Fogo, a high-speed Layer 1 blockchain, has halted its mainnet after an attacker received 400 million FOGO tokens in a security incident involving the Fogo Foundation. The stolen amount represented more than 10% of the token's circulating supply, and about 4% of the 10 billion-token genesis supply, and was worth roughly $3 million when the incident emerged.

The foundation initially stated that an unknown actor had compromised its organization and transferred the tokens to a bad actor, while noting that the blockchain itself continued to operate normally. However, about 15 hours later, Fogo paused the mainnet to prevent further movement of the affected assets.

Emergency Network Halt

Fogo said validators would upgrade the network to restrict addresses linked to the unauthorized activity. The project did not provide a restart timeline or explain exactly how the address restrictions would work. Coordinated validator upgrades to block specific addresses have been used by other networks after major exploits, but such interventions draw debate because they sit in tension with the principle that public blockchains should be censorship-resistant.

The size of the theft relative to circulating supply makes the incident particularly significant for the token market: tokens exceeding 10% of float, if sold, would weigh far more on price than the same nominal amount in a larger-cap token.

Exchange Restrictions Add Pressure

Major exchanges also moved to limit FOGO transfers. Bitget suspended FOGO deposits and withdrawals shortly before Fogo publicly disclosed the incident, and KuCoin later announced similar restrictions.

The exchange suspensions could make it harder for the attacker to liquidate the tokens through centralized venues, a containment playbook exchanges have repeatedly deployed after token thefts. They also temporarily restrict ordinary users from transferring FOGO through those platforms.

Fogo has not disclosed the attack vector, the specific systems affected, or whether private keys were compromised. The foundation said it had notified exchanges, law enforcement agencies, and forensic specialists. Compromises of foundation-held tokens typically originate with organizational systems or key management rather than the chain's consensus layer, though Fogo has not confirmed which applies here.

Fogo launched its mainnet in January following a $7 million Binance token sale at a $350 million valuation. The project positions itself as a high-performance blockchain for onchain trading, with a focus on fast block times and reduced exposure to maximal extractable value.

The mainnet halt now places Fogo's security controls and validator governance under scrutiny so early in the network's life. Open questions include how the attacker gained access, whether the affected tokens will be frozen or burned and reissued, and how quickly validators can coordinate a restart.