Rivol Research

I have submitted the evidence behind my RSquad investigation to the Swiss Federal Supervisory Authority for Foundations. The submission includes eight PDF reports documenting 11 verified transfers totaling 2.64M USDT and 1.25M GRAM, wallet attribution, and…

How TON Ecosystem Reserve legitimized 531M TON mined by Telegram's orbit under the guise of a "community donation" On April 7, 2022, TON Foundation launched TON Ecosystem Reserve under a 3-of-5 multisig, promising TON product integrations, community growth, and partnerships. On April 21, an official TON channel called it a record $1B raise and thanked whales who gave TON "without asking for anything in return." This was not a broad community raise. Nineteen Large Giver miner wallets in a linked cluster contributed 420.32M TON directly. Another 17 linked wallets sent 106.9M to Reserve. Fifteen transferred at least 99.99% of their balances, while two sent 98.98% and 98.89%. Another wallet contributed 4M after receiving 29.27M from a Large Giver miner. The same miner funded an early TON-project payout wallet. Together, 37 linked early-mining wallets supplied 531.22M TON - 99.99% of Reserve inflows. On September 12, 2023, seven Reserve donors and another early miner sent 374.99M to one TON Foundation wallet, from which 353.32M went to Telegram. On November 3, 2023, after an announced address migration, all 531.22M TON moved from the 3-of-5 multisig to a single-key wallet. The controller and reason for reducing control to one key were not disclosed. TON Space, TOP, Web3 Grants, and Telegram integration had already been announced. No Reserve outflow to any of those programs occurred before the migration. From July 28, 2025, 283M TON left Reserve. At least 218.25M went to Telegram - 77.12%. Another 20.23M reached a TON Foundation payment hub. Of 30M sent to eight validator pools, 23.84M returned and 6.15M remained outside Reserve. Two pools remain active. On August 2, another 5M left Reserve: 1.89M went to OKX and 3.09M entered a Binance route. Later sweeps exposed its endpoint - 58F1 -> 1D0A, 1D0A -> 20D7, and 20D7 -> Binance Hot Wallet. Another 2M TON went to a new wallet and remains there. Reserve holds 248.22M. On July 29, one day after the first 100M TON withdrawal, Telegram received 27.51M and 27.43M. On July 31, it signed an agreement with TON Strategy. On August 8, Telegram transferred 149.01M TON to TON Strategy in five material transactions under the $272.7M agreement (1, 2, 3, 4, 5). Because the funds were commingled, the exact Reserve share of that package is 0-54.95M TON. The full 54.95M reached Telegram two days before the agreement. The Open Network Stiftung did not exist during the raise - it was registered on May 3, 2023. The 2022 legal recipient and any transfer of 531.22M TON to the Stiftung were not disclosed. Article 84 of the Swiss Civil Code binds foundation assets to their purpose. If Swiss law governs the gifts and the April promises were accepted conditions, Articles 246 and 249 of the Swiss Code of Obligations allow a donor to demand performance or, after breach, revoke the gift and recover the remaining enrichment. No agreement, valuation, board resolution, or accepted deliverable was published for Telegram's 218.25M. Criminal liability requires proof of a breach of asset-management duty and resulting loss. If the offender acted with a view to securing an unlawful financial advantage for themselves or another, Article 158 of the Swiss Criminal Code provides that a custodial sentence of one to five years may be imposed. No donor publicly demanded a budget, a result, or the return of the gift. Links among Large Giver miners and the near-total balance transfers show these were not 37 unrelated donors, but a connected early-mining cluster linked to Telegram's orbit. Telegram received 218.25M of the 283M TON withdrawn - 77.12%. TON Foundation has named no promised integration, growth campaign, or partnership funded by those 283M TON. In Telegram's wallet, Reserve inflows mixed with the rest of its treasury. From that pool, Telegram sold TON, moved funds to Fragment, and placed 200M across 52 validators to earn rewards. The "community donation" legitimized supply mined by Telegram's orbit as a liquid asset for sales and recurring income. Thread: x.com/realRivol

Как развиваются обновления TON Чтобы обеспечить техническое превосходство TON

How TON Foundation extracted $4.66M through RSquad From Jan 17, 2025 to Jun 19, 2026 TON Foundation sent at least $4.66M to one public RSquad wallet: $2.64M USDT and 1.25M GRAM worth $2.022M when transferred. Earlier addresses and connected wallets are not…

How TON Foundation extracted $4.66M through RSquad From Jan 17, 2025 to Jun 19, 2026 TON Foundation sent at least $4.66M to one public RSquad wallet: $2.64M USDT and 1.25M GRAM worth $2.022M when transferred. Earlier addresses and connected wallets are not included. TON Foundation repeated one cycle three times: when an RSquad product failed to launch, stopped updating, or left TON infrastructure, the same team received the next project. TON BTC Teleport remained on testnet - TON Pay followed. TON Pay stopped moving - Rust Node followed. After the largest transfer, 1.25M GRAM ($2.022M) on Jun 19, the team shipped node/v0.9.0, the final release. Five days later TON removed all ten Rust Node pages from its official documentation. During TON BTC Teleport and TON Pay development RSquad received $2.09M from TON Foundation. No product split was disclosed. Bitcoin bridge development stopped on Dec 10, 2025; another $513K followed in two transfers: $213K and $300K. It never left testnet. On Jul 13, 2026 TON official node tool, MyTonCtrl v2.17.0, removed BTC Teleport entirely. RSquad received $742K on Oct 2, 2025. Twenty-eight days later the TON Pay repository appeared. Its 15 commits provide a checkout UI and SDK for TON or jetton transfers through TON Connect. Payment creation and webhooks remain on closed pay.ton.org; official docs say TON Pay is not a payment processor. No updates followed Mar 18. During TON Rust Node development RSquad received another $2.57M. TON marketed it as a production-grade node built from scratch; the head of TON Core called it an Early Beta Everscale adaptation and warned against mainnet use. The final $2.022M transfer arrived on Jun 19; node/v0.9.0 followed, and public development ended. TON removed it from official docs; no new releases or answers to reported problems followed. Without continuous protocol updates it loses TON compatibility. This is not a maintained C++ alternative but an abandoned Everscale-derived codebase. All three publicly announced TON Foundation developer-support programs in 2026 allocated just $69K in total: Dubai Builders, AI Hackathon, and Fast Grants. RSquad received 37 times more during Rust Node development. Its six-minute trailer, watched just over 1.3K times, cost $40-50K - almost as much as the Foundation has allocated to independent teams and developers since the start of 2026. RSquad had been a TON Foundation contractor for years. The official Gram (TON) channel said it was building a crosschain bridge with Foundation developers, while a 2023 paper was signed “by RSquad Blockchain Lab on behalf of TON Foundation”. Teleport, TON Pay, and Rust Node followed. TOP recruited its Product Manager for roadmap and delivery. RSquad was not independent: it was embedded in TON, while the Foundation and TOP managed and delivered its products. The Russian RSquad company owned by Roman Nguyen and Boris Pimonenko reported RUB 31.9M revenue for 2025. Thirty-nine days before the first investigated payment, RSquad registered its Dubai company, RSQUAD TECHNOLOGIES L.L.C, under licence 1446989. Before Dubai, the same team ran GAGARIN and publicly tied it to Seychelles. Nguyen was co-founder/CTO; Pimonenko was COO. GAGARIN Terms allowed collection of government ID and bank details, payment restrictions, and third-party KYC sharing, yet named only “GAGARIN and its affiliates and subsidiaries worldwide” - no legal entity, address, governing law, or court. The project's GGR token fell 98.7% from ATH. For $4.66M the network received a Bitcoin bridge that never launched, a thin wrapper around closed TON Pay, and an Everscale-derived node abandoned after the final payment. Each time the money stopped, public work stopped, while the same embedded team received the next project. This is not infrastructure development; it is TON Foundation budget extraction through RSquad. What could the network have gained if that $4.66M had supported independent developers instead of one embedded contractor? Thread: x.com/realRivol

Few people realize just how decentralized TON is. - Pavel Durov, replying to Chainspect's post about TON "decentralization" Yes, Pavel. Few do. And you would prefer it stayed that way. Because the moment people stop counting validators and start tracing the money, "decentralization" collapses into one circle that holds the network. And that circle is you. The whole thing holds together only as long as few look.

Telegram's orbit controls two thirds of TON stake - three quarters with its affiliated whales. Genuinely independent money: 8.6%. ton.org sells it as the #2 most decentralized chain. Durov calls TON "one of the most decentralized blockchain networks on the planet", ton.org front-pages "#2". I traced 100% of the foundation's own staking dashboard on-chain. Table: The orbit. Ton Strategy, NASDAQ vehicle of ex-foundation-president Manuel Stotz, holds 27.7%, Telegram's own treasury wallet - 19.4%. Two owners - 47%, enough for a third - and they move as one circle: honest Nakamoto, 1. The trace is worse: Telegram's real footprint is 30.3% - treasury-funded wallets under other flags: a third of Kiln's deposits (6.86M, 5.43M, 5.03M, 4.76M TON in May 2025 to fresh wallets - right into Kiln) and an unlabeled group - 82% treasury-funded (11.1M at link). Add Stotz's TONX and TOP - which holds practically all of TON: top DEX STON.fi, NFT marketplace Getgems, Tonkeeper, the Telegram wallet, Tonstakers, ton.org. Plus Alexander Tamas's Vy Capital - TONX anchor, and Tamas was a registered controller of TOP until late 2024, then Vy's own CFO. Total: the orbit owns 67.9% of the money, Stotz and Telegram alone - 58%. Community pools (Ton Whales, Chorus One): 5.5%. The dashboard misses single-nominator pools (Animoca is there) - 67.9% is a floor. The "independent miners" are one cluster. Another ~8% - 81.4M TON across 29 staking entities - is funded by one 2020 miner cluster: 10 wallets. I scanned the full history of all 10: not one has ever sent anything to an exchange, and five wire straight into the foundation's reserves - the pair behind the Kiln flow: 8M to the Ton Ecosystem Reserve and 1M to TON Foundation, plus ~42M through one hub into Kiln. Money that never cashes out and flows into the foundation's treasuries is not independent capital. Ownership unproven - the path is on-chain. Orbit plus this stake: 76%. Makosov's "proof". On May 12 TON Core head Anatoly Makosov answered the charge: "Contrary to widespread FUD, TON validators are indeed well decentralized" - naming Blockchain.com, Pantera, Kiln, Animoca, P2P.org and Bastion. Check: Blockchain.com and Pantera are not validators - they are investors in Stotz's $558M PIPE, whose filing adds Stotz "also serves on the board of Blockchain.com". Bastion's chair sits on the TON Foundation board. Kiln is real - but 71% of the money inside is the orbit (34% Telegram treasury + 37% foundation-feeding miners), 12% market. Animoca - backed by Kingsway, Stotz's own fund - ex-"largest validator" - ~2M TON, 0.35%. P2P.org discloses no addresses - unverifiable. Its client AlphaTON announced 4M "locked" TON via P2P under BitGo - whose coins, BitGo does not show. Every name is the orbit itself, its board, its investor or its wallet. Asked about centralization, the head of TON Core listed his foundation's investors, board member and money. What 68-76% does. TON runs on stake weight, per its own docs: a third of the weight halts the network - every transfer stops. They cannot take coins, but can keep your address out of blocks - a freeze, no court. Configs change by stake-weight vote: 3/4 passes, a quarter blocks - the orbit blocks alone. It does not need 75: in 2026 validators were called to vote four times - April 2, April 8, April 30 ("support the proposal by Pavel Durov", command included) and June 3. All passed: April confirmed, June is already live in the config (max_stake_factor 4.5 today, as asked). Nothing was ever voted down. A network where one circle can stop every transfer and switch off any address, where a vote is a mailed-out command that always passes, is private infrastructure - you are a guest in it. And "#2 in decentralization"? ton.org takes it from Chainspect: Nakamoto 83. It counts validator nodes - 83 nodes is true. But a node is not an owner - one owner runs dozens. The foundation has the owner count too - its own dashboard, where a third takes 2 entities. It saw both numbers and put 83 on the front page. Thread: x.com/realRivol

tonmate.pro: someone is building a "TON treasury on NASDAQ", and the timing points to the Telegram orbit I came across tonmate.pro while going through TON-related domains. Its header: "The TON Foundation-Aligned, UAE-Backed Treasury," and below it "Traded on NASDAQ." Let me explain what that actually means and why it caught my eye. A "treasury traded on NASDAQ" is a specific model: a public company that holds a crypto asset on its balance sheet, so investors buy its stock to get exposure to the coin. TON already has one, TON Strategy (NASDAQ: TONX), Stotz's vehicle, which proves the model is real. tonmate aims at the same model but brands itself differently: "UAE-Backed", tied to the United Arab Emirates, the exact jurisdiction Vernham declares and the same orbit the entire Gram rebrand is structured through. So it isn't just copying TONX, it's pointing at the Gram/UAE side of this. The NASDAQ claim isn't live: zero SEC filings, no ticker, and the page itself says "Coming soon." So nothing trades yet, it's a stated goal. But "coming soon" also tells you this isn't an abandoned page, it's something they intend to launch, and it's being actively edited, images changed today. Here's what's hard to wave off. The domain was registered 18 Sep 2025, exactly 10 days after the GRAM trademark was quietly moved to Vernham, the BVI shell behind the rebrand, on 8 Sep 2025. Almost nobody knew about that transfer for nearly a year. So whoever built this wasn't reacting to public news, there was none. A name like "tonmate", friend of TON, plays the same game as "Foundation-Aligned": it borrows closeness to TON without proving it. So read it straight. This could be a third party riding the rebrand, that's the simplest explanation. But it could also be an early treasury vehicle for the Telegram orbit, a second one alongside TONX, branded for the new name and being stood up before it's announced. Registered 10 days after a transfer no one knew about, pointed at the same UAE shell, "coming soon" and edited today. That is not what a clueless scam looks like. Either way: NASDAQ trading is a goal, not a fact. Treat the whole thing as unverified until there's an actual SEC filing and a named company. I'm flagging it early so you see it before the money and the "NASDAQ" badge show up to make it look legitimate. Thread: x.com/realRivol

Telegram is renaming Toncoin to GRAM. Here is what the announcement leaves out. On 1 June Pavel Durov announced it: TON's native currency is becoming Gram, ticker TON to GRAM, step 4 of 7 of MTONGA. The network keeps the name TON, no swap, no migration, your…

Telegram is renaming Toncoin to GRAM. Here is what the announcement leaves out. On 1 June Pavel Durov announced it: TON's native currency is becoming Gram, ticker TON to GRAM, step 4 of 7 of MTONGA. The network keeps the name TON, no swap, no migration, your balance is unchanged (10 TON becomes 10 GRAM), transition in about 3 weeks. He linked the new page, gram.org. The same day the official Toncoin channel opened a one-week community vote on TON Vote, weighted by TON balances. I traced this from public records a week before. The trademark, the shell and the lawyers were already on the record, and my findings are archived with dates before 1 June (links at the end). This is about the part the announcement does not mention: who assembled the name, and how. 8 Sep 2025: a BVI shell, Vernham Group Inc, bought the GRAM trademark from Lantah Co (USPTO reel 9184/0626). Three registries record it: USPTO, WIPO, Canada's CIPO. GRAM is the name Telegram chose for its 2018 token and fought Lantah for, through Skadden, and lost. Same registration Vernham owns now. Canada's file even names Telegram as a past opponent. Check: assignmentcenter.uspto.gov (87810181), ttabvue.uspto.gov (91243046), tsdr.uspto.gov (owner Vernham) Vernham's registered address is Commerce House, Wickhams Cay 1, Tortola, c/o the agent Conyers Trust. A US federal seizure warrant gives the exact same address and agent as Telegram's. Same firms too: Conyers ran Telegram's $1.7B bond (Jun 2025), Skadden was its counsel in the 2018 GRAM case. Check: DOJ 26-sz-32 , conyers.com. Five overlaps, one direction: address, agent, offshore firm, coordinating firm, plus a UAE establishment in the same country as Telegram and TOP. My read: about 78% that Vernham sits inside the Telegram/TOP orbit. The announcement and the vote confirmed the rename, not the buyer. I cannot see the owner, the BVI hides it, so this is convergence, not proof. ton.org is now run by the Telegram team (TON Tech, inside the TOP group): corporate Okta and Jamf on the domain, homepage rebuilt from Dec 2025. Durov, 4 May: "Telegram replaces the TON Foundation." And a Foundation insider, Inal Kardan (its gaming lead, co-founder of the $40M TON Ventures fund), built a working ton.org preview with Toncoin renamed GRAM, "Everything runs on Gram," cert-dated 4 Apr 2026, about two months before the announcement. Honest limit: the cert dates the domain, the page was first archived 27 May, so "before step 1" is my inference, and it is his personal box, not official. Check: crt.sh/ton.org. The tell: a community token already named GRAM existed on TON. Weeks before the official rename, Durov personally messaged its creator and told him to drop the name. The creator said so and complied. Telegram filed zero formal IP complaints. Platforms do not clear a name for someone else. Durov's own reason is mine: he says Gram was the currency's original name in the first white paper. I called the rebrand a week early; I had it as the finale (step 7), he placed it at step 4, right call, wrong step number. What he does not say is that the name was bought in 2025, by whom, through which lawyers. Three myths, all false: "GRAM abandoned" - (live marks in US, UK, EU, CA, AU), "Lantah bankrupt" - (it won $625k off Telegram and sold the mark), "lifetime SEC ban on Gram" - (a Section 5 order plus a 3-year notice that expired in 2023). Check: SEC 2020-146. What the announcement and vote confirmed: the rename. What they did not: who owns Vernham, or that Vernham is Telegram. That link is still about 78% in my read, circumstantial, not ownership. I am not telling you it is all proven. I am telling you the rename was on the public record before the announcement, I archived it before, and the announcement will not say who bought the name first. Archived before 1 June: ton.kardan.ddns.net preview: web.archive.org/web/20260531145106/http://ton.kardan.ddns.net/ ; GRM (ex. GRAM) creator's post: archive.ph/WTNiF (https://t.me/tonbase/1299) Full writeup, every source: Substack Thread: x.com/realRivol Read the links, not me.

Channel created