Fogo's main network resumes online, recovering 237 million stolen coins

Fogo restarts its main network after recovering 237 million tokens

Fogo has restarted its main network after security incidents suspended the Layer 1 blockchain. A total of 400 million FOGO tokens were stolen in this incident, of which 237 million were recovered and permanently removed from the total supply.

Event summary

Fogo restarted the main network after the security incident. The attack resulted in the theft of 400 million FOGO tokens, forcing the blockchain to suspend operation. The project has recovered 237 million FOGO units and permanently removed them from the total supply. An additional 163 million FOGOs have not yet been recovered, and Fogo is working with centralized exchanges and law enforcement agencies to track the affected assets. Fogo has not disclosed how the foundation was breached, and the investigation is still ongoing.

Fogo said in its latest announcement that the main network has resumed normal operation and continues to cooperate with centralized exchanges and law enforcement agencies to recover the remaining affected tokens.

Mainnetwork restart and token recovery

After recovering 237 million FOGO, the Fogo main network restarted a few days later. Previously, Fogo suspended blockchain operations on August 29 to prevent attackers from transferring tokens obtained during the Fogo Foundation's breach.

Of the 400 million stolen FOGO, 237 million have been recovered and permanently removed from the total token supply. The project party stated that there are still 163 million FOGO items that have not yet been recovered. "Continue to work with centralized exchanges and law enforcement agencies in an effort to recover remaining affected assets," Fogo said.

The project party did not provide specific details on how to recover the 237 million tokens and permanently remove them from supply. Fogo said the investigation is still ongoing and advised users to obtain further information through its official channels.

After days of uncertainty about the status of stolen assets, the latest announcement provides the network with clearer recovery data, but Fogo has not yet released the full story of the incident.

The incident

Fogo first disclosed the incident on August 28, when the foundation said an unknown attacker had invaded the organization and transferred 400 million FOGO to its so-called "malicious actor" address. At the time, the foundation stated that the blockchain itself was not affected and was operating normally. The project party has notified exchanges, law enforcement agencies and forensic experts and has begun tracking assets.

The situation changed the next day. Fogo suspended network operations while the verifier prepared to upgrade. The suspension is intended to prevent further transfers of affected tokens, and the project party did not provide a restart time when announcing the measure.

The 400 million FOGO stolen accounted for 4% of the blockchain's 10 billion creator supply, and accounted for more than 10% of the circulation supply at the time. When the network was suspended, the FOGO transaction price was approximately US$0.0075, and according to DefiLlama data, the value of the affected tokens was approximately US$3 million.

Shortly before the foundation publicly disclosed the incident, the exchange began to restrict relevant operations. Bitget suspended FOGO's replenishment and withdrawal business an hour before the first announcement, saying it was wallet maintenance;KuCoin subsequently implemented similar restrictions.

Fogo did not disclose which addresses or systems in the foundation were compromised, and the latest statement did not specify attack vectors. As the investigation continues, a complete post-event report has not yet been released.

Cases of network suspension after security incidents

There have been multiple security incidents this year, and blockchain projects have worked with exchanges and law enforcement agencies to control stolen or improperly created tokens. In August, it was reported that Harmony proposed a chain rollback after the counterfeit ONE token spread to the Internet. Harmony's recovery plan will roll back two shards to the August 11 checkpoint, discarding more than 109,000 regular transactions and 315 pledged transactions. One wallet involved in the incident transferred 2.385 trillion counterfeit ONE tokens through 477 successful transfers in 106 seconds.

Another network outage occurred in August, when Maya Protocol suspended operations after attackers exploited six associated software vulnerabilities. The attackers stole approximately $1.7 million in Bitcoin and other assets (including approximately 20 BTC), before the cross-chain protocol initiated a global pause to prevent further losses.

Crypto projects use network suspension measures in different situations when they identify threats that may affect blockchain operations or assets. MANTRA Chain recovered on August 22 after its mainnet was unable to process transactions for about 30 hours due to a Cosmos-EVM vulnerability. The validator deployed version 8.4.0 to fix the issue, MANTRA said two wallets managed by the project were affected, but the user balance remained unchanged.

Earlier this year, Humanity Protocol disclosed a security incident involving a breach of management credentials. A developer device infected with malware accidentally backed up seven sets of private keys during the startup of the main network in June 2025, resulting in the disclosure of credentials. The attackers used these credentials to steal 141.2 million H tokens from the Ethereum Bridge and issued an additional 300 million H tokens on the BNB smart chain. Humanity Protocol said the incident involved a disclosure of a private key, not a vulnerability in its smart contract or bridging infrastructure.

The Fogo incident is still under investigation, and the foundation has not disclosed whether credential leaks, internal system problems, or other attacks caused the transfer of 400 million FOGOs.

Fogo launched its main network in January

Fogo launched its main network in January 2026, having previously raised US$7 million through Binance token sales at a US$350 million valuation. The Layer 1 network is mainly aimed at on-chain transactions and sells high-speed transaction processing capabilities, including a target block time of 40 milliseconds, and infrastructure designed to reduce maximum extractable value (MEV).

Before the outage on August 29, a guide released by the Fogo website in March stated that the blockchain has maintained 100% uptime since its launch. This network suspension ended the uninterrupted operation record of the main network for several months since its launch. Fogo did not say how long the network was offline before the latest restart, nor did it elaborate on the validator upgrades that were made during the outage.

With 237 million FOGOs recovered and removed from supply, the project party stated that cooperation with centralized exchanges and law enforcement agencies will continue to focus on the remaining affected assets. The investigation will continue and more information will be announced later.