Following the FTX collapse, in recent weeks, Mazars South Africa has provided proof or reserve attestations to various cryptocurrency exchanges, including Binance, Crypto.com, and KuCoin. As of today, those certifications are no longer available on its website, as Bloomberg first reported. The press has widely misrepresented the certifications as audits and they are far from it. There is a real risk that they provide a false sense of security.

So far, Mazars has not commented why the certifications were removed from its website (we have copies of those from Binance and Crypto.com). However, Binance issued a statement saying: “Mazars has indicated that it will temporarily halt work with all of its crypto clients globally, which include Crypto.com, KuCoin, and Binance. Unfortunately, this means we won’t be able to work with Mazars at the moment.”

With the collapse of FTX there have been question marks over its audits, including from Armanino, which was one of the first to provide proof of reserve certifications. According to an unconfirmed report from Forbes, Armanino is shutting down his crypto practice over reputational concerns. If a high-profile audit is called into question, that can be reflected in all the other firms the firm audits, potentially encouraging clients to head for the exits.

Certifications provide a false sense of security

Audits do not necessarily uncover fraud, as in the case of FTX. But certifications are less likely to. They involve much less work on the part of accounting firms, and often the rules are specified by the client.

While many support cryptocurrency certifications, our opinion is that they can provide a false sense of security. The certifications are intended to add up all customer accounts and compare them to the wallet balances under the control of the cryptocurrency exchange. When customers log in, they can see that their balance was part of the certification.

However, there are several ways in which this does not necessarily provide proof. For example, the exchange is aware that people never log into their accounts. So it’s conceivable that they could exclude these accounts when getting certifications. They often included negative balances as well, which voids the object.

But most importantly, certifications do not reflect off-chain contracts. The company could have other significant liabilities that are not reflected, such as a general pledge. He could have temporarily borrowed the crypto assets just for the certification work.

Kraken was one of the first cryptocurrency exchanges to do certifications. Its CEO, Jesse Powell, criticized Binance’s certification when it was first announced.

Mazar’s silence is deafening

On the one hand, it may have seemed strange that Mazars South Africa is making these attestations. However, the company employs more than a thousand people in the country alone. By contrast, for years, the branch of auditors that provided certifications for the Tether stablecoin had only a handful of employees.

It is unusual that comments about Mazars crypto work being paused come from Binance, not Mazars. The fact that he has withdrawn the previously published attestations is particularly worrying. And it could lead some to conclude that something is up in one or more of them.