How to Read a Stablecoin Attestation Report and Spot Red Flags

14 October 2026

A stablecoin attestation report is a third-party auditor’s statement about whether the issuer holds enough assets to back all the coins in circulation. To read one, you check who performed the audit, what assets were counted, how they were valued, and whether the report covers the right date. Red flags include vague asset descriptions, stale dates, qualified opinions, and assets that are not cash or cash equivalents.

What an attestation report actually says

Most fiat-backed stablecoins publish attestation reports monthly or quarterly. The report is not a full audit - it is a "reasonable assurance" or "agreed-upon procedures" engagement. The auditor checks that the issuer’s claimed reserves match the bank and custodian records at a single point in time. The report typically includes:

• The date and time the snapshot was taken.
• A list of reserve assets and their stated values.
• The total number of stablecoins outstanding at that moment.
• The auditor’s opinion on whether the reserves cover the outstanding coins.

The key figure is the reserve ratio: total reserves divided by circulating supply. If it is 1.00 or above, the report claims full backing. Below 1.00 means undercollateralization.

Step-by-Step: How to Read the Report

1. Identify the Auditor and Their Reputation

Find the name of the auditing firm. Major firms (Deloitte, PwC, EY, KPMG) have professional standards and liability. Smaller or unknown firms may lack the same rigor. If the auditor is an in-house team or a firm with no public track record in financial audits, treat the report as less reliable.

2. Check the Report Date and the Snapshot Date

The report should state the exact date and time when the reserves were counted. A report published in November that covers a snapshot from August is stale. Red flag: any gap longer than one quarter, or a report that does not give a specific date.

3. Examine the Asset Composition

Look for a breakdown of what the reserves actually are. The safest composition is cash or cash equivalents (T-bills, money market funds, reverse repo agreements). Red flags include:

• Commercial paper, corporate bonds, or other debt instruments without a clear breakdown by rating and maturity.
• "Other assets" or vague categories with no explanation.
• Tokenized assets or crypto held as reserves. This introduces price volatility that can break the peg.
• Loans to related parties or affiliates. This creates a conflict of interest and a risk of default.

If the report lists only "cash and cash equivalents" with no further detail, that is a lack of transparency, not necessarily a red flag - but it limits your ability to judge risk.

4. Verify the Circulating Supply Figure

The report should state the number of stablecoins outstanding at the snapshot time. You can cross-check this against on-chain data from block explorers or supply dashboards. If the report’s supply number is significantly lower than the on-chain supply, the issuer may be excluding coins held in certain contracts or reserves.

5. Read the Auditor’s Opinion Carefully

Auditors issue one of several opinion types:

• Unqualified (clean) opinion: The reserves appear to cover the liabilities, and the procedures found no material issues.
• Qualified opinion: The auditor found a specific problem, but it is not severe enough to invalidate the whole report. The qualification will be explained in a paragraph. Read that paragraph.
• Adverse opinion: The reserves do not cover the liabilities, or the issuer’s records are unreliable.
• Disclaimer of opinion: The auditor could not complete the procedures, often because the issuer did not provide enough access.

Any opinion other than unqualified is a red flag. If the opinion is qualified, decide whether the specific issue matters to you. For example, a qualification about a minor custody delay may be less concerning than one about missing bank statements.

6. Look for the Auditor’s Scope and Limitations

The report will describe what the auditor did and did not check. Common limitations:

• The auditor only verified assets held at specific custodians. If the issuer claims to hold assets elsewhere, those were not checked.
• The auditor did not independently value assets - they relied on the issuer’s valuations.
• The auditor did not verify that the issuer actually owns the assets free and clear (no liens or encumbrances).

If the scope is narrow, the report is less useful. A report that only checks one bank account when the issuer claims to hold reserves at three banks is incomplete.

What Happens When a Report Shows a Problem

If the reserve ratio is below 1.00, or if the auditor gives a qualified or adverse opinion, the stablecoin is not fully backed at that snapshot. This does not automatically cause a depeg, but it is a strong warning. Traders and arbitrageurs may lose confidence and sell, widening the gap from the peg. Past cases have shown that a bad attestation can trigger a bank run, especially if the issuer delays releasing a corrected report.

If the report is clean but the stablecoin is trading below peg anyway, the problem is likely elsewhere - market panic, liquidity issues, or a temporary arbitrage failure. The attestation is just one data point.

Practical limits of attestation reports

No attestation report proves solvency. It proves only that at one moment in time, the issuer held certain assets. Between reports, the issuer could move or lose those assets. The report also does not verify liabilities beyond the stablecoins themselves - the issuer may have other debts that could drain reserves.

For these reasons, treat attestation reports as helpful but incomplete. Combine them with on-chain proof-of-reserves tools, real-time supply data, and the stablecoin’s trading history to form a fuller picture.

Back to stablecoins