"March 2013 Chain Fork Post-Mortem" by Gavin Andresen - The 1st known Bitcoin Double-Spend where a merchant lost $10,000 after a 24-block Bitcoin reorg and hard fork on the network

I think a lot of people have forgotten that there has been at least 1 true double-spend as a result of a hard fork on Bitcoin.

This was confirmed by many core devs including Gavin Andresen among others: March 2013 Chain Fork Post-Mortem

Background

In 2013, there was a catastrophic bug in the 0.8 Bitcoin release that caused a hard fork between Bitcoin Core 0.7 and 0.8. Later on, 0.8.1 was released to patch the bug, but before that happened, Bitcoin mining pools 51% attacked the network to revert the canonical chain back to 0.7, leading to a massive 24-block, 5-hour reorg. At the time, this was the 2nd largest reorg of Bitcoin (the largest being the 53-block reorg in 2010 for the 184B minting bug).

About 60% of mining power had already switched to 0.8, so it was the canonical chain.

51% attack and 24-block reorg

Afterwards, a few Bitcoin mining pools decided to support the 0.7 fork, and Bitcoin mining pools BTCGuild and Slush (among others) 51% attacked the network. Many members of the community and merchants were not given sufficient time to respond.

Double-spend attack

Unfortunately, by the time of the reorg, OKPAY accepted a $10K deposit from a user at block 225446 of the 0.8 chain. This allowed a UTXO from the orphaned 0.8 chain to be rebroadcast to the mempool and reused, leading to the first known cryptocurrency double-spend.

FTR, OKPAY later confirmed that they "resolved this situation" with the attacker who executed the double-spend, and I'm guessing that means they returned the money.