Hello everyone.

A friend of mine has very irritating problem which I am going to outline below.

He has been using Bitcoin Core and kept his BTC on Core during 1st August hard fork. After the hard fork on 2nd of August it stopped syncing and this state continues up to this day. Since I've never encountered such a problem I decided the best way was to extract private keys and create wallet in Electrum. We also managed to recover his BCH also in Electron Cash. After inserting all keys into Electrum we realised that something is not quite right.

It turned out that balances that Core and Electrum displayed are not matching.
Core:       2.395BTC
Ethereum: 0.991BTC
What is even more worrying is that block explorer shows around 0.991BTC which is the amount Electrum presents. My friend says that the after this split he didn't transfer any funds and Core presented the same balance before the fork and after it stopped syncing.

I was digging into the subject, because it's almost uncanny that there was such a whopping difference and I found a transaction that concerned me.
https://blockchain.info/pl/tx/cb39028a8880a0b38b72edf39ed3c9637adef891fc403b4ab75929f8c924b374
From where we checked he actually send 1.92BTC, but he doesn't recall the second output (1.08961509 BTC). Core also doesn't show that output and because of that the balance was wrong for almost 10 days! It looks like somebody stole his funds.

1. What could cause Core to display wrong balance even?
2. What output is that 1.08961509 BTC? It is surely no transaction fees

Please help.
Best regards,
Tryptohash