I guess
The Big 4 would do the work. It's how CEX can prove they have what they say they have...
Mazars has paused its activity relating to the provision of Proof of Reserves Reports* for entities in the cryptocurrency sector due to concerns regarding the way these reports are understood by the public,
CZ wrote something similar, how accounting firms don't understand crypto, but Coinbase did it, so whats the problem?
CZ, however, replied that those accounting firms dont work with or understand crypto exchanges (Coinbase literally just received an attestation report from Deloitte), so that is why it has not been audited by one of them.
To avoid such scams with the FTX exchange, you need to prohibit the exchange from managing client deposits. For this violation 1,000,000 life sentences. I used to be an anarchist too, but today everyone understands that cryptocurrency exchanges should be under the control of regulators.
They don't need to be under the control of regulators, but for sure they need to have some proof of reserves. SBF used the client's deposits for his own projects (reserves were in FTT) and with the collapse of FTT he literally ended up with nothing.