AYA CORE

Media › Article

Paid, Not Received: How a Bitcoin Payment Vanishes by the Network's Own Rules

Aslan Hasanli · Founder, AYA Network · 14 October 2026 · 5 min read

A seller sees an incoming Bitcoin payment and hands over the goods. Ten minutes later, the buyer has both the goods and the money. The seller has a life lesson.

Nobody hacked anything. No keys were stolen, no passwords guessed. The buyer used a feature that is built into Bitcoin and described in its open documentation. It is called Replace-By-Fee, or RBF.

Let's look at how the trick works, who came up with it, and how AYA handles the same moment differently.

How the trick works

A Bitcoin transfer becomes final only when it lands in a block. Until then, it waits in the network's shared queue, called the mempool.

  1. The buyer sends bitcoin with a tiny fee — a few cents. Miners have little interest in such a transfer, so it can sit in the queue for a long time.
  2. The seller's wallet already shows the incoming amount. The seller hands over the goods.
  3. Before the transfer lands in a block, the buyer cancels it in their own wallet. The popular Electrum wallet has had this cancel option built in since 2020.
  4. The same coins go to another address of the buyer — this time with a fee of $5–7.
  5. Miners pick the transfer that pays more. The new one lands in a block, and the old one simply disappears, as if it never existed.

The scammer spends a few dollars in fees to keep thousands. Excellent margins — and all strictly by the network's rules. The network's rules were not broken. The law was: this is plain fraud.

A hole, or by design?

By design — and nobody hid it. Transaction replacement has been discussed in the open since Bitcoin's early years:

Satoshi's "for now" lasted six years. In IT terms, that is almost forever.

The developers' position is simple: a transfer without a block is not money yet. RBF did not create this problem; it made it obvious. Double-spending an unconfirmed transfer was possible before, too — it just took more skill.

Why the victim's balance "doesn't go down"

After the replacement, the seller's wallet sometimes keeps showing the old amount for a while. That is a wallet defect, not a network one: the wallet counted an unconfirmed transfer in the balance and didn't remove it after the replacement.

This is exactly what happened in Ledger Live in 2020. The wallet added incoming amounts to the balance right away and didn't reduce it after an RBF cancellation. Ledger published its own analysis of the bug and fixed it in version 2.7.0.

Ledger Live was quite the optimist back then: it counted money that hadn't arrived and didn't notice money that had already left.

The check is simple: open the transfer in a block explorer such as mempool.space. "Unconfirmed" means it is not money yet. It is a promise.

Even a block is not an iron guarantee

A confirmation in a block is not absolute either. Whoever controls more than half of a network's mining power can rewrite its latest blocks. This is called a 51% attack.

In late July 2020, Ethereum Classic was hit exactly this way. The attacker rented mining power for about $192,000 and rewrote thousands of already confirmed blocks. The double spend came to about $5.6 million.

Spend $192,000, walk away with $5.6 million. A business plan nobody should copy.

In Bitcoin, such an attack costs incomparably more. That is why large amounts are accepted after 3–6 blocks. One block takes ten minutes on average — just enough for a cup of coffee. Six blocks are enough for a proper conversation over coffee and dates.

A checklist for sellers who accept bitcoin

How AYA handles it

In AYA, an incoming transfer does not land in the balance on its own. The recipient sees a "+N from …" line with an Accept button. Until they press it, the money isn't theirs yet — and the wallet says so honestly.

Diagram comparing Bitcoin and AYA. Bitcoin: a transfer is sent with a fee of a few cents and the seller sees the amount; while it waits for a block, the scammer replaces it with a new address and a fee of $5–7; the replacement lands in the block and the money goes to the scammer. AYA: a transfer is sent and frozen in transit; while it waits for Accept it is not in the balance and the sender can take it back; after Accept it is in the balance and can't be recalled.
Where a payment can still vanish. In Bitcoin, the window before a block belongs to the sender. In AYA, the recipient closes it with Accept.

In Bitcoin, the moment of finality is decided by miners, and the sender can influence it with a fee. In AYA, that moment is decided by the recipient — with one button.

The seller's rule is the same as in Bitcoin, only simpler: hand over the goods after Accept. Not after a "sent" screenshot, and not after a "+N" line.

AYA, honestly

Today, the nodes of the AYA network are run by the AYA CORE team. The rule "an accepted transfer can't be recalled" is written into the protocol, not into a promise. But a sceptic has every right to ask: couldn't the operator rewrite the database?

The honest answer: the more independent nodes there are, the less you need to take our word for it. That is why we invite partners to run their own nodes. The next step is quorum signatures from independent validators on the network's records. Then nobody will be able to rewrite history alone — including us.

The bottom line

Bitcoin doesn't lie. It just speaks a language few people have learned: in it, "sent" doesn't yet mean "received."

The scammer lives in the gap between those two words. In AYA, there is one button between them — and the recipient is the one who presses it.

AYA CORE is a post-quantum Layer-1 blockchain built from scratch in Rust. Read the documentation at portal.ayacoin.online/docs, verify what the network records through the public AYA CORE Explorer, and hold the keys yourself: the wallet runs at ayacoin.online and is available on the App Store and Google Play.

Sources

Also on: Medium

Aslan Hasanli is the founder of AYA Network, a post-quantum Layer-1 blockchain built from scratch in Rust by Bruno Kapital & Investment LLC.

This article is educational and does not constitute financial or investment advice.