Skip to main content

Goldsky

Digital asset audit evidence

Talk to our team

What is digital asset audit evidence?

Digital asset audit evidence is the record an auditor needs to confirm a company’s crypto holdings: every wallet it used in the period, each wallet’s balance at the year-end cut-off, the transfers in and out, the prices and proof that the company controls the keys.

Funds, crypto banks, exchanges and companies with crypto on their balance sheet put it together for their financial statement audit, because the auditor has to test that the assets exist, that the list of wallets is complete and that the company has the rights to them.

Goldsky finds the block at your cut-off, reads each wallet’s balance at that block and exports the year’s transfers into your warehouse; pricing, reconciling to your books, proving control of the keys and the auditor’s own testing stay with you, your providers and your auditor.

Who needs digital asset audit evidence?

Crypto funds and asset managers, crypto-native banks, exchanges and companies that hold digital assets on their balance sheet, and the fund administrators who keep their books.

How digital asset audit evidence gets put together

The diagram follows one year-end audit from the list of wallets you used to your auditor testing the evidence against the chain. Your setup may differ.

Your business, step 1: List every walletIncluding ones emptied in the period
Your business, step 2: Set the cut-offOne date, time and time zone
Goldsky, step 3: FeedsFind the cut-off blockThe last block before that time
Goldsky, step 4: EdgeRead balances at that blockEach wallet and token, on EVM chains
Goldsky, step 5: TurboExport the period’s transfersEvery movement in and out, to the cut-off
Your business, step 6: Pricing sourcePrice at the cut-offPrincipal-market price per token
Your business, step 7: Reconcile to your booksBalances and transfers against the ledger
Your business, step 8: Prove controlSign a message or send a test transfer
Your business, step 9: Hand over the evidenceBalances, transfers, prices and proofs
Your business, step 10: AuditorTest the evidenceChecks it against the chain
  • Goldsky
  • Your provider

How to prepare digital asset audit evidence

You fix the cut-off and turn it into a block on each chain, read every wallet’s balance at that block over RPC and export the year’s transfers to your warehouse with a one-time pipeline. Your team then prices, reconciles and proves control before handing the files to your auditor.

What you’ll need

  • Goldsky Turbo
  • Goldsky Feeds
  • Goldsky Edge
  • A full list of the wallets and accounts used in the period
  • A data warehouse or database for the transfer export
  • A pricing source for each asset’s principal market
  • Your accounting system or subledger
  • Access to the keys, or a custodian who can sign for you

  1. List every wallet you used in the period

    Auditors test that your list is complete as well as that the assets exist, so the evidence has to cover every wallet you used.

    Include wallets you emptied before year end, accounts at custodians and exchanges, and addresses you used with DeFi protocols. A wallet left off the list is a gap the auditor can’t close from your files.

  2. Set the cut-off date, time and time zone

    Crypto trades around the clock, so year end needs an exact moment for both balances and prices.

    Pick a convention, such as midnight in your reporting time zone or a fixed UTC time, write it into your policy and use it every period. Transfers after the cut-off but before the period ends still need a look, because they can point to an impairment.

  3. Find the block at the cut-off on each chain

    Handled by Goldsky Feeds

    Chains record time in blocks, so a balance at a moment is read at the last block before it.

    Each chain has its own block times, so resolve the cut-off chain by chain and keep the block numbers in your evidence. A block after the cut-off pulls in transfers that belong to the next period.

    The Feeds Blocks endpoint returns the newest block at or before a time when you call it with timestamp_lte, sort=number_desc and limit=1.

    Turn a timestamp into a block (opens in a new tab)

  4. Read each balance at the cut-off block

    Handled by Goldsky Edge

    The balance at the cut-off block is the figure your books have to agree with.

    Read the native balance and each token’s balance for every wallet at that exact block, from a source whose reliability you can show your auditor, with a Bitcoin node or explorer for Bitcoin wallets. A read left at the newest block returns today’s balance without any error.

    Goldsky’s Edge RPC routes historical requests to archive nodes, so eth_call to a token’s balanceOf and eth_getBalance for the native token both take the cut-off block number.

    Read contract state at a block (opens in a new tab)

  5. Export the year’s transfers

    Handled by Goldsky Turbo

    Auditors trace activity during the year as well as the closing balance, so every movement in and out belongs in the file.

    Pull every transfer to and from your wallets between the opening and closing cut-off blocks, with transaction hashes so each one can be found onchain. The opening balance plus the transfers should equal the closing balance; when it doesn’t, a wallet or a token is missing.

    In job mode, a Turbo Pipelines pipeline runs once over a fixed block range and exits, so an EVM transfer backfill can stop at the cut-off block and write its rows to your warehouse.

    Run a one-time backfill (opens in a new tab)

  6. Price each asset at the cut-off

    Holdings measured at fair value need a price from their principal market at the same moment as the balances.

    Your pricing source supplies the last price before the cut-off in each token’s principal market, with when and where it was taken. A price taken at a different moment than the balance leaves a gap your auditor will ask about.

  7. Reconcile to your books

    Your accounting records are what the financial statements report, so they have to agree with the chain.

    Match each wallet’s balance and the year’s transfers to your subledger and general ledger, and explain every difference. Assets at a custodian or exchange are reconciled to its statements too, since they may sit in addresses shared with other clients.

  8. Prove control of the keys

    A balance only counts as your asset if you can move it.

    You or your custodian sign a message the auditor chooses with the wallet’s key, or send a transfer the auditor specifies. Either shows access at one point in time; showing that nobody else can move the funds takes evidence about your key management controls.

  9. Hand the evidence to your auditor

    Auditors work from what you give them, so the files need to let them redo each figure.

    Include the wallet list, the cut-off blocks, balances, transfers, prices, reconciliations and control proofs, plus any custodian statements and SOC reports. Note where each figure came from, because management has to show that its source of chain data is reliable.

  10. Let the auditor test it against the chain

    Your auditor checks your figures against sources they choose, so the evidence has to hold up to an independent read.

    Auditors may compare your balances with block explorers or their own tools at the same block height, watch a signed message or test transfer, and confirm balances with your custodians. Giving them the block numbers you used lets them compare like with like.

What you control

Your team
  • List every wallet you used in the period
  • Set the cut-off date, time and time zone
  • Reconcile to your books
  • Prove control of the keys
  • Hand the evidence to your auditor
Your providers
  • Pricing source
  • Auditor

Questions and answers

What is proof of control?

Proof of control is evidence that a company can use the private keys of the wallets it reports, usually by signing a message the auditor chooses or by sending a transfer the auditor specifies. It shows access to the keys at one point in time. Whether anyone else also holds the keys is a separate question, which auditors answer by testing the company’s key management controls. The key holder or its custodian produces the proof, because it takes the keys.

Security and deployment

  • SOC 2 Type IIIndependently audited security controls.
  • Dedicated infrastructureSingle-tenant options for production workloads.
  • Data residencyCloud, on-premises or co-located.

More use cases that report on onchain activity

Use cases built the same way

Prepare digital asset audit evidence with Goldsky

We’ll map it to your systems and show you what Goldsky runs, so your team builds the product, not the pipelines underneath it.

Talk to our team

© Endless Sky Inc. All rights reserved.

PrivacyTermsSecurity

System status