How 237M Tokens Were Handled
Fogo said its mainnet restarted and resumed normal operation after an incident involving about 400M stolen FOGO. Roughly 237M were recovered and permanently removed from supply. Those numbers describe stolen total, controlled assets and unresolved assets, not one status. A restart demonstrates service recovery; it does not establish that the attack vector, asset disposition and responsibility investigation are complete. "Permanently removed" should ultimately be tied to the relevant on-chain mechanism and transactions rather than inferred solely from a promotional phrase. The implied 163M-token remainder is arithmetic based on disclosed figures, not a separately verified balance. Duplicated counts, later recoveries or supply adjustments could change it. Every update should therefore reconcile stolen, controlled, removed and outstanding categories before publishing a new remainder. This prevents a recovery announcement from being added twice and gives readers a transparent path from the original 400M to the current unresolved estimate. Every settlement event needs the rule version that produced its funding calculation. Hashes for recovery and permanent removal should be stored separately so the two actions are not counted twice.
Why a Restart Does Not End Risk
The project said it was working with centralized exchanges and law enforcement to track the remainder. A recovery chain should mark discovery, consolidation, freezing, removal and continued pursuit as separate stages, each with its own evidence. Tokens arriving at a consolidation address support tracing but do not establish who ultimately controls it. Exchange cooperation also does not mean every relevant balance has been frozen. Media summaries that interchange recovered, burned and frozen can make residual risk appear to be zero, so status fields need disciplined wording. Bridges and centralized exchanges can interrupt the visible on-chain trail. "No further movement" on one network does not mean the assets are safe or the investigation has ended. Cross-chain minting, internal exchange ledgers and law-enforcement holds may require information unavailable to public observers. The report should state where visibility stops and which organization may hold the next piece of evidence. Time-zone normalization matters when a charge crosses a reporting cutoff or a traditional-market session. If the remainder reaches a centralized venue, exchange records may be needed to complete the public-chain view.
The Evidence Chain for Stolen-Asset Tracking
Ongoing monitoring should begin with the unresolved balance implied by the disclosed figures, roughly 163M FOGO, while recognizing that later announcements may revise it. Watch for splitting into fresh wallets, bridge use, exchange deposits and overlap with the known incident path. Tie each alert to the original case and current disposition state to prevent double counting. When project or law-enforcement evidence changes, update the grade without deleting the earlier snapshot. The investigation closes on the remaining unknowns—where the assets moved and which identities are formally supported—rather than on the fact that the chain restarted. Closure criteria should separately cover network remediation, asset disposition and identity investigation. Completion of one does not substitute for the others. The chain can operate normally while funds remain missing; funds can be removed while the attacker remains unknown. A three-track status view prevents the word resolved from obscuring unfinished work and helps KYT teams retire only the alerts whose underlying risk has actually ended. A configuration test with a known example should precede activation of the revised surveillance rule. Every identity clue should state whether it came from the project, law enforcement or ledger inference.