The Fogo layer-1 blockchain, built on the Solana Virtual Machine, has halted its mainnet after the Fogo Foundation confirmed that an attacker received 400 million FOGO tokens, worth approximately $3 million at the time of the incident. The network pause was announced around 12:29 p.m. ET on Saturday, about 15 hours after the Foundation first disclosed the compromise at 9:13 p.m. ET on Friday.
The Foundation stated that an unknown actor had compromised the organization and sent the tokens to a bad actor. While the team initially said there was no impact to the Fogo blockchain and that it continued to operate normally, the subsequent halt was intended to prevent further movement of the affected assets while validators upgraded the network. Fogo did not provide a restart time or detail how the restrictions would work.
Initial reports indicated the exploit targeted the token contract rather than the underlying SVM blockchain, meaning the core network was not breached, but a vulnerability allowed the attacker to siphon a significant share of supply. The stolen amount represents 4% of Fogo's 10 billion-token genesis supply and more than 10% of current circulating supply. According to DefiLlama data, FOGO was trading near $0.0075 at the time of writing. The Foundation has not disclosed the attack vector or targeted addresses.
Exchanges Bitget and KuCoin suspended FOGO deposits and withdrawals. Bitget described the move as wallet maintenance and acted about an hour before Fogo's first public disclosure; KuCoin later announced a similar suspension. The Foundation said it notified exchanges, law enforcement, and forensic specialists to trace and recover the funds.
Fogo launched its mainnet in January after a $7 million Binance token sale conducted at a $350 million valuation. The project markets itself as a high-speed Layer 1 for onchain trading, targeting 40-millisecond block times and reduced exposure to maximal extractable value. The incident adds to a growing list of crypto security exploits, although the Fogo chain infrastructure was reportedly not compromised.
