Fogo has restarted its mainnet after recovering and permanently removing 237 million of the 400 million FOGO tokens stolen in a security incident that forced the Layer 1 blockchain to halt operations.
- Fogo has restarted its mainnet after a security incident involving 400 million FOGO tokens forced the Layer 1 blockchain to halt operations.
- The project recovered 237 million FOGO tokens and permanently removed them from the total supply.
- Another 163 million FOGO remain unrecovered, with Fogo working with centralized exchanges and law enforcement to trace the affected assets.
- Fogo has yet to disclose how the Foundation was compromised, with its investigation into the incident still ongoing.
Fogo said in its latest update that the mainnet was operating normally again, while efforts to recover the remaining affected tokens were continuing with centralized exchanges and law enforcement.
Fogo mainnet has restarted after 237 million FOGO recovery
The restart comes several days after Fogo stopped its blockchain on Aug. 29 to prevent the attacker from moving tokens received during a compromise involving the Fogo Foundation.
Of the 400 million FOGO taken during the incident, 237 million have now been recovered and permanently removed from the token’s total supply, the project said. That leaves 163 million FOGO from the original amount that have not been reported as recovered.
“Efforts to recover the remaining affected assets are ongoing with CEXs and law enforcement,” Fogo said.
The project did not provide further details on how the 237 million tokens were recovered or the process used to permanently remove them from supply. Fogo said its investigation remained underway and asked users to rely on its official channel for further information.
The latest update gives the network a clearer recovery figure after several days of uncertainty over the status of the stolen assets, though Fogo has yet to publish a full account of how the compromise occurred.
Fogo initially disclosed the incident on Aug. 28, when the Foundation said an unknown actor had compromised the organization and transferred 400 million FOGO to what it described as a “bad actor.”
At the time, the Foundation said the blockchain itself had not been affected and continued operating normally. Exchanges, law enforcement agencies and forensic specialists had been notified as the project began tracing the assets.
That changed the following day when Fogo halted the network while validators prepared an upgrade. The pause was intended to stop further movement of the affected tokens, with the project providing no restart time when it announced the action.
Stolen FOGO represented more than 10% of circulating supply
The 400 million FOGO involved in the incident represented 4% of the blockchain’s 10 billion-token genesis supply and more than 10% of the circulating supply at the time.
FOGO was trading near $0.0075 when the network was halted, putting the value of the affected tokens at approximately $3 million based on DefiLlama data.
Exchange restrictions had started shortly before the Foundation publicly disclosed the compromise. Bitget suspended FOGO deposits and withdrawals around an hour before the first announcement and cited wallet maintenance, while KuCoin later introduced similar restrictions.
Fogo did not disclose which addresses or systems within the Foundation had been compromised, and its latest statement does not identify the attack vector. No complete post-incident report has been released as the investigation continues.
The response follows several security incidents this year in which blockchain projects have worked with exchanges and law enforcement to contain stolen or improperly created tokens.
In August, crypto.news previously reported that Harmony proposed a chain rollback after forged ONE tokens spread across its network. Harmony’s proposed recovery plan would return its two shards to checkpoints recorded on Aug. 11, discarding more than 109,000 regular transactions and 315 staking transactions. One wallet involved in the incident moved 2.385 trillion forged ONE through 477 successful transfers in 106 seconds.
Another network interruption occurred in August when Maya Protocol halted operations after an attacker exploited six linked software flaws. The attacker took an estimated $1.7 million in Bitcoin and other assets, including roughly 20 BTC, before the cross-chain protocol activated a global halt to prevent further losses.
Crypto projects have used network halts after security incidents
Network stoppages have been used under different circumstances when developers or validators identify threats that could affect blockchain operations or assets.
MANTRA Chain resumed block production on Aug. 22 after its mainnet spent roughly 30 hours unable to process transactions because of a Cosmos-EVM vulnerability. Validators deployed version 8.4.0 to patch the issue, while MANTRA said two wallets managed by the project were affected and user balances remained unchanged.
Earlier in the year, Humanity Protocol disclosed a separate security incident involving compromised administrative credentials. A malware-infected developer device exposed seven private keys that had been inadvertently backed up during its June 2025 mainnet launch.
The credentials allowed the attacker to drain 141.2 million H tokens from an Ethereum bridge and mint another 300 million H on BNB Smart Chain. Humanity Protocol said the compromise involved private keys instead of a vulnerability in its smart contracts or bridge infrastructure.
Fogo’s incident remains under investigation, with the Foundation yet to disclose whether compromised credentials, internal systems or another attack method allowed the 400 million FOGO transfer.
Fogo launched its mainnet in January
Fogo launched its mainnet in January 2026 after raising $7 million through a Binance token sale conducted at a $350 million valuation.
The Layer 1 network was built primarily for onchain trading and markets itself around high-speed transaction processing, including a target block time of 40 milliseconds and infrastructure designed to reduce exposure to maximal extractable value.
Before the Aug. 29 interruption, a guide published on Fogo’s website in March said the blockchain had maintained 100% uptime since its launch. The network halt ended that uninterrupted run several months after mainnet went live.
Fogo has not specified how long the network remained offline before the latest restart or detailed the validator upgrades carried out during the interruption.
With 237 million FOGO now recovered and removed from supply, the project said work with centralized exchanges and law enforcement remains focused on the rest of the affected assets. Further information will be released as the investigation continues.
