Fogo, a layer-1 blockchain, paused its mainnet roughly 15 hours after 400 million FOGO tokens were stolen from foundation wallets in a security breach, the network said.
The stolen amount equals 4 percent of the genesis token supply and more than 10 percent of circulating tokens in active circulation. The foundation disclosed the compromise and initiated the network halt to prevent further damage or the attacker's use of the tokens within the Fogo ecosystem.
Fogo operates as a standalone blockchain competing in a crowded field of layer-1 networks that includes Solana, Polygon, and Arbitrum. The network had been live and processing transactions before the incident. The foundation did not immediately disclose the attack vector or how the attacker gained access to the wallets holding the tokens.
Mainnet pauses are rare in public blockchain operations. When a network halts, validators and nodes stop producing new blocks, freezing all state changes and preventing any transactions. The move came as the foundation assessed that the breach posed an immediate operational or security threat severe enough to justify taking the entire network offline rather than attempting to patch the issue while the chain remained live.
A 10 percent loss of circulating supply affects token ownership percentages and voting power in governance systems tied to the token. An attacker holding 10 percent of circulating FOGO would hold a controlling stake in network decisions if the governance model weighted holders proportionally.
Fogo has not disclosed a timeline for mainnet restart, the identity of the attacker, or recovery plans for the stolen tokens. The foundation also has not announced whether it plans to fork the blockchain, reverse transactions, or redistribute tokens to affected parties.
The incident joins a line of major token thefts from blockchain projects in 2026, including earlier breaches at Lido and Curve Finance. Foundation wallets remain high-value targets because they often hold large token pools reserved for ecosystem development, team incentives, or reserve funds.
The duration of the mainnet pause will determine whether this becomes a contained incident or a prolonged operational disruption. If Fogo restarts within days, users and developers may treat the downtime as a security response and resume normal activity; if the pause extends to weeks, confidence in the network's operational continuity could deteriorate and token holders may exit positions.
