The longest chain wins. But not waiting for enough confirmations to deem a transaction to be final between 2 parties is the risk here. Hopefully no one got rugged.