Well I'm not quite sure I do understand.

The way I see it. I have opened the wallet containing the funds. Exported the private keys. Then probably by mistake I have used the sweep private keys (on the exact same wallet which had the funds). I don't think I've created a new wallet nor do I remember having any seed. I assume in order to sweep I was supposed to use the private keys for the current wallet (the one which had the funds right?).

I can't find any wallet file. When you export the private keys, there's a long list of keys. I saw that you can import the wallet using only private key. Does it make any difference if you use all the private keys or only one of them? I can't remember if doing that sweep I have used a specific key or all of them...

I believe I have swept the private keys somehow. Wasn't I supposed to use the original wallet keys of the actual wallet from which I have initiated the sweep?

So basically if I remember right this might be a very possible scenario.

I had the funds in some wallet -> transferred to this new wallet which was created from scratch. Then I have saved the seed somewhere. Then I believe I have use the SWEEP on this wallet and pasted some private keys. I'm not sure which private keys or how did I do it. So what can I do in this situation?

This is starting to make sense now...

I know it might sound foolish but I believe that I might have been in this scenario:

If you've used the "sweep" functionality in Electrum to import private keys, it's important to understand that this process typically involves transferring the funds from the imported address to a new address controlled by the wallet. This means that after sweeping the private keys, the funds associated with those keys are no longer stored at the original address but have been moved to a new address within your Electrum wallet.

So if I have the seed and the private keys but I'm still unable to see the funds, what I'm supposed to do?

I've been thinking and I believe it is worth to try. I have nothing to lose, I've already considered the funds gone or stolen.

So assuming when importing the wallet I have used he sweep functionality, how can I see if that address were the funds were sent it's associated with my electrum wallet?

I have never exported nor saved my wallet's private keys. I know that for a fact. Just to double-check, I have searched all my computer clipboard history (I have an app called ClipMenu that saves the last X entries or so). I have also checked the history commands on my MacOS, virtual machine, Linux server, and so on. Nothing.

 So we get back to the seed phrase... How that happened, it's still a mistery. I mean I'm more frustrated right now that I have no clue how it happened rather that I have lost all the funds...

This is my guess too. Someone probably had access to your seed phrase and made that transaction manually.
If your wallet had been hacked, it wouldn't take 2 days to steal the funds.
[/quote]

Well, it took 2 days, right? It's not clear to me how the wallet has been hacked. Someone generated wallet private keys and then brute force passwords until he managed to find the right one? Can you elaborate a little more in regards to the hacked wallet?

I know they are lost for good. I still can't understand how it happened. I've already been contacted by someone pretending to be from PayBack-LTD. They provided a lot of explanations, some youtube channel of their company bla bla. They want to $1500 upfront to recover my funds and 10% from the recovered amount. If nothing is recovered, then the $1500 paid is not refundable.

Sounds like a pretty good deal for them right?

I have scanned my computer with a ton of antivirus, anti malware, same my linux server, installed everything from ObjectiveSee as in malware monitoring tools. I have firewall enabled on my iMac, same goes for my linux server. I'm working with linux servers for years, no one, ever, hacked in any of my servers.

The curious thing is that the wallet is on my iMac, the seed phrase was saved on that linux virtual machine on an encrypted partition (which unfortunately remained mounted). What's really curious: I have generated the wallet on the 7th of March and got the funds in there. They were transferred/stolen almost 48 hours laters. I haven't done anything unusual during this time, not installed any new software, nothing. So I would say that either my linux sever got hacked which I totally doubt or somehow someone was able to steal my iMac clipboard history (I have copied/pasted the seed phrase from iMac to Linux). So wallet was on one machine, seed on a different machine. Wallet was protected with a password. I never save the passwords that I use for personal stuff and that I can remember in the clipboard nor do I copy/paste them. So I would say the seed was somehow stolen, used to recover the wallet and transfer the funds.

What happened now, is really unreal! But it is what it is so I have to find a way to get over it.

Is there any way to figure out where that the receiving BTC address was created? As in which wallet? country maybe. Just curious...

The seed is saved on a text file, on a linux virtual machine which runs on a server which is at my home. I'm the only one who has access to that server. I do have notifications when someone tries to connect via SSH to the server no matter from where. I'm using that server for years and never something like his happened. This is really really weird.

So I had an old electrum wallet with some funds in it. I have recently created a new electrum wallet on my iMac running MacOS Sonoma. The Electrum wallet was downloaded from their official website, I have double checked that. On 7th of March I have transferred those funds in this new wallet, address: bc1q99qq2awpvu72mrs7gng84dkzyxcxk3q5gfwkx8

Then the funds were transferred mysteriously on 9th of March, to an address I do know nor does it belong to me. The address is: bc1q5chaqcn56sk2fq29z3cl37n5pfzhh06e2gx5uz and the tx id is: 85918ae49e2e40ee1ec481be089bebf929f7769c4247e03c8856140df3c2f0d6

My computer is protected by a password and I'm the only one knowing the password. Also the wallet file was protected by a password and again nobody knows that password. I'm using ESET antivirus on my computer with real time scanning. So on the 9th of March, at 20:42 the transaction was initiated and my funds were transferred. I was not at home at that time, the wallet was closed. I have not shared with anyone that wallet nor did I use the wallet address on any website.

I know that probably the funds are lost for good, I'm just trying to find a reasonable explanation for this.

Any help is kindly appreciated. If any of you has any way of recovering those funds, I'm ready to split the 50/50 the entire amount (which was around 6K USD).

does this still work?

I would love to see SUMO listed on Binance. I am pretty confident that this nice coin will hit at least $25 by tht end of this year!