No one is above mistake and that is what we should always remember when we make a mistake, a BTC in the wallet can not be touched if the owner did not touch it or give out his seed phrase and the wallet gets hacked, with his explanation I think he didn't do anything wrong with the transaction he made but it seems like his is doubting something because the BTC in his wallet I have decrease which shows that someone might have access to it or the wallet got hack, from my observation I don't think someone has access to his wallet because although BTC can not be decreased without not touch, well if that will be the case I advise to change the wallet immediately or withdraw all the coin from the wallet to another wallet before it gets worst but I'm still thinking that if the account was a hack I don't think he will still find some coin in his wallet, the person who has access to his wallet will have to withdraw everything instead of making the transaction until he has noticed.

I have had to follow up this thread as it goes, replies and your posts in between and I can picture what as distressed situation you might be in, finding out that your transactions aren’t adding up and each time you have to initiate a transaction, a couple more is been sent out.

This is hardly any case of a hack as, it always begins with you. Should jacking have been the case, of course it would t wait on you to initiate a transaction and your wallet would be empty in minutes for sure.

It’s all a mixup and you really should calm yourself and go through it step by step. Getting this and that file could just complicate the whole thing for you as, am having to see a lot of files you’ve generated already.

What I don’t understand is, change addresses are supposed to balance up your wallet with your deducted balance from what have been sent out. How is yours not the same and instead, you’re having different values…?
Is there an automated command on your wallet like, having to pay several addresses at a time, I just don’t get it.

I get the feeling you're a bit muddled on how Bitcoin wallets actually work.  You're mixing up terms and saying things that don't make much sense.  All wallets nowadays generate multiple public addresses spawned from one original seed and  this covers change addresses too.  So there's no master address or single address that represents your entire wallet.  Unless you imported the wallet using a private key - that wallet would have only one public address (well actually three, depending on the script type, but I won't get into that). 

I strongly recommend you ask someone with more expertise for assistance if you dont wanna risk losing your money forever with amateur moves.

I know how hard it can be and  in my sight the amount you lost is not small  we all have our priorities and I respect yours don't panic for now even if you are baffling you are doing great by not making any further transaction so the amount left can be saved. Don't share your seed phrase with anyone in the problem I know you are a techy guy and 45 I read the whole thread to see what's the update on your case.

So till now I understood that you made these transactions from core wallet but when you saw the remaining amount is lesser so you imported your wallet to electrum and you took screen shots and posted here. But the screen shots are saying there are two outputs for each transaction. The ones I mentioned are three transaction in which you lost 1800$ (600$ each) but there is another transaction made on (2024-07-15) and it did not deducted 600$ extra. Why?

I don't think your wallet was compromised, because if it were, then you wouldn't be seeing any money in your wallet. Here comes the change address concept. Which is one of the privacy feature of Bitcoin Core. It is a newly generated wallet address within your wallet.

What it does is, whenever you want privacy on your transaction, it sends the leftover funds to a new wallet address (change address). which makes the ownership finding difficult as now we can't know the wallet receives the 600 is yours or not. Which I mentioned in my last post, here they are again:

I know there are more than 3 tx. These wallets must be in your bitcoincore wallet you just have to find them. Don't lose the recovery key as this case shows he can't access his change address back as he lost private key I am not a bitcoincore wallet user so to test the theory, I need to have it but it will take time. You are a techy person you can find them easily. If not then post again. I did not find any video tutorial to it. Well, the addresses received the funds are totally new so there are 100% chances that they are changes addresses. Don't delete the wallet or dat files, because when you used the private key to recover the wallet those keys don't bring back those change addresses back because they are random (AFAIK).

If you have downloaded a fake wallet or you wallet has been exposed then the attacker would have stolen all your coins not just part of it. Why didn’t he do that if he has full access to your wallet? This doesn’t make sense to me!

What’s weird is that your wallet is a legacy wallet as the sending addresses start with "1" but what are supposed to be your change addresses are segwit addresses! So they can’t be your wallet change addresses.

How did you import your bitcoin core wallet into Electrum?

There are 70 transactions related to this address since 2017, so it would be more easy to understand the issue if you'd post the ids or the links of the suspicious transactions instead. Anyway I guess you are referring to the last ones, well if the other addresses than the recipient address (bc1qw40vpr90585k0t4v46jj097p8e0mfayux26clt as I understand) are not change addresses, don't belong to your wallet and you've not entered them yourslef when making your sending transactions as Pay to Many adresses, then your wallet is necessarily corrupted or is a malicious version of Electrum.  

What do you mean bro? You've checked the extended public key (xpub key) of your wallet within blockchair, that's what you mean? Please bro try to be a bit clearer and more precise in your explanations. If yes, it is what it is. But fortunately it wouldn't be a so big loss up to now.

Edit: I see you've used Bitcoin Core   What do you mean bro? You can't import the HD seed of a Bitcoin Core wallet into Electrum neither into most wallet AFAIK so what have you done precisely? You've just imported the private key of this address(1CChv6qepeypQYwkFshUKQ3RMcG5bPAydo)? If yes Electrum won't be able to know what are the change addresses related to your initial Bitcoin Core wallet belonging to this address. You need to check that into Bitcoin Core.

If we assume that the second address to receive is not a change address, then in this case the loss of the OP would not amount to $600, but many times more, since it was debited every time a transaction was made. But the OP does not write that he lost several thousand dollars.

I use mempool for my convenience checking your account.
https://mempool.space/address/1CChv6qepeypQYwkFshUKQ3RMcG5bPAydo

I use Mempool to easily check your account.

Let’s get to the most important part and summarize the figures based on your wallet history.

You’ve received a total of 0.56780229 BTC, and your remaining balance is now 0.03291220 BTC. That means you’ve spent or withdrawn 0.53489009 BTC from your wallet. You’ve had a total of 70 transactions (deposits/withdrawals), so it should be pretty easy to track if something is missing. With just 70 transactions, you can trace them all to see if everything adds up.

If the numbers don’t match, it’s possible that your PC has been compromised. You should take immediate steps to secure the remaining balance.

I think you were not aware of the white label transaction fee, which is according to them is 1.5%, but I checked the reviews on different sites, and a person mentioned Plisio charged a 15% transaction fee aside from the cost you were paying, which means on 60 dollars you were paying 0.9 dollars (if the rate was 1.5%), and if the commission they were taking was 15%, then you were paying 9 dollars extra on your 60$ purchase + the transaction fee, and maybe there will be extra charges hidden from you. (source)

You must inquire with Plisio about it they might give you some details on the matter. Although I think for personal use they are cost-free, for business, they cost 0.5% commission. The rates are different everywhere, and only then can they sort the matter out for you, although I heard they have bad customer care too.

The transaction details show you sent another $600  while paying for your games. Here is the extra $600 you sent to the following address at the the following dates:

bc1qj4pjyc0m7d882kar9ry59hvc034d5fc9rw30wg 2024-03-24 21:21:33
bc1qn6q4kx2945ujx2dh4yztl7pcf62jwtl5gq79sp 2024-07-21 18:49:20
bc1qfm70pn6c2kljtzxcy4acrmkvuf7md4yjz0cqtg 2024-02-10 08:00:39

You were sure the balance was right I mean, it should not be right you were sending an extra $600 on every purchase. And in the photos you attached the sent balance is 0.011 while for 60 dollar purchase, it should be around 0.001 BTC.

Now using Claymore 11.3 mining Monero with -pow7 1 and it works wonderfully.
All my RX 570s hashing at 850-855H/s 
Claymore, you are the champ!

PhoenixMiner 2.7c is officially released. In addition to the changes in 2.7a, and 2.7b, we have added support for secure stratum connections using SSL (supported by ethermine.org) to prevent the increasing IP hijacking attacks. To connect to a secured pool, use the ssl:// prefix (e.g. -pool ssl://eu1.ethermine.org:5555). We have also Added support for solo mining (HTTP GetWork protocol).

We are switching our attention to 2.8, which will include a lot of small improvements, as well as some big ones but we prefer to keep them confidential for now in order to avoid giving any ideas to the competition  We also continue working towards dual mining and Linux support as our next major milestones.

17589:11:17:58.925: unkn Eth: Can't resolve host us1.ethermine.org:4444 - The requested name is valid, but no data of the requested type was found
17589:11:17:58.925: unkn Eth: Giving up after 3 retries, switching to next pool
17589:11:17:58.925: unkn Eth: Reconnecting in 20 seconds...
17589:11:18:02.646: GPU4 Unable to submit share - pool disconnected
17589:11:18:07.786: main GPU1: 59C 44%, GPU2: 59C 41%, GPU3: 53C 17%, GPU4: 59C 39%, GPU5: 59C 43%, GPU6: 59C 43%, GPU7: 59C 42%
17589:11:18:18.940: unkn Eth: Connecting to ethash pool eu1.ethermine.org:4444
17589:11:18:18.940: unkn Eth: Can't resolve host eu1.ethermine.org:4444 - The requested name is valid, but no data of the requested type was found
17589:11:18:18.940: unkn Eth: Reconnecting in 20 seconds...
17589:11:18:19.049: GPU5 Unable to submit share - pool disconnected
17589:11:18:29.791: GPU7 Unable to submit share - pool disconnected
17589:11:18:35.860: main GPU1: 59C 44%, GPU2: 59C 41%, GPU3: 53C 17%, GPU4: 59C 39%, GPU5: 59C 44%, GPU6: 59C 42%, GPU7: 59C 42%
17589:11:18:38.949: unkn Eth: Connecting to ethash pool eu1.ethermine.org:4444
17589:11:18:38.950: unkn Eth: Can't resolve host eu1.ethermine.org:4444 - The requested name is valid, but no data of the requested type was found
17589:11:18:38.950: unkn Eth: Reconnecting in 20 seconds...
17589:11:18:39.469: GPU7 Unable to submit share - pool disconnected
17589:11:18:58.954: unkn Eth: Connecting to ethash pool eu1.ethermine.org:4444
17589:11:18:58.954: unkn Eth: Can't resolve host eu1.ethermine.org:4444 - The requested name is valid, but no data of the requested type was found
17589:11:19:00.813: unkn Eth: Giving up after 3 retries, switching to next pool
17589:11:19:00.813: unkn Eth: Reconnecting in 20 seconds...
17589:11:19:03.868: main GPU1: 55C 44%, GPU2: 55C 41%, GPU3: 49C 17%, GPU4: 55C 39%, GPU5: 54C 43%, GPU6: 55C 42%, GPU7: 55C 42%
17589:11:19:20.816: unkn Eth: Connecting to ethash pool us1.ethermine.org:4444
17589:11:19:20.950: eths Eth: Connected to ethash pool us1.ethermine.org:4444 (18.219.59.155)
17589:11:19:20.950: eths Eth: Send: {"id":1,"jsonrpc":"2.0","method":"eth_submitLogin","worker":"eth1.0","params":["YourWallet.DESKTOP-CIU19IR"]}

17589:11:19:21.080: eths Eth: Received: {"id":999,"jsonrpc": "2.0","result": false,"error": "Invalid user provided"}
17589:11:19:31.871: main GPU1: 45C 36%, GPU2: 46C 33%, GPU3: 44C 0%, GPU4: 48C 33%, GPU5: 44C 36%, GPU6: 46C 35%, GPU7: 45C 35%
17589:11:19:59.936: main GPU1: 42C 0%, GPU2: 45C 0%, GPU3: 44C 0%, GPU4: 48C 0%, GPU5: 42C 0%, GPU6: 45C 0%, GPU7: 44C 0%
17589:11:20:27.943: main GPU1: 43C 0%, GPU2: 45C 0%, GPU3: 44C 0%, GPU4: 49C 0%, GPU5: 43C 0%, GPU6: 45C 0%, GPU7: 44C 0%