Please answer the question asked by o_e_l_e_o.
What do you mean by "The payment did come through to the xpub that we use to receive payments"?
How do you check the transactions made by your customers through the xpub?

In electrum, click on "Wallet" at top of the window and then select "Information".
Do you see the same master public key (xpub)?


Another question:
How did you create your wallet?
Did you create your wallet in electrum or you created your wallet somewhere else and then imported it into electrum?
If you have created your wallet in any version of electrum newer than 4.0.9 (through GUI), you should have zpub, not xpub.

Note that if you have downloaded the blockchain in pruned mode and wants to import a new private key now, you have to download the blockchain again.


In the case you import the private key into a wallet and don't move the fund, you shouldn't destroy the copies. Instead, you should keep them in safe places. You will need your private key as a backup for your fund.

First of all note that if you insist on using bitcoin core for any reason, you have to download the blockchain. It's currently around 380 GB.

For importing your paper wallet into bitcoin core, Go to console (Window > Console) and use the following command.


Warning:
Before doing anything, make sure that your device is secure.

Is your wallet synced? Is the circle located at bottom right corner of the window green?

If your wallet is synced and that's not the problem, go to "Addresses" tab and check if you see the receiving address there.
If you don't see the address there, that may be beyond the gap limit.

For increasing the gap limit, go to console tab and use the following command.

Where N is the gap limit.
Change it to 50 and see if it works. If it didn't work, change it to 100.

Note: If any of "addresses" and "console" tabs are not available, you can click on "View" at top the window and enable them.

The problem is that it doesn't check the checksum when you enter a (WIF) private key.

To OP:
As already stated by BlackHatCoiner, only the first (WIF) private key corresponds to the hexademical format of the private key you posted. The second one is not valid at all.
As you see, the difference between the two (WIF) private keys you posted is only in a few last characters. That's because the tool in question doesn't check the checksum and those last characters don't make any change in the final result when deriving the hexadecimal format of the private key. 

It's true that the public key can't be derived from the address, but once you broadcast a transaction to the network, your public key is revealed and anyone can know that.
The public key (as the name suggests) should be public. Without the public key, nodes can't verify the transaction and the sender has to disclose it.  

The website you referred to is a scam.

If you have created your paper wallet using the website you shared above, your private key is already compromised.

Anyway, as I already said, you can sign the transaction on an offline device.
A good wallet allowing you to do so is Electrum.

Read the following guide to learn how to sign a transaction on an offline device using electrum.

How to spend from an offline paper wallet using Electrum.

How can they verify that a withdrawal address belongs to an exchange, especially if that's a fresh address?
In the case no deposit has been to that address before, the only way to verify that is to ask the exchange if the address belongs to them.

Or they may ask the users to provide a screenshot from the deposit page of the exchange. If so, users can easily edit the images.  

Edit:
They ask the user to record a video proving that the address belongs to the exchange. [Ref.]

I read the article completely. It seems that they won't store users private keys and will let them to be the only and the real owner of their fund.

From the translated version of the article shared by 1miau (done by google translator):


They even encourage people to use cold wallets.

What do you mean by being stolen?

Do you mean your private key may be compromised by hackers?
If you want to be 100% secure, you can sign the transaction on an airgapped device. In this way, your private key doesn't touch the internet at all.

Or maybe you think your private key may be stolen because it is broadcast along with your transaction to the network?
If so, there is no need to worry about that. Your private key doesn't broadcast to the network.
Note that nodes don't need your private key for verifying your transaction.

To those who are recommending 2FA for securing their fund:

Bitcoin purpose is to have full control over your money. Note that with using a custodial wallet with 2FA feature, you actually give the control of your money to the service provider.
You may decrease the chance of getting hacked (if you have the 2FA application in a separate device), but you are in the danger of being scammed.

Electrum allows you to add new inputs for bumping the transaction fee.
You can do so, even if the new inputs come from a transaction made later than the original transaction.

Also, you can click on "Show advanced setting" when bumping the fee and select the strategy.



If you use the first option, there would be three cases:

1. If there's a change (which is sufficient) in the original transaction, electrum decrease the change.
2. If there is no change (or there's a change, but it's not sufficient) and there's another available UTXO in the wallet, electrum combines that UTXO with original input(s).
3. If there is no change (or there's a change, but it's not sufficient) and there is no other UTXO in the wallet, there is no option other than decreasing the payment amount.

It's a good news and a good lesson.

Note that the fund is actually still on cryptonator's wallet and they have full control over your money. Now, they show a number as your balance and promise that you can withdraw that fund.
This promise can be broken at any time.

If you want to be the real owner of that fund, I recommend you to withdraw all the fund to a non-custodial wallet. In this way, you can have full control over that fund and you can be sure that the same thing will never happen again.

You remember correctly. That was bitcoinpaperwallet(dot)com.
The website turned into a scam after its ownership was changed. The new owner was giving pre-generated addresses to people.

Anyone interested to know what happened to bitcoinpaperwallet(dot)com can click here and read the topic created by hugeblack.

You can't sort the topics based on their creation time just with clicking on a column title. In that way, you can sort the boards only based on number of replies, number of views and the last post time.
For sorting the topics based on their creation time, there is no way other than adding the characters mentioned by lovesmayfamilis to the board's URL.

Or even better, create a wallet using an open-source tool, write down the seed phrase and keep the paper in a safe place. (That's recommended to be done on an air-gapped device)

Dealing with a seed phrase (a series of words) is definitely easier than dealing with a private key.
There's a high probability that you make a mistake when writing a private key. You can easily write the seed phrase on a piece of paper without any need to a printer.

You don't have to give the 70 dollars worth of ethereum from the address the user has deposited to. You can use the fund other users have deposited to process one's withdrawal.
Centralized exchanges usually move all the funds to their own wallet and use the fund in that wallet for processing withdrawals.

It's the first time I've heard of such attack.
That pre-mined block can't really increase the chance of the success of the attacker very much. Am I right?

Let's say I have control over addresses A and B and I am a miner.
I make a transaction from address A to address B in transaction A and include it in a block. I don't broadcast that block.
Now, I double-spend same UTXO(s) from address A to address C in transaction B and broadcast it.

Although the block including transaction A hasn't been broadcast yet, it's still very unlikely that the transaction B can enter the mempool of the node address C owner is connected to. Because the transaction B has been broadcast later than transaction A.


Edit:
I should keep the transaction A in my own mempool and don't broadcast that before broadcasting the block including that. Right?
In this way, other nodes won't flag transaction B as a double-spend attack and it can enter their mempool.

As shown in the following image, even if there are extra spaces in the private key you import, that shouldn’t be a problem and electrum would still allow you to click on "Next" button.
In that case, electrum would ignore the spaces and creates the wallet.

I don't think that's the problem. Armory doesn't support seed phrase at all and CSTEK7148 should deal with private key(s).

---

To CSTEK7148:
You have probably imported a wrong private key.

Look at the image below.
You should copy-paste the key in front of PrivBase58. Nothing more and nothing less.