Fogo Mainnet Restarts After Recovery of 237 Million Stolen FOGO Tokens

Fogo Mainnet Restarts After Recovery of 237 Million Stolen FOGO Tokens

Fogo, the Layer 1 blockchain that halted its network on Aug. 29 following a major security incident, has restarted its mainnet and confirmed the recovery of 237 million FOGO tokens out of the 400 million that were stolen. The recovered tokens have been permanently removed from the project’s total supply, while efforts to trace the remaining 163 million FOGO continue alongside centralized exchanges and law enforcement.

In an update published on Sept. 2, the project said the mainnet was “restarted and operating normally” after several days offline. Fogo did not provide further detail on how the 237 million tokens were recovered or the exact process used to burn them from supply, and the investigation into the original compromise remains ongoing.

The restart closes, at least partially, an episode that began on Aug. 28, when the Fogo Foundation disclosed that an unknown actor had compromised the organization and transferred 400 million FOGO to a wallet it described as belonging to a “bad actor.” At the time, the Foundation insisted the blockchain itself had not been affected. The following day, with the stolen assets still on the move, Fogo took the more drastic step of halting the entire network while validators prepared a restrictive upgrade designed to prevent the attacker from offloading the tokens.

Exchange restrictions had actually begun before the incident was publicly confirmed. Bitget suspended FOGO deposits and withdrawals roughly an hour before the first announcement, citing wallet maintenance, and KuCoin introduced similar restrictions shortly afterward.

Scale of the theft

The numbers underline why Fogo treated the incident as an existential threat. The 400 million FOGO taken in the compromise represented 4 percent of the blockchain’s 10 billion-token genesis supply and more than 10 percent of the circulating supply at the time of the halt. FOGO was trading near 0.0075 USD when the network was stopped, which values the stolen tranche at approximately 3 million USD based on DefiLlama data.

Removing the recovered 237 million tokens from supply permanently rather than re-issuing them is a deliberate choice. It eliminates any risk that the attacker could later regain access to the funds, but it also shrinks the circulating supply by a meaningful margin, a trade-off the project appears to have accepted in exchange for finality.

What remains unanswered is the attack vector itself. Fogo has not disclosed which addresses or systems within the Foundation were compromised, whether stolen credentials, a compromised device or an internal tool gave the attacker access, and no full post-incident report has been published. Until that accounting arrives, users are being asked to rely on the project’s official channels for updates.

A broader pattern of halts and recovery operations

Fogo’s response fits a wider pattern across 2026 in which blockchain projects have used emergency halts, supply surgery and coordinated exchange action to contain security failures.

In August, Harmony proposed a chain rollback after forged ONE tokens spread across its network. The recovery plan would return Harmony’s two shards to checkpoints recorded on Aug. 11, discarding more than 109,000 regular transactions and 315 staking transactions. Chain analysis showed one wallet moved 2.385 trillion forged ONE through 477 successful transfers in just 106 seconds.

Maya Protocol halted operations the same month after an attacker chained six linked software flaws to extract an estimated 1.7 million USD in Bitcoin and other assets, including roughly 20 BTC, before a global halt stopped further losses. MANTRA Chain resumed block production on Aug. 22 after roughly 30 hours of downtime caused by a Cosmos-EVM vulnerability, patched by validators with version 8.4.0. And earlier in the year, Humanity Protocol disclosed that a malware-infected developer device exposed seven private keys, allowing an attacker to drain 141.2 million H tokens from an Ethereum bridge and mint another 300 million H on BNB Smart Chain.

Fogo’s case differs in one important respect: the chain was not exploited, the Foundation was. That places the incident closer to key-management failures like Humanity Protocol’s than to protocol-level bugs, and it explains why a network halt, an extraordinary measure by any standard, was deemed necessary to freeze the attacker’s options.

What comes next

With the mainnet back online, attention shifts to three open questions. First, whether the remaining 163 million FOGO can be recovered, either through exchange freezes or law enforcement seizure, or whether they are permanently lost to the attacker. Second, whether the permanent removal of 237 million tokens from supply will have a measurable effect on FOGO’s market dynamics now that trading can resume. Third, and most consequential for the project’s credibility, whether Fogo will publish a full technical post-mortem explaining exactly how the Foundation was compromised.

For now, Fogo has bought itself a workable outcome from a bad situation: the network is live, more than half of the stolen supply is permanently neutralized, and the recovery pipeline with exchanges and law enforcement remains open. But until the project explains how 400 million tokens, over a tenth of its circulating supply, walked out the door in the first place, the restart is a recovery, not a resolution.