Bitcoin arrived, then vanished: how a sender takes back an unconfirmed payment

What the victim sees

You are selling a phone, cash or USDT for bitcoin. The buyer writes: “Sent it, refresh your wallet.” You refresh — the amount is there, with an incoming transaction next to it. The buyer rushes you: they are in a hurry, polite, they have “already paid.” You hand over the goods.

Ten minutes or an hour later, the amount disappears from your wallet. Nobody debited it on your side. The payment you saw is no longer on the blockchain: its place was taken by another transaction that sent the same coins back to the buyer.

Why the sender can take the money back

A transaction on the Bitcoin network goes through two stages:

1. Sent. It has been broadcast to the network and waits in the queue of unconfirmed transactions (the mempool).
2. Confirmed. A miner has included it in a block. A new block appears on average every ten minutes.

Space in a block is limited, and miners take first the transactions that pay a higher fee per unit of transaction size. A payment with a very low fee can wait for hours.

Until a transaction is in a block, the network lets it be replaced by a new one, as long as the new one spends the same coins and pays a higher fee. This rule is called Replace-by-Fee (RBF). It has honest uses: speeding up a stuck payment or fixing a mistake in the address. But a scammer uses the same rule:

1. Sends you bitcoin with the minimum fee, so the transaction sits in the queue for a long time.
2. Waits until you see the amount in your wallet and hand over the goods.
3. Sends the same coins to themselves with a higher fee.
4. Miners pick the more profitable transaction. Yours drops out of the queue, and the coins stay with the scammer.

Nothing is hacked. Nobody touches your wallet keys. The sender simply rewrites their own transaction while it is still unconfirmed.

What if the transaction has no replaceable flag

In the past, a sender marked a transaction as replaceable, and that flag let you tell a risky payment apart. Today the flag guarantees almost nothing: the main node software of the network, Bitcoin Core, has by default accepted replacement of any unconfirmed transaction since version 28.0 (October 2024), and version 29.0 (April 2025) removed the option to turn this off. So there is one rule for every payment: without a confirmation, assume there is no money.

How not to get caught

• Zero confirmations means zero money. Hand over the goods only after the incoming transaction has at least one confirmation. For large amounts, wait for more — how many is explained in the seller checklist.
• Check the status, not the balance. Open the transaction and find the number of confirmations. A block explorer is the most reliable place: how to check a payment.
• Being rushed means stop. “Hurry up,” “already sent, refresh,” “I have to run” — this is the main sign of the scheme. An honest buyer has no trouble waiting twenty minutes.
• A suspiciously low fee. If the payment paid much less than is currently needed to get into a block quickly, it will wait a long time, and all that time it can be replaced.
• Check the buyer’s address. Before the deal, paste the sender’s bitcoin address into GuardPay /check: if it is linked to theft or extortion, you will see it before you hand over the goods.

If the money is already gone

Save the chat, the buyer’s address, the hash of the vanished transaction and the hash of the one that replaced it: the explorer shows the link between them. This proves that the coins were sent to you and then returned to the sender. Take it to the police and to the platform where you found the buyer. Where the coins went next can be traced.