Research: Interconnected whales control 85% of TON tokens

At least 85.8% of the supply is mined by a group of miners that are interrelated and associated with the TON Foundation.

Author: Whiterabbit

Translator: Wu on Blockchain

Note: This article was published on March 14, 2023, with numerous links provided for readers to replicate the research. It is recommended to read the original article.

Introduction

96% of the TON supply was allocated to miners in July and August 2020;
At least 85.8% of the supply is mined by a group of miners that are interrelated and associated with the TON Foundation;
The funds of these miner groups are used by network validators, who control 2/3 of the TON blockchain's PoS consensus;
Currently, the freezing of inactive addresses for 4 years has led TON whales to freeze some funds in an attempt to address blockchain adoption issues, but more steps are still needed;

About TON

The Open Network is a PoS blockchain initially built by the Telegram team but is now supported by third-party developers.

The brief history of The Open Network:

On November 15, 2019, the Telegram team launched testnet2 (now the mainnet);
In May 2020, Telegram paused active participation in network development due to disagreements with the U.S. Securities and Exchange Commission;
Subsequently, the Telegram team decided to distribute test GRAM tokens through a token mining process starting from July 6, 2020;
In May 2021, testnet2 was renamed the mainnet, and then Telegram transferred the permissions of ton.org and related GitHub accounts to the development team continuing the project;
In February 2023, TON validators voted to freeze inactive accounts for 4 years, which accounts for approximately 20% of the total supply.

Mining History

Telegram launched token mining on July 6, 2020, by transferring tokens to 20 contracts from system addresses for token distribution.

There are two types of contract addresses: Small Givers and Large Givers. The latter distributes more tokens each time (100,000 instead of 100) but requires more computational power.

Mining continued from July 6, 2020, to June 28, 2022, but almost all token issuance was completed within the first 51 days:

From July 6, 2020, to August 26, 2020, Large Givers distributed 4.8 billion tokens (96%), and Small Givers distributed 9.9 million tokens (0.2%);
From August 27, 2020, to June 28, 2022, Small Givers distributed 117.3 million tokens (2.35%).

Distribution of tokens by Giver type

It is worth noting that the actual mining by Large Givers ended on August 24, but two addresses received the final 100,000 tokens from each Large Giver on August 26.

The remaining 1.45% was allocated from system addresses during 2019-2020 for testing purposes. Subsequently, most of these funds were transferred to an address of the TON Foundation.

Distribution of tokens between Giver contracts

Since the end of mining, the test GRAM tokens were renamed as the mainnet TON tokens, and their fully diluted market value grew from 0 to 11 billion USD within three years.

Most of the major token holders (Large Givers miners in 2020) still hold these tokens. Some of them may have long-term plans for the TON ecosystem, but at the time of writing this article, there is no liquidity for selling tokens in the market. According to CoinMarketCap data, the depth of TON tokens on centralized exchanges is approximately 200,000 to 400,000 USD at -2% and +2% levels (link). Currently, it is almost impossible to sell TON tokens on the open market, as this would cause drastic price changes.

Token Distribution Analysis

A total of 3,278 unique addresses participated in mining, but only 248 addresses participated in the distribution of Large Givers. We will focus on these 248 addresses because Large Givers distributed 96% of the TON supply.

Therefore, we know that 96% of the TON supply was distributed to 248 addresses. In addition, these 248 addresses are closely related: we found many groups of miner addresses that are interrelated and have the same patterns, such as the start and end times of mining or the operations of mined tokens. We also found some retail activity, but most of the token supply was mined by a group of closely related whales.

Based on on-chain analysis, we identified several groups involved in the distribution by Large Givers and linked them to the TON Foundation and its associated members:

The first group "July 6 - July 30" mined 22% of the supply;
The second group "July 30 - August 24" mined 20% of the supply;
The third group "July 6 - August 24" mined 18.8% of the supply;
The fourth group "July 19 - August 24" mined 17.2% of the supply;
Other smaller groups started from August 1 and mined 7.8% of the supply.

According to our calculations, addresses associated with the TON Foundation control at least 85.8% of the supply.

First group: July 6 - July 30

We found a group of 36 addresses that started mining from the first day (each address received the first reward between 18:55 on July 6 and 01:04 on July 7) and ended mining on July 30:

36 addresses stopped mining on the evening of July 30

The group has 20 active addresses and 16 inactive addresses, which were frozen for 4 years after the validator vote. The active addresses hold 650 million TON.

Some other statistical data about these addresses:

1) 17 of the 20 active addresses have the same pattern: each address only conducted one transaction to withdraw all funds, transferring the funds to a third-party address between October 10, 2021, and December 18, 2021. Some withdrawals occurred on the same day:

December 10, 2021: z6oH, KKeo, and X0zB withdrew within three minutes of each other;
December 17, 2021: X2i3 and _QHG withdrew within ten minutes of each other;
October 26, 2021: 5Dk8 and A1DI withdrew six hours apart;

2) The other 3 active addresses conducted more transfers, with one (Pvgy) donating to the TON Foundation and using it for staking;

3) All of these addresses mined tokens from 20 Large and Small Giver contracts.

These factors indicate that this group of addresses is managed by a large whale. We do not claim that only one beneficiary controls this whale. It could also be a closely-knit group:

These nodes started mining from the beginning. It is difficult to create and launch a mining pool with strangers just a few hours after the announcement;
16 mining addresses have not moved funds (miners have the private keys = miners still control these 16 addresses);
Most active addresses (15 out of 19) hold tokens without any activity: tokens only moved from 15 addresses to another 15 addresses.
The identity of the whale is not clear, but we show below that this group is closely linked to other groups that interact directly with the TON Foundation.

This group mined 1.1 billion TON (22% of the supply).

Second group: July 30 - August 24

The previous group of 36 nodes ended mining on July 30. After shutting down all 36 nodes on the evening of July 30, a new group of 26 nodes started on the same day:

All addresses of this group stopped mining on August 24, 2020 (link, "July 30 - August 24" table)

The last reward date received by the first group (July 6 - July 30) was July 30, 20:24:59. The first reward date received by the second group (July 30 - August 24) was July 30, 20:25:47. So, there was only a 48-second gap between these two groups without mining rewards.

More statistical data about this group:

22 addresses are active, and 4 addresses were frozen after the validator vote;
This group's addresses actively donated to the TON Foundation: 6 addresses donated all tokens, and 12 addresses donated 10% to 40% of their remaining balance. The donation of 100% of funds by 6 addresses may indicate that the owners of these addresses have other addresses holding tokens.
Three addresses participated in staking (wFRl, 1bqw, and Owud): they sent funds to addresses interacting with the Elector contract. It is worth noting that Owud created multiple staking accounts by sending tokens to 13 unique addresses. Each address is a unique validator.

As mentioned earlier, actual mining by Large Givers ended on August 24, but the final tokens were distributed to two addresses on August 26:

Large Givers distributed 100,000 tokens each time, but in the final transaction, each address still had approximately 99,560 tokens left (100,000 minus the gas fee from previous transactions).
F81K sent 430-450 tokens to each address, bringing the balance of Large Givers back to 100,000.
These transfers seem to have completed the mining, with F81K mining 8 out of the last 10,000 tokens in 10 Large Givers addresses. The remaining 2 were mined by DjPI.

Daily calculation of Large Givers token distribution

Starting 26 nodes in one night is the largest number of nodes started in a single day since July 6, and these nodes also mined tokens from all 20 Givers, just like the first group. Given the 48-second gap between these two groups without mining rewards, it indicates that this group of addresses is coordinated by one operator.

What is the reason for shutting down nodes and restarting from different addresses? We did not find any technical reasons, but one theory is to represent decentralization.

This group mined an additional 1 billion TON (20% of the supply).

Third group: July 6 - August 24

As mentioned earlier, a group of 36 nodes started on July 6 and ended on July 30, but may have continued at other addresses.

Simultaneously with the first group (from the beginning), another group of 14 nodes started on July 6 and continued mining until August 24:

"July 6 - August 24" table

This group is connected to the first group that operated from July 6 to July 30:

The Vqwi address of this group and the X0zB and KKeo addresses of the first group likely have a common beneficiary. The funds of these three addresses (each with over 40 million tokens) are concentrated in the wqrH address.
13 out of 15 addresses are active. 11 of them have the same pattern as the first group: each address conducted only 1 withdrawal transaction between November 2, 2021, and January 14, 2020, transferring funds to a third-party address.
This group includes putF - a key address involved in TON-related operations, connecting us to other node groups. We will come back to this address later.

This group additionally mined 940 million TON tokens (18.8% of the supply).

Fourth group: July 19 - August 24

There is another group of 17 mining addresses, which we link to the previous group. All addresses of this group received the first reward on July 19 and ended mining on August 24:

"July 19 - August 24" table

This group includes the n__T and oQMb addresses, which are connected to the key address putF of the third group through BDa2:

oQMb sent 1 million TON to n__T via two proxy addresses (gHKM, b_g5) (link) and 1 million TON to 8WcG. 8WcG is connected to BDa2 through mutual transfers;
BDa2 sent funds to CcQ8, and CcQ8 received funds from putF.

Connection between the fourth group and the third group

Additionally, the funds of w2Qp were used to provide liquidity for the integration with OKEX and FTX. This links the w2Qp address to the TON Foundation team:

OKEX TONCOIN listing announcement on November 12, 2021 (link) > 10 million TON traded to OKEX on November 12, 2021 (link);
FTX listing announcement on November 11, 2021 (link) > 10 million TON traded to FTX on November 12, 2021 (link).

This group further mined 859 million TON (17.2% of the supply).

Therefore, the fourth group of mining addresses may be related to TON Foundation contributors and the previous third group (July 6 - August 24). Thus, all four groups studied in this research are interconnected:

Connections between the first four groups

These 4 groups mined a total of 3.9 billion TON tokens (78% of the supply).

Other smaller groups connected to previous groups

Several smaller groups started mining in August and are related to the aforementioned four groups.

Fifth group: August 1

This group consists of 13 addresses, centered around two large miners: w_VD and NL1O. They both received their first reward on August 1 and stopped mining on August 24:

"August 1" table

The addresses in this group are closely connected through mutual transactions or via intermediate addresses:

NL1O aggregated funds from fq1d, cnw0, wQ66, CmsJ, and sent some tokens to w_WD through the dVZ_ address;
NL1O, along with a1Tl, _5as, and Qnur, sent tokens to multiple staking contracts with a common beneficiary.

Connections of the fifth group

This group is connected to the previous four groups: NL1O sent over 49 million TON to BDa2 (an intermediate address of the fourth group).

It also has direct connections to the TON core community members through LJwP. We identified several core community members' wallets using the Tonscan address book.

LJwP sent 1000 TON multiple times to Oleg Illarionov (brainfucker.ton, co-founder of TON Keeper) (1, 2, 3);
LJwP sent 100 TON to some addresses of Oleg Andreev (co-founder of TON Keeper). It also received 0.1-0.9 TON multiple times (1, 2, 3, 4, etc.). Additionally, LJwP sent 600,000 TON to d8O2, associated with the Tonkeeper team. This address then sent 506,803 TON to T3_d and 20,000 TON to PLZR. These two wallets are also associated with Oleg Andreev.
LJwP sent 3,300 TON and 100 TON to 968m (a wallet associated with Kirill Malev, partner at First Stage Labs). This address has many mutual transactions with Kirill Malev's main address malev.ton (1, 2, 3, 4, 5, 6, 7, 8, etc.) and owns NFTs from the TON DOGS collection marked "malev".

Considering Kirill Malev's main address malev.ton, he received TON from 44O-i, which came from wFRI of the second group and 5_Dx of the fourth group:

Connections between the fourth and fifth groups and community members

Sixth group: August 8 - 26

This group consists of 68 addresses with similar behavioral patterns. There are six key addresses in this group: Dwmn, Lwtm, F81K, M63-, tTFy, and tEVL. They mined between 38 million and 45 million TON from August 8 to August 26. Other addresses sent all their funds to one of the major miners on August 7, except for tTFy, without mining over 900,000 TON.

This group has two subgroups:

The first includes Dwmn, M63-, tTFy, and tEVL. These addresses are connected through b4E9 and several other intermediate addresses;
The second subgroup includes Lwtm and F81K.

Connections of the sixth group

All miners in this group received 0.01 TON from 2kJT as one of the first transactions - this address was created three hours after the launch of the mainnet (testnet2) on November 15, 2019.

We also found that the third, fourth, fifth, and sixth groups are connected through the previously mentioned BDa2. Additionally, the sixth group is connected to the fifth group through some other addresses (such as AzQO and 91Gj).

Connections between the third, fourth, fifth, and sixth groups

Seventh group: August 18 - 24

This group consists of 4 addresses, which started mining on August 18 or 19. Three of the addresses received their final reward on August 24:

"August 18 - 24" table

This group has several clear connections to other groups:

iE3g sent all funds to LJwP of the fifth group;
PQY_ is connected to the sixth group through dRZJ (see the diagram above);
qzub is connected to other groups through BDa2. They all sent TON to the iPIP address.

There is also an interesting connection with the ceg_ wallet. It was the first wallet to send funds to the first address of the TON Foundation (25 TON test transaction). Additionally, it is the only address to receive TON from the first address of the TON Foundation: received 12 TON shortly after the first transaction, and 7.5 TON a week later. This clearly indicates a connection to the TON Foundation.

All August groups collectively mined 380 million TON (7.8% of the supply).

Validators

So, what about the current validators? We analyzed the incoming and outgoing transactions of a group of validators as of February 25 to understand their connection to the mining groups.

Out of the 272 active validators at that time, we found that 170 validators are related to the discussed mining groups. Additionally, 12 validators received funds directly from the TON Foundation through direct transactions or proxy addresses.

Therefore, approximately 66.9% of validators (182) received funds from the defined mining groups, which may be controlled by early TON mining groups.

The detailed results are as follows:

https://docs.google.com/spreadsheets/d/1AfWDtz6HYUDqtoFhajOlg98O2gY-4qyBKDIKOFEy5FQ/edit?gid=2026731715#gid=2026731715

Basically, we grouped the validators based on the mining groups. For example, the sixth group miner Dwmn sent 46.2 million TON to 5cNc, which distributed about 20 million TON (1.5 million TON per validator) among 20 validators. So, we classified all these validators as the sixth group.

Additionally, we created a group of validators connected to the BDa2 address. As mentioned earlier, this address is a connection point between the 2nd, 4th, 5th, and 6th mining groups, and 55 validators are associated with this address.

Data Source

We used public APIs to retrieve data about TON miners. We share this data for the reproducibility of the research and the convenience of further analysis:

Raw data
Structured data
Scripts used to retrieve the data

Conclusion

At least 85.8% of the token supply is allocated to several potentially interconnected mining groups. The groups controlling these addresses are slowly releasing TON tokens into the market, limiting their supply and providing a low liquidity effect, which positively impacts the TON price.

We cannot determine who specifically manages these addresses, but we assume that at least some groups are collaborating with the TON Foundation:

This group provides liquidity of tens of millions of TON tokens to centralized exchanges. The integration with these exchanges is announced and managed by the TON Foundation;
Some tokens from this group are transferred to TON core community members;
Some addresses of this group are used for test transactions with the TON Foundation, exchanges, and other services;

The proposal to freeze some addresses is a step towards reducing the issue, as the active token amount of this large whale will decrease. In fact, this whale voted to freeze some of their addresses.

However, this measure does not solve the problem of token adoption, as the utility of the tokens remains very limited. These few mining groups will continue to hold the majority of the supply, and other potential investors will see the risk of token distribution centralization.

As part of the token distribution, these mining groups send funds to the TON Foundation, which already has 570 million TON on its addresses (Address 1, Address 2). We would not be surprised if the TON Foundation starts more actively distributing tokens to the community and key ecosystem projects in the near future to address the issue of blockchain adoption.

Message from the TON Foundation

In the final stage of the research, we contacted the TON Foundation team to get their feedback on our analysis. The TON Foundation reviewed the data to further enhance transparency and engage in public discussions within the community:

We are well aware of the complexity of the ecosystem and believe that our mission is to help everyone navigate it. This in-depth analysis of the TON blockchain, through a deep dive into its mining history, has revealed the current state of the ecosystem and provided a clear path to strengthen decentralization. We believe that through the collective efforts of all stakeholders, we can achieve this goal. Finally, we urge all users to actively participate in building a secure, transparent, and healthy crypto ecosystem. The future of TON is in everyone's hands.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。