that monetizes its token across listing and trading incentives, that omission is not an accident. It is a boundary the legal team drew.
What the bulls get right
Here is the part my peers miss. The coins are there. I checked. MEXC did not fabricate an address or pad a screenshot. In a market where exchanges have outright lied about reserves, publishing even an asset-side snapshot is more than several competitors bother to do. It is a genuine, if minimal, step.
And the demand driving these funds is real. After FTX, retail depositors stopped trusting logos and started wanting receipts. Any exchange that feels pressure to publish anything at all is responding to that pressure. The instinct is correct even when the execution is thin. A public address is a foothold. It is not a summit, but it is a foothold โ and footholds matter in a market this cynical.
The problem is not that MEXC published addresses. The problem is that it packaged them as proof. Beneath every whitepaper lies a buried intent, and beneath every "independently verifiable" claim lies a question the issuer hopes you will not ask.
Where this goes
The transparency arms race is not optional anymore. If Binance or OKX ships a full Merkle-tree PoR with a signed attestation this quarter, MEXC's address disclosure stops being an asset and becomes a liability โ a public record of exactly how little it shows. The company's 170-plus-market footprint makes that pressure sharper, not softer. Jurisdictions tightening custody rules โ the EU under MiCA, US regulators after a decade of exchange failures โ will not accept a wallet screenshot as evidence of solvency. They want a signature.
Watch three things. Does a named auditor appear? Does a liability-side snapshot appear? Do the published addresses stay static, or do coins move out to be pledged elsewhere? Data leaves footprints; hype leaves only dust. The addresses are live. The liabilities are not. Until they are, the Guardian Fund is a brand asset, not a backstop โ and anyone treating a wallet screenshot as solvency insurance is holding the wrong kind of receipt.