Layer 1 blockchain Fogo successfully restarted its mainnet on September 2, 2026 after a critical security incident resulted in the theft of 400 million FOGO tokens worth approximately $3 million. The team managed to recover 237 million of the stolen tokens (59.25% of the total amount) and permanently remove them from the total supply through a burn mechanism. The remaining 163 million FOGO are still under the attackers' control, and recovery efforts continue in cooperation with centralized exchanges and law enforcement agencies.
Key figures: 400 million FOGO stolen (4% of genesis supply, 10%+ of circulating supply). 237 million recovered and burned. 163 million remain with the hackers. The incident was worth ~$3 million at a price of $0.0075 per token.
The incident began on August 28, when the Fogo Foundation disclosed that the organization had been compromised. An unknown attacker gained access to the Foundation's treasury wallets and transferred 400 million FOGO tokens to an address under their control. Initially, the Foundation reported that the blockchain itself had not been affected and continued operating normally, but the following day, August 29, an extraordinary decision was made to completely halt the mainnet.
The network shutdown was necessary to prevent further movement of the stolen tokens and gave the team time to coordinate with exchanges and law enforcement agencies. Over four days (August 29 - September 1), intensive efforts were made to track fund flows, negotiate with exchanges to freeze suspicious deposits, and prepare a technical upgrade for a secure restart. On September 2, the mainnet was successfully restarted, with the recovered 237 million tokens burned at the same time.
The recovery of 237 million tokens (59.25% of the stolen amount) represents a significant achievement, considering that the average recovery rate in the crypto industry is only 10-30%. The Fogo team did not disclose the specific methods that led to the recovery, but typical approaches include blockchain forensics to track transactions, coordination with centralized exchanges to freeze funds when deposit attempts are made, and possible negotiations with the hackers.
The recovered tokens were not simply returned to the treasury but permanently removed from the total supply through a burn mechanism. Although the technical details have not been disclosed, this typically means sending the tokens to a burn address (an address with no known private key) or using a burn function in the smart contract. Burning the tokens has a dual effect: economic (reducing supply increases the scarcity of the remaining tokens) and symbolic (demonstrating commitment to the community that the stolen funds will never return to the market).
Economic effect of the burn: Removing 237 million FOGO from circulation creates deflationary pressure, potentially supporting the token's price. It also reduces the risk that the recovered tokens could be used for market manipulation.
Despite successfully recovering most of the stolen funds, 163 million FOGO remain under the attackers' control. The project continues actively working to track and recover them through several channels. Cooperation with centralized exchanges (CEXs) includes freezing funds when stolen tokens are deposited, identifying the attackers through KYC/AML procedures, and blacklisting compromised addresses.
Work with law enforcement agencies is focused on prosecuting the attackers, international cooperation between jurisdictions, obtaining court orders to access exchange information, and using legal mechanisms to recover assets. Realistically, a full recovery of the remaining funds is unlikely, but partial recovery remains possible.
