Crypto glossary
Replay attack
A replay attack rebroadcasts a valid signed transaction on another chain or fork where the same signature also works, moving funds without consent.
After a chain split, both networks share the same addresses, keys and transaction format. If nothing distinguishes them, a transaction signed for one chain is also valid on the other, and anyone can copy it across. The victim intends to send coins on chain A and discovers the same transfer was executed on chain B as well.
This happened at scale after Ethereum and Ethereum Classic split in 2016, before either chain had built-in protection, and some users and exchanges lost funds. The fix is replay protection: Bitcoin Cash added a new signature hashing flag, and EIP-155 made Ethereum transactions include a chain ID so a signature only works on one network.
Replay risks also appear at the application level. Off-chain signatures for permits, orders or login messages need a nonce, an expiry and a domain separator, or they can be reused on another contract or chain. Smart contract audits routinely look for missing replay checks in signature-based functions.
Example
In 2016 a user sold ETH on an exchange after the fork, but their transfer to the exchange was replayed on Ethereum Classic, so their ETC was sent to the exchange's deposit address as well.