L1 Network Fogo Confirms Mainnet Suspension After Unauthorized Activity Detected
Fogo suspends mainnet to restrict addresses associated with the attack
L1 network Fogo confirmed that it has suspended its mainnet after detecting unauthorized activity. Validators will upgrade the network during the downtime and restrict addresses associated with the incident.
The incident originated from an unknown attacker breaching the Fogo Foundation, resulting in approximately 400 million FOGO being transferred to addresses controlled by the attacker. This amount accounts for 4% of the project's total supply of 10 billion tokens and over 10% of the current circulating supply, with an estimated value of about $3 million at the time of the incident.
The foundation's early statement indicated that the affected wallets or internal infrastructure were controlled by the foundation, not the consensus mechanism or underlying protocol of the Fogo chain; the mainnet continued to operate at that time. About 15 hours later, the team decided to suspend the entire network to prevent the attacker from continuing to move the involved assets. The attack path, the compromised wallets, private keys or infrastructure nodes, and the identity of the attacker have not been disclosed.
Fogo stated that the upgrade aims to restrict subsequent activities related to the addresses associated with the attack, but has not disclosed how the address restrictions will be enforced, whether balances will be frozen, whether statuses will be modified, whether blacklist rules will be adopted, or the timeline for resuming block production and transaction processing. This decision means that Fogo will intervene at the protocol level to address the incident of the foundation's wallet theft.
The foundation has notified exchanges and is collaborating with law enforcement and blockchain forensic experts to trace the funds. Bitget and KuCoin have suspended FOGO deposits and withdrawals; following the attack and the news of the network suspension, FOGO briefly dropped about 18% to 20%, reflecting the market pricing in potential selling pressure, the on-chain halt, and uncertainty regarding subsequent disposal rules.
From a market mechanism perspective, if the attacker can deposit the 400 million tokens into exchanges or split and exchange them through on-chain paths, it would create potential selling pressure exceeding 10% of the circulating supply; the exchanges' suspension of deposits and withdrawals and the mainnet shutdown cut off this path but also froze the liquidity of normal users' assets. Short-term funds typically sell FOGO, which bears security, liquidity, and governance uncertainties, while buyers will turn to event traders waiting for address restriction plans, resumption timelines, and exchange recovery arrangements; beneficiaries are mainly infrastructure participants who control cross-chain monitoring, custody risk management, and high liquidity exit channels, while holders, market makers, validators, and applications relying on network operation bear direct pressure.
Source: Public Information
ABAB AI Insight
Fogo's design emphasizes low-latency transaction execution: it is a high-performance L1 compatible with the Solana Virtual Machine, competing in on-chain trading scenarios. There is no evidence that the consensus, smart contracts, or user wallets were compromised in this incident; the issue primarily lies in the foundation's own asset control layer. However, the team's subsequent decision to suspend the entire network and propose address restrictions indicates that the project's actual risk boundaries are determined not only by code but also by the foundation's key management, token distribution, and emergency governance authority. Incidents like the freezing of Terra and FTX-related assets and multiple cross-chain bridge attacks show that the market's distinction between "protocols not being breached" only holds at the technical attribution level; token prices will still price in the security of the controlling party's assets and governance credibility.
The core of the capital path is that the 400 million FOGO originally belonged to the foundation's reserves; the tokens obtained by the attacker are not newly generated by the protocol but rather a significant existing inventory that can affect secondary market supply. The project has taken three measures to block its monetization: exchanges have frozen deposits and withdrawals to prevent the attack tokens from entering concentrated liquidity pools, on-chain address restrictions have cut off the ability to transfer within the chain, and law enforcement tracking aims to compress fiat withdrawal paths. However, this set of paths also transforms "asset rescue" into a governance action reliant on centralized coordination; for holders, the real need is to reassess whether the foundation can effectively restrict specific addresses and the triggering boundaries and procedural constraints of such power.
Historically, after the Ronin cross-chain bridge was hacked in 2022, whether the attacker's assets could be transferred through exchanges, mixers, and cross-chain paths became key to price and recovery rates; the 2023 Multichain incident showed that chaotic control of infrastructure can leave user assets in prolonged uncertainty. Fogo differs from these cases in that the involved assets are the foundation's token reserves rather than explicit user deposits, and the team has chosen to suspend the entire network and impose address restrictions. It is currently in the first phase of crisis management: first blocking liquidity exits, then clarifying upgrade rules, and only later discussing network resumption, token disposal, and control restoration; until the rules are made public, any judgment that "losses have been fully controlled" lacks basis.
Essentially, this is a regulatory change style governance stress test: when on-chain assets are stolen, market liquidity is ample, and attackers may quickly cash out, project parties often choose the latter between "immutability" and "loss prevention." Address restrictions migrate traditional financial sanctions lists, account freezes, and exchange risk controls to the protocol layer, which can reduce the probability of stolen tokens flowing out in the short term but will change participants' expectations regarding the certainty of on-chain asset ownership and scrutiny risks in the long term. The mechanism is not complex: the more centralized the emergency power, the faster the loss prevention; but the governance transparency, rule predictability, and risk discount demanded by holders also increase. Whether Fogo can subsequently disclose the root cause of the attack, the scope of address restrictions, code changes, recovery conditions, and the foundation's key governance rectification will determine whether the risk premium is a one-time shock or a continuous discount.
ABAB News · Cognitive Laws
The power to suspend the network can also rewrite risk boundaries
Stolen tokens are not scary; liquidity exits are the battlefield
Decentralization is proven by code, while centralization becomes apparent in crises