Fogo has restarted its mainnet after a security incident that led to the theft of 400 million FOGO tokens. The project said the network is operating normally again after the disruption.

The team recovered 237 million of the stolen tokens and permanently removed them from the total supply. The move prevents the recovered assets from returning to the market and keeps them from re-entering circulation while the investigation continues.

The incident has drawn renewed attention to security risks facing newer blockchain networks. Fogo operates as a Solana Virtual Machine, or SVM, compatible layer-1 network focused on fast onchain transactions, which makes uninterrupted network operation and incident response especially important for users and infrastructure participants relying on a live chain.

Network Halt Followed Token Theft

Fogo halted its mainnet after the August 29 incident to prevent further movement of the affected assets. The stolen 400 million FOGO represented a significant portion of the token’s circulating supply.

At the time, the project said it had notified centralized exchanges, law enforcement agencies and blockchain security specialists. Exchanges also moved to restrict certain FOGO-related activity as investigators worked to track the stolen funds.

The project has not publicly disclosed the precise vulnerability that enabled the theft. It also has not provided a complete breakdown of how the recovered tokens were retrieved.

Recovery Efforts Continue

With the mainnet now operating again, Fogo said it will continue working with centralized exchanges and law enforcement to recover the remaining affected assets. That leaves the response focused not only on restoring service, but also on tracing what remains of the stolen supply through the channels already involved in the case.

The recovery of 237 million tokens means roughly 163 million FOGO from the original 400 million remains unresolved, based on the figures disclosed by the project.

The permanent removal of the recovered tokens also changes the supply impact of the incident. However, the broader security implications remain important for Fogo and its users.

The restart marks a key step toward restoring normal network operations, but the investigation is still ongoing. Further disclosures about the exploit, remaining funds and security measures could shape how the market and ecosystem participants assess the network as Fogo moves beyond the incident.