You may have already did this but did you try checking through your transaction history to trace in which addresses the remaining 11.5BTC is located, yours or somebody else's? Can Core see the transaction made to Electrum with 0.5BTC? Restarting Core with -rescan option?

If you have swept, or at least tried to sweep, all of the 1000 remaining keys then this wallet's transaction state is out of date and a -rescan will show the true amount. At least to me it sounds like that remaining balance is not there, assuming, again, you swept every key.