TON blockchain: a group of related whales mined 85% of TON supply

Generated by Midjourney

TL; DR:

• 96% of the TON supply was distributed to miners during July and August 2020;
• At least 85.8% of the supply was mined by a few groups of miners connected with each other and affiliated with TON Foundation;
• Funds from these miner groups are used by network validators that control 2/3 of the TON blockchain PoS consensus;
• The current vote to freeze inactive addresses for 4 years causes TON whales to freeze some of their funds trying to solve the problem of blockchain adoption, but additional steps are required to be taken in this direction;
• We share the data collected from the TON blockchain for the reproducibility of our research.

About TON

The Open Network is a Proof-of-Stake blockchain, which was originally built by the Telegram team but is now supported by third-party developers.

A quick history of The Open Network:

1. testnet2 (which is currently mainnet) was launched by the Telegram team on November 15, 2019 (link).
2. In May 2020, Telegram suspended active participation in the development of the network due to disagreements with the U.S. Securities and Exchange Commission (link).
3. Subsequently, the Telegram team decided to distribute test GRAM tokens via the token mining process that started on July 6, 2020 (link).
4. In May 2021, the testnet2 was renamed to Mainnet (link) and later Telegram transferred the rights to ton.org and the related GitHub account to the development team, who continued to work on this project (link).
5. On February 2023, TON validators voted to freeze inactive accounts for 4 years, which is about 20% of the total supply (link).

History of mining

Telegram launched token mining on July 6, 2020, by transferring tokens from the system address to 20 contracts that distributed coins.

Contract addresses were of two types: Small Givers and Large Givers. The second distributed more coins (100 000 instead of 100 each time) but required more computing power.

Mining continued from July 6, 2020, to June 28, 2022, but almost all token emission was distributed during the first 51 days:

• From July 6 to August 26, 2020, Large Givers distributed 4.8bn (96%) tokens, Small givers gave away 9.9 mn tokens (0.2%);
• From August 27, 2020, to June 28, 2022, Small Givers distributed 117.3 mn tokens (2.35%).

Token distribution by Giver type

It worth mentioning that de-facto Large Givers mining was ended on August 24, but two addresses received the last 100 000 tokens from each Large Giver on August 26.

The remaining 1.45% were distributed in 2019–2020 from the system address for testing purposes. Subsequently, most of these funds were moved to one of the TON Foundation addresses.

Token distribution among Giver contracts (link, sheet “Givers”)

Since the end of mining, the test GRAM tokens were renamed to mainnet TON tokens and their Fully Diluted Market Capitalization has grown from 0 to $11 billion in three years.

Most major token holders (Large Givers miners from the year 2020) still hold the tokens. A significant part of them might have long-term plans for the TON ecosystem, but anyway there is no exit liquidity for selling tokens on the market at the moment of writing. According to CoinMarketCap, TON token depth -2% and +2% is near $200–400k on centralized exchanges (link). It is mostly impossible to sell TON tokens on public markets without a dramatic change in market price.

Analysis of token distribution

There are 3278 unique addresses that participated in mining, but only 248 addresses took part in the Large Givers distribution. We will focus on these 248 addresses because Large Givers distributed 96% of the TON allocation.

So, we know 96% of TON allocation was distributed between 248 addresses. In addition, these 248 addresses are strongly connected: we discover many groups of miner addresses that are associated with each other and have the same patterns like the start and end time of mining or actions with mined tokens. We also found some retail activity, but most of the token supply was mined by a group of whales that interacted with each other.

According to the on-chain analysis, we distinguish several groups that participated in the Large Givers distribution and connect them with the TON Foundation and affiliated members:

1. The first group “July 6 — July 30” — 22% of the supply mined;
2. The second group “July 30 — August 24” — 20% of the supply mined;
3. The third group “July 6 — August 24” — 18.8% of the supply mined;
4. The Fourth group “July 19 — August 24” — 17.2% of the supply mined;
5. Other smaller groups started from August 1–7.8% of the supply mined.

Conforming to our calculations, the addresses connected to the TON Foundation control at least 85.8% of the supply:

Let’s dive into each group!

First group: July 6– July 30

We found a group of 36 addresses that started mining from the first day (each of the addresses received the first reward between 18:55 July 6 and 01:04 July 7) and ended mining on July 30:

All 36 addresses stopped mining on the evening of July 30 (link, ”July 6 — July 30” sheet)

This group has 20 active and 16 non-active addresses which are frozen for 4 years after the validators vote. Active addresses hold 650 mn TON.

Some other statistics about these addresses:

1) 17 out of 20 active addresses have the same pattern: only 1 withdrawal transaction with all funds was made from each of them to a third-party address between October 10 and December 18, 2021. Some withdrawals were made on the same day:

• December 10, 2021: three minutes range between z6oH, KKeo, and X0zB withdrawals;
• December 17, 2021: ten minutes range between X2i3 and _QHG withdrawals;
• October 26, 2021: six hours range between 5Dk8 and A1DI withdrawals;

2) The other 3 active addresses made more transfers, and one of them (Pvgy) donated to TON Foundation and was used for staking;

3) All these addresses mined tokens from all 20 Large and Small Giver Contracts.

These factors indicate that this group of addresses was managed by one large whale. We don’t claim that there is only one beneficiary controlling this whale. It can also be a group of people, but this group of people is tightly connected with each other:

• these nodes started mining from the very beginning. It would be hard to create and launch a mining pool with unfamiliar people just a few hours after the announcement;
• 16 mining addresses didn’t move the funds (the miner has private keys = the miner still manages these 16 addresses);
• most of the active addresses (15 out of 19) are holding the tokens without any activity: tokens were only once moved from 15 addresses to 15 other addresses.

The identity of the whale remains unclear, but below we show that this group is tied to the other groups directly interacting with TON Foundation.

This group mined 1.1 bn TON (22% of the supply).

Second group: July 30– August 24

The previous group of 36 nodes ended mining on July 30. Right after turning off all of the 36 nodes on the evening of July 30, a new group of 26 nodes was launched on the same day:

All addresses from this group ended mining on August 24, 2020 (link, ”July 30 — August 24” sheet)

The last reward that the first group (July 6 — July 30) received is dated 08:24:59 pm July 30. The first reward that the second group (July 30 — August 24) received is dated 08:25:47 pm July 30. So, there was only 48 seconds gap without mining rewards between these two groups.

More statistics about this group:

• 22 of the addresses are active, and 4 addresses are frozen after the validators vote;
• Addresses from this group were actively donating to the TON Foundation: 6 of them donated all tokens, and 12 of them donated from 10% to 40% of their balances. The fact that 6 addresses donated 100% of the funds could indicate that the owner of these addresses has other addresses where the tokens remain.
• Three of the addresses participated in staking (wFRl, 1bqw and Owud): they sent money to addresses that interacted with the Elector contract. It is worth mentioning that Owud created multiple staking accounts by sending tokens to 13 unique addresses (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13). Each of these addresses is a unique validator.

As we said above, de-facto Large Givers mining ended on August 24, but the last coins were distributed between two addresses on August 26:

1. Large Givers were distributing 100k tokens each time, but for the last transaction, they had near 99 560 tokens left on each address (100k minus gas fees for previous transactions).
2. F81K sent 430–450 tokens to each address to make Large Givers balances 100k again.
3. It seems that these transfers made it possible to finish the mining and F81K mined 8 out of 10 last 100k on 10 Large Givers addresses. 2 were mined by DjPI.

Large Givers token distribution by days

Launching 26 nodes in one evening is the largest launch of nodes in one day since July 6, and these nodes also (as the first group) mined from all 20 Givers. Given the gap of 48 seconds without mining rewards between these two groups, it seems that these two groups of addresses are coordinated by one operator.

What could be the reason for turning off the nodes and turning them on again from different addresses? We didn’t find any technical reasons for it, but one theory is to signal decentralization.

This group mined another 1 bn TON (20% of the supply).

Third group: July 6 — August 24

As we wrote above a group of 36 nodes was launched on July 6 and ended on July 30 but probably continued under other addresses.

At the same time as the first group (from the very beginning), another group of 14 nodes was launched on July 6, but this group was mining tokens till August 24:

link, “July 6 — August 24” sheet

This group has connections with the first group that operated from July 6 to July 30:

• Vqwi address from this group and X0zB and KKeo from the first group most probably have one beneficiary. Funds from these three addresses (40+ mn tokens from each address) were aggregated in wqrH address.
• 13 addresses are active out of 15. 11 of them have the same pattern as the first group: only 1 withdrawal transaction was made from each of them to a third-party address between November 2, 2021 and January 14, 2020.
• This group includes a putF — a key address for the TON-related operations that connect us to other groups of nodes. We will return to this address later.

This group mined additional 0.94 bn TON tokens (18.8% of the supply).

Fourth group: July 19 — August 24

There is another group of 17 miner addresses that we connect to the previous one. All addresses from this group received the first reward on July 19 and ended mining on August 24:

link, “July 19 — August 24” sheet

This group includes n__T and oQMb addresses that are connected to the putF (a key address from the third group) via BDa2:

• oQMb sent 1 mn TON to n__T (link) and 1 mn to 8WcG via two proxy addresses (gHKM, b_g5). 8WcG is connected with BDa2 via mutual transfer;
• BDa2 sends money to CcQ8 which receives funds from putF.

Fourth <> third groups connection

Also, funds from w2Qp were used to provide liquidity for OKEX and FTX integrations. That links the w2Qp address with the TON Foundation team:

• OKEX TONCOIN listing announcement November 12, 2021 (link) <> 10 mn TON transaction to OKEX November 12, 2021 (link);
• FTX listing announcement November 11, 2021 (link) <> 10 mn TON transaction to FTX November 12, 2021 (link).

This group mined another 0.859 bn TON (17.2% of the supply).

So, the fourth group of miners addresses is likely related to TON Foundation contributors and the previous third group (July 6 — August 24). Accordingly, all 4 groups from the research are connected with each other:

Connection between the first four groups

These 4 groups mined 3.9 bn TON tokens (78% of the supply).

Other smaller groups connected to the previous ones

There are several smaller groups that started mining in August and are connected with the four groups mentioned above.

Fifth group: August 1

This group consists of 13 addresses, which are centered around two large miners: w_VD and NL1O. Both of them received their first rewards on August 1st and stopped mining on August 24:

link, “August 01” sheet

Addresses in this group are tightly connected either through mutual transactions or through intermediate addresses:

• NL1O aggregates funds from fq1d, cnw0, wQ66, CmsJ and sends some tokens to w_WD through dVZ_ address;
• NL1O together with a1Tl, _5as, and Qnur send tokens to multiple staking contracts with one beneficiary.

Fifth group connections

This group is connected with the previous 4 groups: NL1O sent more than 49 mn TON to BDa2 — an intermediate address for the fourth group.

It also has direct connections with the TON core community members through LJwP. We used the Tonscan address book to determine several core community members’ wallets.

• LJwP sent 1 000 TON to Oleg Illarionov (brainfucker.ton, TON Keeper co-founder) a few times (1, 2, 3);
• LJwP sent 100 TON to one of Oleg Andreev’s (TON Keeper co-founder) addresses. It also received 0.1–0.9 TON miltiple times (1, 2, 3, 4, etc.). In addition, LJwP sent 600 000 TON to d8O2, which is related to Tonkeeper team. This address then sent 506 803 TON to T3_d and 20 000 TON to PLZR. Both of these wallets are related of Oleg Andreev as well.
• LJwP sent 3 300 TON and 100 TON to 968m, the wallet which is related to Kirill Malev (First Stage Labs partner). This address has many mutual transactions with Kirill Malev’s main address malev.ton (1, 2, 3, 4, 5, 6, 7, 8, etc.) and owns NFT from the TON DOGS collection labeled “malev”.

Considering Kirill Malev’s malev.ton main address, he received TON from 44O-i which is funded by wFRI from the second group and 5_Dx from the fourth group:

Connections between fourth and fifth group and community members

Sixth group: August 8–26

This group contains 68 addresses that share similar behavior patterns. There are six key addresses in this group: Dwmn, Lwtm, F81K, M63-, tTFy, and tEVL. All of them mined from 38 to 45 mln TON during the period from August 8 to August 26. The other addresses mined no more than 0.9 mln TON and sent all of their funds to one of the large miners (except tTFy) on August 7.

This group has 2 subgroups:

• the first includes Dwmn, M63-, tTFy, and tEVL.These addresses are connected through b4E9 and several other intermediate addresses;
• the second subgroup includes Lwtm and F81K.

Sixth group connections

All miners from this group received 0.01 TON as one of the first transactions from 2kJT — an address that was initiated on November 15, 2019, three hours after the mainnet (testnet2) launch.

We also found that the third, fourth, fifth, and sixth groups are connected via BDa2 which was mentioned earlier. In addition, the sixth and the fifth are connected via a few more addresses (for example, AzQO and 91Gj).

Connections between third, fourth, fifth, and sixth groups

Seventh August 18–24

This group consists of 4 addresses that started mining on August 18 or August 19. Three of them received their last rewards on August 24:

link, “August 18–24” sheet

The group has several clear connections with the others:

• iE3g sent everything to LJwP from the fifth group;
• PQY_ is connected with the sixth group through dRZJ (see the schemes above).
• qzub is connected with other groups via BDa2. They both sent TON to iPIP address.

There is also an interesting issue related to ceg_ wallet. It was the first wallet to send funds to TON Foundation’s 1-st address (25 TON test transaction). Moreover, it is the only address that has received TON from TON Foundation’s 1-st address: 12 TON just after the first transaction and 7,5 TON one week later. This is a clear marker of connection with the TON Foundation.

All August groups mined 0.38 bn TON (7.8% of the supply).

Validators

What about current validators? We analyzed incoming and outcoming transactions of current blockchain validators in terms of their connection with the mining groups.

The data was collected on February, 25, and we made an analysis of one group of validators (TON doesn’t unfreeze validators’ stake right after the epoch, so there are two groups of validator addresses that replace each other after each epoch).

We found 170 validators that are connected with the discussed mining groups among 272 active validators at that moment. In addition, there were 12 validators that received funds from TON Foundation either through direct transactions or through proxy addresses.

So, there are 182 (~ 66,9%) validators that received funds from defined mining groups which are possibly under the control of the described group of early TON miners.

The detailed results are presented here.

Basically, we grouped validators according to the mining group. For example, Dwmn from the sixth group of miners sent 46.2 mn TON to 5cNc, which distributed ~ 20 mn TON among 20 validators (1.5 mn TON each). So, we relate all these validators to the sixth group.

Also, we created a group of validators connected to the BDa2 address. As discussed earlier, this address is a connector between miners from groups 2, 4, 5, and 6 and there are 55 validators related to this address.

Data source

We used public API to retrieve the data about TON miners. We share it for the reproducibility of our research and easiness of making other analyses:

• Raw data
• Structured data
• Script we used to get data

Conclusions

At least 85.8% of the token supply was distributed between several groups of miners probably connected to each other. The group of people that controls these addresses slowly releases TON tokens into the market limiting its supply and providing a low liquidity effect that has a positive impact on the TON price.

We cannot say for sure who exactly manages these addresses, but we assume that at least part of the group is collaborating with the TON Foundation:

• This group sent tens of millions of TON tokens to provide liquidity on centralized exchanges. Integrations with these exchanges were announced and managed by TON Foundation;
• There are few token transfers with sufficient amounts from this group of miners to TON core community members;
• Some of the addresses from this group were used to make test transactions with the TON Foundation, exchanges, and other services;

The current initiative to freeze some of the addresses is a step towards reducing the problem because the number of active tokens of this large whale will decrease. In fact, the whale voted to freeze some of their addresses.

However, the problem of blockchain adoption is not solved by this initiative as the token utility is still very limited. These few mining groups will continue to own the main part of the supply, and other potential investors will see risks in the centralization of token distribution.

As a part of token distribution, these mining groups send funds to the TON Foundation, which already has 570 million TON on its addresses (address 1, address 2). We won’t be surprised if the TON Foundation starts distributing tokens to the community and key ecosystem projects more aggressively in the near time to solve the problem of blockchain adoption.

A few words from TON Foundation

At the final stage of the research, we reached out to the TON Foundation team to get their feedback on our analysis. TON Foundation reviewed the data to further strengthen transparency and engage in public discourse within the community:

We understand as no other how complex the ecosystem is, and consider it our mission to help navigate it. This thorough analysis of the TON blockchain through a deep dive in its mining history, reveals a lot about the current state of the ecosystem and provides a clear path on what needs to be done in order to make sure that decentralization is strengthened. We are confident that by engaging with the effort from all stakeholders, together, we can make this happen.
Finally, we call on all users to actively participate in building a secure, transparent, and healthy crypto-ecosystem. The future of TON is in everyone’s hands.

Whiterabbit is a crypto research and consulting company that works both with builders and VCs to provide the best possible support for genuine crypto projects.

Contact: hello@whiterabbitsolutions.io
Follow us on Twitter for new research papers: https://twitter.com/whiterabbit__hq