The 0.85 BTC Deposit That Vanished in a Three-Block Reorg

The rule was defensible only as a baseline, not as a finality guarantee. Bitcoin has probabilistic finality: each additional block makes reversal less likely but does not make a transaction irreversible. At 14:41 the deposit had two confirmations, but two other facts mattered more than the sub-1 BTC amount: the input sequence made the transaction replaceable, and the fee was only 8 sat/vB. A low-fee, replaceable transaction is exactly the profile that can be displaced by a higher-fee conflict during a reorg. A risk-based policy should have treated the deposit as unconfirmed for crediting purposes until it had either reached a higher depth, for example 6 confirmations for a new or low-value customer, or the mempool conflict risk had passed. The exchange should also have checked whether the transaction was opt-in RBF and whether the node had seen a conflicting spend. The correct action at 14:41 was to hold the credit, not release it automatically, and to escalate to a human for a decision. The amount alone was not a sufficient risk signal.

First, preserve volatile evidence: node debug logs, mempool snapshots, peer information, the original and conflicting transaction hex, block heights, timestamps, and the exchange's internal credit and withdrawal logs. Hash the evidence and record custody. Second, restrict the account without tipping off the customer; the withdrawal is already confirmed, so recovery may depend on the receiving VASP. Third, trace the conflicting transaction and the 0.849 BTC output, and determine whether the customer initiated the replacement, was a victim of a wallet or exchange compromise, or is a suspect. Check login, device, IP, and API-key activity around 14:02-14:49. Interview the customer with open questions. If the customer controlled the original transaction and benefited from the credit, this is a potential fraud against the exchange; if a third party replaced it, the customer may be a victim. File a suspicious transaction report where the jurisdiction requires it, and consider a law-enforcement referral. Do not represent the loss as recovered until the receiving VASP confirms a freeze.

A confirmation is not a seal; it is a measure of how much work has been built on top of a transaction. Miners can build a competing chain, and if that chain becomes longer, the network follows it and the earlier transaction can disappear. In this case the customer's deposit was only two blocks deep and paid a low fee, so it was easy for a competing transaction paying a higher fee to be mined instead. When the reorg happened, the exchange's software was looking at the new chain and no longer saw the deposit. The withdrawal had already been made on the strength of the earlier view. The practical lesson is not that the blockchain lied, but that the exchange treated a two-block-deep, replaceable transaction as if it were settled. A clearer customer communication should avoid saying the funds were stolen by the blockchain and instead explain that the deposit was reversed by a chain reorganization before it reached the exchange's finality threshold.