VALR is the first cryptocurrency exchange to verify its risk practices against a public Probability of Loss index

VALR is a South Africa-based cryptocurrency exchange, licensed by the FSCA and backed by Pantera Capital and Coinbase Ventures. It is also the first crypto exchange to submit data to improve its Probability of Loss index.  

VALR verified: a current penetration test, live reserve wallet addresses for ongoing tracking, and the findings from a prior proof-of-reserves audit.

After verification, VALR’s Probability of Loss improved to represent better transparency and risk management practices. As a result, their PoL changed from 80 (D methodology bracket) to 39.3, which places VALR in the B methodology bracket.

To better understand the scale, VALR skipped 100 ranking positions with this step, now placed #14 by PoL (prior position: #121).

Score breakdown:

VALR scored 100/100 in transparency and full marks on every solvency sub-metric:

• Proof of ownership verified.
• Full user scope in the reserve audit.
• Merkle tree verification is in place.
• Live reserve wallet tracking is publicly available.

Security scored 59/100, dragged down primarily by cookie flag configuration. Penetration testing is current.

We also spotted some gaps where evidence of specific risk management practices was absent:

• Insurance fund or dedicated reserve to cover losses from breaches or theft
• ISO 27001 or CCSS certifications to independently verify operational and cryptographic standards
• Third-party bug bounty platform hosting (e.g., HackenProof or Immunefi) to maximize researcher reach beyond their self-hosted program
• Anti-phishing codes to help users distinguish legitimate exchange communications from spoofed emails

Every gap on that list is also an unsubmitted piece of evidence. Closing them is how VALR can keep moving its PoL down, and it's how any exchange shows users that resilience and transparency are practiced, not advertised. Even current PoL 39.3 leaves a lot of room for improvement. 

💡 Notice on methodology: CORE3 inherited CEX security scores from CER.live and enhanced them with two more domains to aggregate a probability of loss. Solvency and transparency are now part of how we index crypto exchange risk exposure.

More about the full CEX methodology: docs.core3.io/cex-pol-methodology

248 exchanges are indexed under the updated CEX Probability of Loss methodology. The infrastructure is live at core3.io, so any exchange can submit missing data to update its risk index.

VALR was first. And their PoL reflects risk management practices as they are: absent and present. For the remaining 247, the question is the same one VALR already answered: are you willing to prove what you claim?