Storing TON in 2026: hardware vs software vs custodial

TL;DR. For daily spend under $500 — Wallet in Telegram or Tonkeeper is fine. For $500–5000 — software wallet (Tonkeeper/MyTonWallet) with the seed properly backed up. For $5000+ — Ledger Nano S+/X/Stax. Custodial exchanges (Bybit, OKX) only for short transit before withdrawal. Trezor does not natively support TON as of May 2026 — a critical fact that marketing sometimes obscures. Multi-sig is its own story for teams and large sums.

Storage paradigms

Three fundamental models:

1. Self-custody, hardware. Keys live on a dedicated chip, never leave the device. Signing happens on the device itself.
2. Self-custody, software. Keys on phone or PC, encrypted with a password. Signing in the wallet app.
3. Custodial. Keys held by a third party (exchange, custodian). You hold an IOU, not the TON itself.

Hybrids:

4. Self-custody inside a messenger (Wallet in Telegram, TON Space). Self-custody by form, tied to Telegram account → additional compromise vector.

5. Multi-sig. Self-custody requiring N-of-M signatures. For teams, funds, large amounts.

Comparison table

Hardware: Ledger in detail

As of May 2026 the hardware-wallet landscape for TON looks like this:

• Ledger Nano S+, Nano X, Stax — all three support TON via the official Ledger Live app and pair with Tonkeeper/MyTonWallet over TON Connect.
• Trezor Model One and Model T — do NOT support TON natively or via third-party integrations as of May 2026.
• Keystone 3 Pro, SafePal X1 — announced support, but implementations are partial (signing through mobile app, no native applet).

Using Ledger with TON

1. Buy Ledger Nano S+ (minimum) — $80–100, Nano X with Bluetooth — $150, or Stax with the larger screen — $300+.
2. Install Ledger Live, update firmware.
3. In Apps, find TON and install (~5 minutes).
4. Install Tonkeeper or MyTonWallet.
5. In the wallet pick “Connect Ledger” → select account.
6. The wallet no longer holds your private key. Every transaction is signed on the Ledger.

Step-by-step: Ledger connection guide.

What Ledger does NOT protect against

• Clipboard hijack (malware replacing the recipient address after copy). Ledger signs the tx you confirm on its screen — verifying the address is your responsibility.
• Social engineering — if you type your seed on a phishing site, Ledger cannot save you.
• A compromised Ledger device bought from an untrusted source. Buy only direct from Ledger or via official distributors.

Software: Tonkeeper, MyTonWallet, Tonhub

Tonkeeper

The most popular TON wallet. Mobile + browser extension + desktop. Open-source client app, audited. Supports TON Connect (standard dApp connection), Ledger, jettons, NFTs, in-wallet swap.

Strengths:

• Clean UI, low barrier for newcomers.
• Large dApp ecosystem via TON Connect.
• In-wallet swap powered by STON.fi.

Weaknesses:

• Auth backend is closed source — not fully open source.
• Mobile app requires biometric/PIN but no 2FA for critical operations.

MyTonWallet

Open source, web + extension + mobile. Supports Ledger, multisig, TRON/BTC alongside TON.

Strengths:

• Multi-chain (TON + TRON + BTC).
• Browser extension — convenient for dApps.
• Native multisig.

Weaknesses:

• UI less polished than Tonkeeper.
• Fewer dApp integrations (though TON Connect is a unified standard).

Deep dive: MyTonWallet vs Tonkeeper.

Tonhub

Old wallet (among the first on TON), built by part of the original Gram-era team. Mobile only, open source. Good for users who want minimalism without extensions or built-in swap.

More: is Tonhub worth using.

Self-custody inside Telegram: Wallet and TON Space

Wallet (TON Space) — built-in wallet in Telegram, available via the menu. Architecturally self-custody: the private key is generated on the user device, Telegram does not see it. Backup via cloud-password setup.

Pros:

• No separate app needed.
• Sending TON to other Telegram users by @username is one-tap.
• Low barrier for newcomers.

Cons:

• Tied to the Telegram account. SIM-swap → access to account recovery → possible loss of funds.
• Depends on Telegram policy (terms can change).
• No Ledger support.
• No multi-sig.

More: Wallet in Telegram features and limits.

Custodial: Bybit, OKX, Binance, Bitget

Exchanges hold TON. You see a balance and can trade and withdraw, but you do not hold keys.

When custodial is reasonable:

• Short-term transit before a trade (bought → waiting for a better rate → sold).
• Active trading account.
• Exchange-side staking when you do not want to manage pools (KYC and custodial risk remain).

When custodial is dangerous:

• Long-term HODL.
• Amount > $5K.
• Specific regulatory risks (freezing by geo has happened on several exchanges).

Headline risks:

• Exchange bankruptcy (FTX, Celsius).
• Exchange hack (Mt.Gox, classic).
• Regulatory geo-freeze.
• Internal exchange error (wrong account debit, system bug).

“Not your keys, not your coins” — the golden rule for custodial.

Decision tree by amount

Common-sense rules (any approach)

• Never type your seed anywhere except your own wallet’s initial restore. No forms, no “wallet support”.
• No screenshots of the seed. Do not send it to Telegram/Mail/iCloud.
• Paper seed in two independent places (home + safety deposit / relative).
• Before a large transfer, send a tiny test to the same address to confirm it lands correctly.
• Antivirus and SIM-pin on the phone.
• 2FA on exchange and Telegram via app authenticator, not SMS.
• Every six months, review dApp approvals in the wallet. Revoke forgotten ones.

See also: TON cold storage strategies and seed storage practices.

Storage-choice checklist

• Defined the amount and time horizon.
• Picked storage per the table above.
• Ledger bought from official source, not second-hand.
• Seed written on paper/metal, in two locations.
• Test transaction completed with a small amount.
• 2FA enabled on Telegram and exchange accounts.
• Practised wallet recovery on a test device.

Sources

• Ledger Live supported assets: ledger.com
• DeFiLlama: TON ecosystem TVL
• TON Foundation security guidelines: ton.org/docs
• Tonkeeper, MyTonWallet, Tonhub — official sites (via cloak)