Fogo suspends mainnet to restrict addresses associated with the attack

L1 network Fogo confirmed that it has suspended its mainnet after detecting unauthorized activity. Validators will upgrade the network during the downtime and restrict addresses associated with the incident.

The incident originated from an unknown attacker breaching the Fogo Foundation, resulting in approximately 400 million FOGO being transferred to addresses controlled by the attacker. This amount accounts for 4% of the project's total supply of 10 billion tokens and over 10% of the current circulating supply, with an estimated value of about $3 million at the time of the incident.

The foundation's early statement indicated that the affected wallets or internal infrastructure were controlled by the foundation, not the consensus mechanism or underlying protocol of the Fogo chain; the mainnet continued to operate at that time. About 15 hours later, the team decided to suspend the entire network to prevent the attacker from continuing to move the involved assets. The attack path, the compromised wallets, private keys or infrastructure nodes, and the identity of the attacker have not been disclosed.

Fogo stated that the upgrade aims to restrict subsequent activities related to the addresses associated with the attack, but has not disclosed how the address restrictions will be enforced, whether balances will be frozen, whether statuses will be modified, whether blacklist rules will be adopted, or the timeline for resuming block production and transaction processing. This decision means that Fogo will intervene at the protocol level to address the incident of the foundation's wallet theft.

The foundation has notified exchanges and is collaborating with law enforcement and blockchain forensic experts to trace the funds. Bitget and KuCoin have suspended FOGO deposits and withdrawals; following the attack and the news of the network suspension, FOGO briefly dropped about 18% to 20%, reflecting the market pricing in potential selling pressure, the on-chain halt, and uncertainty regarding subsequent disposal rules.

From a market mechanism perspective, if the attacker can deposit the 400 million tokens into exchanges or split and exchange them through on-chain paths, it would create potential selling pressure exceeding 10% of the circulating supply; the exchanges' suspension of deposits and withdrawals and the mainnet shutdown cut off this path but also froze the liquidity of normal users' assets. Short-term funds typically sell FOGO, which bears security, liquidity, and governance uncertainties, while buyers will turn to event traders waiting for address restriction plans, resumption timelines, and exchange recovery arrangements; beneficiaries are mainly infrastructure participants who control cross-chain monitoring, custody risk management, and high liquidity exit channels, while holders, market makers, validators, and applications relying on network operation bear direct pressure.

Source: Public Information