Fogo’s mainnet had not produced a block since Saturday afternoon, leaving the network offline for roughly 46 hours after validators stopped the chain in response to the theft of 400 million FOGO tokens from the Fogo Foundation.
The halt froze every position on the chain. The report said $987,291 of deposits across four protocols are now stuck, and the Foundation has not said when the network will restart, how the compromise happened, or which addresses received the tokens. The only published plan is a network upgrade that would restrict those addresses, a step Fogo can take because its voting validator set is run by seven operators.
The 400 million stolen tokens equal 10.3% of FOGO’s 3.88 billion circulating supply and 4% of the 10.05 billion tokens in existence. At Monday’s price, that stash was worth about $2.9 million. CoinGecko data cited in the report showed FOGO trading at $0.007333, down 3% over 24 hours and 18.4% over seven days, with a market capitalization of $28.5 million and a fully diluted valuation of $73.7 million.
During the outage, the token fell to an all-time low of $0.00704157 at 23:47 UTC on Sunday. It remains 88% below its record high of $0.062549 set on Jan. 15, the day Fogo launched its public mainnet after a Binance token sale.
Chain said to be unaffected, then halted 15 hours later
The Foundation’s first public description of the incident said the blockchain itself was still operating normally.
At 9:13 p.m. ET on Aug. 28, the Foundation posted: 「The Fogo Foundation experienced a compromise by an unknown actor which unfortunately resulted in 400mm FOGO tokens being sent to a bad actor. The Foundation alerted exchanges immediately and is actively communicating with law enforcement as well as forensic experts. There is no impact to the Fogo blockchain, which continues to operate as normal.」
Fifteen hours later, the network stopped. At 12:29 p.m. ET on Aug. 29, Fogo wrote: 「In the last hour the Fogo Mainnet has been temporarily halted as a precautionary measure following the detection of unauthorized activity. The halt is being initiated to prevent further movement of the affected assets. During the halt, the network will be upgraded to restrict the addresses associated with the incident.」
That remains the project’s latest public update. Fogo has not disclosed the attack vector, the addresses involved, what those restrictions mean at the client level, or when the network will be restarted.
No blocks, no RPC
Fogo’s own explorer showed the last block, 718,525,971, as two days old. Transactions per second were listed as 「N/A」 and the epoch clock was stuck at 16.56% through epoch 7,994. According to Fogoscan, requests for individual block pages returned: 「Sorry, we're unable to locate this block.」
When The Defiant queried the Foundation-run mainnet RPC endpoint at mainnet.fogo.io on Monday, it received an HTTP 502 error.
Onchain balances remain fixed at their Saturday levels. DefiLlama data cited in the report showed Fogo’s tracked total value locked sitting at exactly $987,291 for three straight days, down from $1.32 million on Aug. 28. Decentralized exchange volume over the past 24 hours was zero, and DefiLlama tracked no stablecoin supply on the chain.
The largest frozen positions listed in the report were:
- $1.18 million at liquid staking protocol Ignition LST
- $719,195 at lending market Pyron
- $687,372 at Brasa Finance
- $268,095 at Valiant Trade
Seven operators and one council
Fogo’s ability to stop the network within minutes is tied to how its validator set is structured. The project uses a curated model. In a validator design post published in October 2025, the Foundation wrote that 「anyone can permissionlessly join the network as a non-voting validator. In order to become a voting validator for a zone, you must be approved by the Fogo Validator Council」.
The same post said Foundation stake was 「split equally at launch across 7 operators」. The council itself is a seven-member multisig made up of technical operators, a researcher, ecosystem representatives, a Foundation delegate and a security specialist. It reviews candidates against a 1 million FOGO self-stake requirement and administers 「the removal of any non-performing validator from the set」.
Fogo presents that design as the basis for its 40-millisecond block times. The same setup also makes a coordinated halt and client-level address restrictions available in an incident response, while leaving users dependent on seven operators to bring the chain back.
Deposits and withdrawals disabled, trading still open
While Fogo’s rails were shut down, exchanges left trading available.
KuCoin’s public currency API showed both deposits and withdrawals disabled for FOGO’s only chain, with a 1,000-confirmation deposit requirement. Gate’s API returned deposits and withdrawals disabled but trading enabled.
The report said spot volume across venues reached $2.3 million over 24 hours. Holders on exchanges were therefore still trading the token even though its chain had been offline since Saturday.
Fake Foundation account pushed a bogus vote
Fogo’s halt notice told users to rely only on the project’s official channel for updates. Even so, an account calling itself Fogo Foundation, using the handle @FcgoFNDN and a purchased checkmark, posted its own updates.
According to the report, the account copied Fogo’s bio and Linktree, joined X in February 2014, had 1,750 followers, and its older posts were consumer complaints written in Turkish.
At 10:46 a.m. ET on Aug. 30, the account posted that 「the community vote for the $FOGO restoration & compensation plan is now live」 and that the proposal 「will support affected users and help restore the $FOGO token supply」. The post included a link card spoofing fogo.io, drew about 7,400 views, and was configured so only some accounts could reply.
The report said no such vote exists in any official Fogo channel.
The last public appearance by anyone from the project was a video posted by co-founder Robert Sagurton at 2:20 p.m. ET on Aug. 29. Its caption read: 「Friday night turned out to be a true Fogolized Friday.」 He has not posted anything since.
The second chain to go down over the weekend
Fogo was one of two networks that stopped themselves over the weekend. Cronos halted on Sunday during an exploit of the Tectonic lending protocol, then restarted on Monday by rolling state back to a block before the attack. That move discarded almost 11,000 blocks and close to two hours of other users’ transactions, along with the attacker’s balances.
Both halts relied on validator sets small enough to act within an hour of detection. The Cronos case also showed what users who had nothing to do with an incident may face after a chain is paused and state changes are made.
The weekend came after a month of halts elsewhere. MANTRA, TAC and KiiChain all stopped producing blocks in late August because of a shared Cosmos EVM flaw, and Moonwell lost $8.7 million to MAMO price manipulation on Base last week.
Funding history and unanswered next steps
Before its January launch, Fogo raised about $7 million by selling 2% of supply on Binance at a $350 million valuation. A year earlier, it had also completed an $8 million community round on Echo.
As of the report’s publication, the Foundation had not committed to a post-mortem, a compensation plan, or a restart timeline.