On August 9, Ledger — the hardware wallet maker millions of us trust with our private keys — did something unusual. It issued a blunt warning about a Bitcoin improvement proposal called BIP-110. The message wasn't diplomatic. It wasn't "exercise caution." It was: don't claim these fork coins. Don't operate them. Don't touch them.
That kind of directness from a major infrastructure provider is rare. It's what you get when engineers have looked at the code and concluded the risk is structural, not hypothetical. At the center of it all is a flaw that should matter to every Bitcoin holder, even those who have never heard of BIP-110: this fork has no replay protection.
Here's what that means in plain language. When a blockchain forks, both chains share the same history. Same addresses. Same balances. Same signature rules. If BIP-110 becomes a separate chain, every transaction you've signed on Bitcoin is valid on the new chain, and vice versa. An attacker can take a transaction you broadcast on the BIP-110 chain, copy it, and rebroadcast it on the Bitcoin main chain. Your BTC moves without your consent. This isn't a theoretical exploit — it's a structural property of two chains sharing signature rules.
I've been here before. In late 2018, I watched twelve ICOs eat 80% of a $500 portfolio through rug pulls and vanity projects. The lesson wasn't about greed. It was about understanding what you're actually holding, and the hidden costs of "free" assets. BIP-110's fork coins are promoted as a free distribution — one coin for every BTC you hold. But the act of claiming them can cost you the very BTC you used to qualify.
And in this bear market, that's the only question that matters. Survival is the strategy. Not gains — survival. If you're holding Bitcoin right now, this is a gift. Here's why.
The mechanics of the replay bomb
A replay attack exists because of a gap between what a signature proves and what the network checks. When you sign a Bitcoin transaction, your signature covers the inputs, outputs, and amounts. It does not commit to a chain identity. On a normal day, that's fine — there's only one Bitcoin chain. The moment a fork exists, that signature is a skeleton key for both doors.
If BIP-110 activates, a user who wants to sell fork coins creates a transaction on the BIP-110 chain: send the fork coins to an exchange, receive value. That transaction is signed. An attacker monitoring the fork chain's mempool grabs it and broadcasts it, unchanged, to the Bitcoin main chain. The main chain checks the signature. It's valid. The main chain executes it. The user's BTC leaves their wallet, sent to a recipient they never intended to pay.
The drain isn't slow. It isn't probabilistic. It's instantaneous and irreversible.
And the danger doesn't begin when you sell. It begins when you engage with the fork chain at all. Even a simple operation — checking your balance, claiming the coins, consolidating outputs — requires you to broadcast a signed transaction on the BIP-110 chain. Once that signature exists, it can be replayed. The safest transaction is the one you never create.
The user's intent gets inverted, too. You think you're selling an airdrop. The main chain sees a legitimate transfer, signed by the rightful owner. There's no fraud flag. No appeal. The signature is the authority, and the signature was stolen by circumstance.
This is why the 2017 Bitcoin Cash split became the industry's reference point. When BTC and BCH separated, both implementations introduced replay protection — unique signature hash prefixes, additional input constraints, chain-specific identifiers — so a transaction signed on one chain is invalid on the other. It wasn't perfect, but it was conscious. The community refused to repeat the mistake.
The number alone — BIP-110 — tells you this proposal predates the 2017 fork wars that taught the industry to demand replay protection. By the time Ledger issued its warning, that work still hadn't been done. From a safety engineering perspective, that's not a minor oversight. It's the difference between a fork designed for users and a fork designed to create an attack surface. Compared with the standard the industry set in 2017, it's a regression.
Ledger's role: the honest middleman
Here's what the warning reveals about the limits of wallets. Ledger devices are built to sign transactions. They're excellent signature machines. That's their job. But the replay protection gap lives at the consensus layer — in the rules of the chain, not the firmware of your device. No hardware wallet can fix a flaw in the protocol.
Ledger's warning was, in technical terms, an honest disclosure of its own limitations. It can sign a BIP-110 transaction. It can't tell you that signing won't trigger a replay on the main chain. The protection that should exist at the protocol layer isn't there, and the wallet layer can't enforce it. So the entire burden falls on you, the user, to understand the risk before you press the button.
That's a responsibility vacuum, and it's worth naming. The protocol doesn't protect you. The wallet can only warn you. In between, your assets sit exposed. I've seen this pattern before — during DeFi Summer, when users were confused about impermanent loss and gas fees, and the information gap cost them money. But this is worse. That gap was about understanding a complex product. This gap is about a safety feature that was never built.
Why "free" is the most expensive word in crypto
Let's talk about what this fork coin is actually worth. The BIP-110 fork coin has one distribution mechanism: a 1:1 claim matched to BTC address balances at the fork. No lockups. No vesting. No disclosed team allocation. On paper, it's the most "fair" distribution — every existing Bitcoin holder gets a copy.
But fairness in distribution doesn't mean value. The fork coin has no described utility, no revenue model, no ecosystem commitments, and no replay protection. Its entire value proposition is speculative. The cost of claiming it is the tail risk of losing your main-chain Bitcoin. As an expected-value calculation, this is one of the worst trades I've seen in years of auditing token distribution schedules. The upside is a coin that may be worth nothing at listing. The downside is losing the asset that holds your savings.
The word "free" is doing a lot of work here. Economists call this the zero-price effect — when something is priced at zero, our brains stop weighing its actual costs. This fork coin is not free. Its real price is denominated in risk: the risk of a signed transaction being replayed, the risk of losing BTC, the risk of engaging with an unprotected chain. Zero-price assets in crypto are almost never free. They're usually the most expensive things you'll ever encounter.
I've built my career watching where value actually accrues. It accrues to people who understand the difference between a coupon and a liability. A fork coin without replay protection isn't a gift. It's a liability dressed as a gift.
The rational response — the one Ledger is guiding users toward — is non-participation. Don't claim. Don't operate. Don't sell. The fork coin's value is zero until someone demonstrates a safe way to interact with it. No one has.
The quiet shift into defense
Warnings like this change market behavior at the margin. The most likely response from experienced holders is defensive: assets move from exchanges into self-custody, and on-chain activity dips, because people reduce operations in an uncertain environment. The moment a credible threat is named, the safest move is to do nothing.
In my copy-trading community, I've watched how people behave when a bear market grinds on. There's a hunger for anything that feels like a win — an airdrop, a fork coin, a "free" token. That hunger is exactly what dangerous forks exploit. The promise of free value short-circuits the risk assessment that a bear market should sharpen. When everything is bleeding, the instinct to grab something free is strongest. And that's precisely when the trap snaps shut.
Then there's the exchange angle. If BIP-110 starts looking real, centralized exchanges face a security decision about whether to list the fork coin at all. Given the replay gap, the safest decision — and the most likely one — is to wait or refuse. There's a compliance angle too: listing a coin whose signature rules endanger user funds means inheriting that liability and explaining it to regulators. Refusing to list removes the easiest exit route for anyone who wanted to claim and sell quickly, which further depresses the fork coin's appeal.
And in the OTC market, I expect opportunistic buyers offering to purchase fork coins from holders, positioning themselves as the "safe" exit. That is exactly the transaction type an attacker wants to see. The fork chain's trading volume becomes the attack feed.
The contrarian angle: the real victims will be the clever
Here's what most coverage of this story will miss. The people most at risk from a replay event aren't the reckless degens who FOMO into every airdrop. They're the opposite — users who think they've found a clever, low-risk arbitrage.
Think through the sequence. Ledger publishes a warning. Some users do nothing. Others reason: "I won't hold the fork coin. I'll claim it and sell immediately. Free money." That second group is about to discover that their exit plan is exactly the transaction an attacker needs to replay. The act of selling — the thing they believe is risk-free — is what broadcasts the signature that drains their BTC.
An attacker doesn't need to target a specific victim. They just need to watch the fork chain for transactions with a counterpart on the main chain, then replay them. Every eager seller is a signal.
There's a second blind spot. Since 2017, the industry has assumed replay protection is standard — that every serious fork includes it. BIP-110 breaks that assumption, and it probably isn't alone. If a proposal that reached the point of a major hardware wallet issuing a user warning doesn't have replay protection, how many smaller forks are out there right now, unexamined, waiting for the same exploit?
This is also a governance failure. Somewhere in BIP-110's development, replay protection either wasn't raised or was deprioritized. For a proposal that directly affects the security of the Bitcoin main chain, that's a significant omission. The advocates were more focused on launching a chain than protecting the users who would inherit it. And in the vacuum, it fell to a hardware wallet manufacturer — a company, not a consensus body — to warn the public. That says something about where security accountability actually lives.
What you should do with this information
If BIP-110 continues toward activation, expect more wallets and exchanges to release similar warnings. Expect exchanges to delay or refuse listings until replay protection is added. And expect a small number of users to lose Bitcoin — because no warning has ever stopped everyone.
For you, the path is simple. Keep your Bitcoin where you control the keys. Don't claim BIP-110 coins, no matter how loud the promises get. And if you're holding any other fork assets, ask the hard question: does this chain have replay protection? If the answer is unclear, the answer is no.
Trust the hands, not just the charts. Community first, coins second. Always. The people who survive this industry aren't the ones who grab every free token in sight — they're the ones who understand what touching a fork without protection actually costs. Follow the people, follow the profit. And right now, the people worth following are the ones telling you to stand still.
When a fork asks you to claim its coins, ask yourself who is holding the risk. If the answer isn't the fork's developers — and with BIP-110, it isn't — then the risk is yours. The only winning move is not to play.