10 September 2023. Paxos broadcasts a Bitcoin transaction sending 0.074 BTC, about $2,000, and attaches a fee of 19.8 BTC, about $520,000.
The largest transaction fee ever recorded on the network, paid to move two thousand dollars.
Paxos attributed it to a bug in its corporate operations software. Analysts looking at the transaction suggested the change output had been miscalculated, so the software handed most of the input to the miner instead of returning it.
Now the part that matters for this lesson. Nothing failed. The signature was valid. The rules were applied exactly as written. The network did precisely what it had been instructed to do, which is not a bug in the system, it is the entire product.
There was no appeal, no reversal, no clearing window, no fraud department, because none of those things exist here.
Five days later, F2Pool returned the 19.8 BTC after verifying who had sent it. A private company, under no obligation, chose to give it back.
That is the only thing that saved Paxos. It is a business decision by a third party, not a property of the technology, and you should not plan around it.
Most explanations of blockchains start with cryptography, or mining, or a metaphor about gold. We are going to start with what the thing actually is, because the mental model you build here determines whether the next ten courses make sense or feel like a list of arbitrary rules.
The notebook in the square
Picture a notebook in a public square. Anyone can walk up and read it. Every entry is simple: this address paid that address ten units, at this moment.
Now the part that is genuinely new. Nobody is in charge of the notebook. There is no clerk, no manager who decides which entries count. Everyone who walks past checks the arithmetic themselves. If something does not add up, everyone notices at once.
That is the whole idea. A public notebook, everyone reads it, nobody owns it.
Everything you have ever owned digitally was somebody's database row. Your bank balance lives in the bank's computer. Your playlist lives on a company's server. Any of them can change the row, lose it, or take it away, and they do. A blockchain is the first time a digital record exists that no one owns.
The notebook is enough to start. Now we make it precise, because the notebook model quietly hides the thing that costs people money.
Blocks are the diff. State is the balance.
Two different things get called "the blockchain" and confusing them is the source of a lot of muddle.
The blocks are an ordered list of everything that has ever happened. Each block is sealed to the one before it, so editing block 47 breaks the seal on 48 and every block after it. This is the history.
The state is the current situation: which address holds what, right now. It is not stored in any single block. It is what you get by applying every instruction in every block, in order, from the beginning.
So the state is derived. Any node can rebuild it from scratch by replaying history, which is why nobody has to trust anybody's copy. You do not accept my claim about your balance. You recompute it.
That is the actual machine: an ordered log of instructions, plus rules for applying them, producing a state that everyone independently agrees on because they all did the same arithmetic.
Your balance is not a number stored somewhere with your name on it. It is a result. It is what the rules produce when applied to the history.
Which is why there is nobody to call. A support line implies an operator who can edit the record. The record is the output of a computation that thousands of machines performed independently. Editing it means convincing all of them to compute something different, which is exactly what F101-02 and F101-03 are about.
A transaction is an instruction, not a request
When you pay by card, you are asking. A request goes to your bank, which may approve, decline, hold, or reverse it. There are humans and policies in that path, which is why fraud can be undone.
A transaction on a chain is not a request. There is nobody to grant it. It is a signed instruction that either satisfies the rules or does not, and if it does, it executes.
Three consequences follow, and they are the ones that cost money.
It does what it says, not what you meant. Paxos meant to send $2,000. It signed an instruction that also handed over $520,000, and the instruction was valid, so it ran.
There is no reversal. Not because the industry has not built one, but because reversal requires an authority, and removing the authority is the point of the design. F101-03 covers the one time this was overridden and what it cost.
Fees are not a service charge. They are a bid for inclusion. Nothing checks whether your bid is proportionate to what you are moving, because nothing is looking at your transaction with any judgment at all.
Fees are priced by transaction size in bytes, not by value moved. That single fact explains the whole incident.
A typical Bitcoin transaction is around 250 bytes. At a fee rate of, say, 20 satoshis per byte:
250 x 20 = 5,000 satoshis = 0.00005 BTC
At a bitcoin price of roughly $26,000 in September 2023, that is:
0.00005 x $26,000 = about $1.30
Now the transaction Paxos signed:
Amount sent: 0.074 BTC, about $2,000 Fee paid: 19.8 BTC, about $520,000
Ratio of fee to amount:
19.8 / 0.074 = 268 times the amount being sent
Ratio of fee paid to a normal fee:
$520,000 / $1.30 = roughly 400,000 times
Two things to take from this. First, the fee is a completely independent field from the amount, so no ratio between them is unusual to the network; nothing was out of range because there is no range. Second, and more usefully: fees are priced by bytes, so a fee that scales with value is a sign that something is wrong. If you ever see a wallet proposing a fee that looks like a percentage, stop and read the transaction, because F105 is full of what happens when you do not.
The address is half the destination
This is the failure mode that opens the whole course, and it is the most common way beginners lose money for reasons that have nothing to do with an attacker.
An address is a string. The same string can exist on many chains. On every EVM chain, one private key produces the identical 0x... address, controlling completely separate balances on Ethereum, on Arbitrum, on Base, on BNB Chain.
So the destination of a transfer is not the address. It is the pair: chain and address. And almost every interface shows you the address prominently and the chain as a small dropdown you already stopped reading.
What happens when you get it wrong depends entirely on who holds the key on the chain the funds actually landed on:
- Your own address, wrong chain. Usually recoverable. The same key controls that address everywhere, so you add the network in your wallet and the funds are sitting there. Do not panic and do not pay anyone to help you, which is F106-06's autopsy.
- An exchange deposit address, on a chain that exchange does not support. Often unrecoverable in practice. They may hold the key, they may not, and there may be no process. Some exchanges recover case by case for a fee. Many do not.
- A contract address that cannot move the token. Permanent. The key does not exist, and neither does anyone who can act.
If I send to the wrong network, the funds are gone.
This is the belief the earlier version of this course taught, and it is wrong in the case that matters most to you.
For a self-custody address, wrong-network funds are usually still yours, because the same private key controls that address on the other chain. Adding the network in your wallet makes them visible and spendable. The whole event costs you a few minutes and a gas fee on a chain you were not expecting to use.
The genuinely unrecoverable version is when someone else holds the key on the destination chain and has no process for you, which is the exchange case, or when nobody holds it at all, which is the contract case.
Getting this distinction right matters more than most things in this lesson, because believing the funds are gone is what makes people accept the first offer of help that arrives.
What the chain actually guarantees
Worth being exact, because both the promotional version and the dismissive version of this get it wrong.
It guarantees that valid signatures were required, that the rules were applied uniformly, that the ordering is agreed, and that changing recorded history is expensive in a way we can quantify, which is F101-02.
It does not guarantee that the instruction was what you meant, that the counterparty is honest, that the contract does what its name suggests, that the price is fair, or that anybody will help you.
The chain is a machine for making a specific narrow promise very hard to break. Everything else, including all of the judgment, remains yours, and the whole Freshman level is about the part that stays yours.
A blockchain is an ordered log of signed instructions plus rules for applying them, producing a state that everyone recomputes independently rather than taking on trust. That means a transaction is an instruction rather than a request, so it does what it says and not what you meant, and Paxos paid $520,000 to move $2,000 with nothing failing at any point. Fees are priced by bytes, not by value, so a fee that scales with the amount is a warning. And the destination of a transfer is a chain and an address together, where the address is the half everybody checks.