The "recently_open" paths in the config file is the same as the list in the GUI's menu: "File->Recently open".
Both lists has a limit of 5 paths to a wallet file.

In my opinion, using the menu will be much more simpler.

Electrum will never show "Electrum" after pasting an electrum seed.
It's either "segwit", "standard", "2fa-segwit", "2fa" or "old" if BIP39 checkbox isn't ticked, otherwise, it'll be "BIP39: (checksum: failed)".

It's hard to call that it's caused by a malware/hacker since you've mentioned that the funds are still there and it's more than a year.
There's a possibility that you've been unintentionally using a different wallet file during those times.

You can try to search your drive for any "wallets" or "electrum_data" folder
and see if there are files inside without any extension but with the wallet name that you've used or "default_wallet" / "wallet_1" if you didn't named it.
Since there are only 8 transactions, the size should be only around 20KB±, and will show base64 characters if your open it with a text editor or readable text if it's not encrypted.

ismine() command isn't necessary if you've checked the addresses tab thoroughly.
Because it'll only check the current keypool which is as much as the addresses listed in your addresses tab.

If you want, you can generate more to check it you somehow used an address at a higher index. (it's highly-unlikely though)
To generate more, enter the command: Then use ismine() command.
Note: You can replace "500" with the amount of address that you want to generate; re-enter the command but with "True" to generate change addresses.

Have you extended your seed phrase by ticking "Extend this seed with custom words" when you created the wallet?
Because if so, you'll have to enter the exact same seed phrase extension (a.k.a Passphrase) to restore the correct wallet.

AFAIK, Sparrow also cannot send ordinals, it can only receive. (CMIIAW please)
If you're talking about the BIP39 seed phrase export option in Sparrow, it wont work since importing an Electrum wallet file to Sparrow wont produce a BIP39 seed that you can export to other wallets.

With that, your option is to export your address's private key which can be done by right-clicking the address in the "Addresses" tab.
However, it depends if ordinal wallet accepts individual private keys.

Another option is to export Electrum's master private key via console command: getmasterprivate()
and convert it into "xprv" via command: convert_xkey(xkey="your_zprv_key",xtype="standard")
But again, the problem is if ordinal wallet supports importation of master private keys.
("View->Show Addresses" and  "Show Console" to enable the mentioned tabs)

You can check the validity of each executable yourself by verifying their signatures.

Follow this guide to know how to verify your Electrum download: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
Signature files (.asc) for the older versions can be downloaded here: https://download.electrum.org/

By the way, Antivirus can't be a good indicator since even real Electrum, specially the older versions usually have false-positive detection from some Antivitus software.

I'm not a fan nor expert in ordinals NFT but AFAIK Electrum doesn't support ordinals and currently can't create Taproot addresses.

So why and how did you managed to receive it to Electrum in the first place?
Is your wallet "[imported, watching only]"?

Take note that if you ever used that tool to decrypt your wallet.aes.json file (after recovering the password),
the private keys in the output will be in plain BASE58 format which doesn't have any network code, flag and checksum.
In other words, it's not readily compatible with most Bitcoin wallets.
It has to be encoded into WIF private key to be compatible.

The advantage though is you wont have to rely on their website and everything can be done offline where its safe.
There's no limit on how many tries so start with it using your mentioned 1~20 possible passwords.

"used" doesn't mean that those are spent, it only means (in layman terms) that you've received bitcoins through an addresses, spent it and then received coins through that address again.
In case you unintentionally enabled the flag, you can disable it with:

---

On a side note, accumulating more UTXOs with small amounts like those could end up causing you to pay high txn fee if you need to spend hundreds of them in one transaction.
If those are mining pool payments, I'd consider setting a higher minimum payment amount.

So basically, you're using the command line option -D or --dir to specify a custom data directory (the "profile folder")?

If so, it'll only provide you a "false sense of security" since it's still connected to the internet and using a possibly compromised PC.
Even if the wallet and data directory is not in your PC at that time, the hacker will only need one chance to get your private keys or seed phrase during the times when you unpack it.
With those info alone, he can create his own copy of your wallet that can send transactions anytime he like.

It happens all the time, usually it's the user's fault. However, we can't discount the possibility of a bug or security issue.

Yes, 'Submarine Swap' should do the trick, so the actual issue is your channel's connectivity.
The "No path found" error happens if your channel cannot find a route to Boltz's channel to pay the to-be-swapped lightning funds.
Connecting to a well-connected node with many channels may help.
Also, if you're not using "trampoline routing", it may take a while to fully sync with the lightning network. (seen as the percentage in the lightning icon)

You can also try directly swapping through Boltz website and see if there's a difference: boltz.exchange
It's the same service as Electrum's swap feature.

That version supports descriptor wallets despite not creating such wallet by default.

Then, the mirrored wallet isn't "descriptor" with watching-only descriptors, it's the legacy version.
Because the "Send" button should've been replaced with "Create Unsigned" if it is.

The alternative for non-descriptor wallet is what o_e_l_e_o pointed out but you need to update your Bitcoin Core for it to appear in the "Confirm send coin" window.

Once it successfully synced, yes.
My reply above this quote is just an option in case Electrum didn't sync.

As additional note, if the watching-only wallet isn't a "descriptor" wallet, you won't be able to use that option either.

If you want to spend them through that watching-only wallet, you can try this:

In Bitcoin Core, there should be a "Create Unsigned" option in 'Send' tab to create an 'unsigned RAW transaction'.
Create a transaction with appropriate amount of inputs and fee, then save the ".psbt" file in a flash drive.
(your txn will be high in size so don't set the fee rate too high)

Open your 2FA Electrum in an offline machine (restore it from seed to be able to use it offline).
Load the .psbt file through the menu "Tools->Load transaction->From file", you should be able to sign it using two keys (Review the outputs and amounts).
After signing, export it through "Export->Copy to Clipboard" and find a way to transfer the copied Signed RAW Transaction to your Bitcoin Core.

Lastly, in Bitcoin Core, open the console (Window->Console),
In the Console, enter the command: sendrawtransaction "PASTE_THE_SIGNED_RAW_TRANSACTION" to send the transaction to the network.

Note: tested only on single-sig SegWit, haven't tested if the watching-only wallet created for EPS includes the redeem script; depending on the watching-only copy, this method may not work.

The list in the 'Receive' tab is just for invoices, it's not remotely important when it comes with the balance so don't mind it that much.
The reason it's removed from the "receive queue" is because the address now received bitcoins and the invoice was fulfilled.

Since it's in your addresses tab, then it's not a clipboard malware but something to do with your PC's security.
Having fake Electrum isn't deducted to the possible cause either until you verified that the signature matches.

I'm afraid only be finding the culprit to "convince" him to return the funds.
Due to Bitcoin's nature, there' no way to reverse an already confirmed transaction, by checking the address in question, all of its txns are already confirmed.

What do you mean "gone"? It's not in the 'Addresses' tab?
If you don't have Addresses tab activated, click "View->Show Addresses" to toggle the tab.

Because if it's not there and there's a similar address in the list (or even not), chances that you've been a victim of "Clipboard Hijacking Malware" is high.
You can Google search the term for more info.

Well, Kraken can't be blamed here since they don't have access to your wallet's private keys.
After you've sent it to your Electrum, only the private key of the address where it was sent to can spend it, in this case, your Electrum wallet.
The possible causes are: compromised PC, leaked private key or seed phrase.

Based from available information at the moment, it seems like you're not the only one who's got robbed.
But it's not possible to tell how without knowing the PC's condition (how it's used) and how the wallet is created.

Have you updated Electrum lately? Say, a message when you tried to send a transaction?
If so, what was your Electrum version prior to the update?

That's because most versions from 2018 are vulnerable to phishing malicious messages from rogue public servers.

Also, verifying its signature will clear all doubt about it being fake, guide: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
You can download the signatures for old version in "Previous Releases" link in Electrum download page.

Kraken can't control the funds sent to your Electrum; also, being hacked isn't the only way to compromise your Electrum.
For example, your seed phrase.
So, have you stored your seed phrase somewhere vulnerable?

The transaction going to 1DRJ3pkdSXTgYh59Rv7yUUQBErhTJ5rskB has a transaction fee.
Electrum just won't display it in the history tab, you'll have to open the transaction's details.

They are talking about the Bitcoin "blockchain", and not "Blockchain online wallet" of blockchain(dot)com.
That's the huge set of files that most Bitcoin node have in their drive, it consist of "chain of blocks" where the transactions are recorded.

Electrum and any other Bitcoin wallets don't contain bitcoins, they only manage the coins accessible by the "private keys" stored in them.
And as an answer to your question, all of your wallet's "private keys" can be derived from your seed phrase so be sure to keep it safe.

Any chance that the wallet is created by later versions of Bitcoin Core?
Because if so, pywallet doesn't support "descriptor" wallet.dat which is the new default.

Version is '1.1'
The number '22' belongs to the error message.

Not just the site, the lawyer is also a fake.
Electrum and Bitcoin don't work like a bank, stolen funds can't be recovered by an authority nor the developers of Electrum or even Bitcoin Core.
If you're scammed, chances that it's the same scammer who's trying to get more out of you.