Thanks
All of it make sense 

What order should I follow when creating a transaction

Is there any standard or recommendation on how to join coins in order to send a particular amount?
Do you add base on oldest to newest? (or viceversa)
Do you add them based on amount, meaning lowest to highest (or viceversa)?
Do you randomly pick until you add-up enough for the total to send?

Thanks
angelo

Merit?
What do you mean?

No, I have over 30 years of experience developing software, it just I just started with blockchain, and the only way I know to learn it's just by doing.
this is why I'm doing the wallet from scratch (almost, I'm using the NBitcoin library, but I'm planning to replace it as soon as I have a stable wallet)

It shows that I'm a newbie :-)
Thanks

I think I've figured out the problem and it's not what you think :-)
let me give you a little bit of background:
In order to crate a this particular wallet I was using "Brain wallets" (which is basically a sha-256 of a text), but I was using simple words like "black" and "white".
I think this simple "words" are part of a databases of "simple" KEYS, which could be easily generated from any source of "public common passwords".

What I think happened is that somebody is "scanning" the "memory pool" of the block chain for any money going to those addresses and immediately run a Vin on those, and they are using the TestNetwork to "test it" :-)

In order to test this "theory" this time I've created a trully random KEY and copy and pasted into the Electron wallet (via WIF) and nothin happened.

I appreciate the comments,

For those that asked for the link to the source code I didn't poste them because it's currently connecting to a "Bitcoin Explorer" that i'm developing (in conjunction with the wallet) an is in my internal network.
As soon as it's stable enough I plan to put it public

Thanks again for all the support.
Grate community !!

First of all I really appreciate all the feedback and responses.
This is what I'll try next in order to rule out any posible compromised software/hardware.

1- I'll reinstall a fresh copy of iOS on an old mac laptop that I happened to have
2- download from Microsoft .NET dev kit.
3 - post the source code of my wallet on GitHub
4 - download on the "fresh" computer the code from GitHub
5 - compile, run and create a new "one address wallet"
6 - request some test coins.
7 - examine result.

Am I missing something with this procedure?
Could this be compromise in any way?

This will take me some time but I'll post my results as soon as I have them

Thanks

This is getting stranger by the minute.
I've created another public KEY, this time I didn't even look at the prive key.
i've created on the wallet that I'm developing using NBitcoin library.
I'm compiling everything from source code
Then I requested to a couple of faucets some test coins and when I'm looking into the block chain this is what I see:

The public address is "mwT5PqSoLCeojDhghhBdXFCMMwGYxb34Ge"
I've received 3 "payments" from 3 different faucets (all on the same block).
But at the same time all of them where spend and when to the same address as on the prevues testes, and all of this happened on the same "block"
and based on the timestamps at the same time.
How can this be possible?

On the bright side we can rule out "a compromised" Electrum (which by the way I did downloaded from the official site + verified the signature)

   "Transaction": [
      {
         "TransactionId": "02e8df6726862abb55f509882b0c8e461847bb4f06c30aa3bc7728fddf7af7c3",
         "n": 1,
         "value": "0.02844292",
         "scriptPubKey_address": "mwT5PqSoLCeojDhghhBdXFCMMwGYxb34Ge",
         "datetime": "2022-10-21T17:06:49",
         "Used": {
            "UsedId": "066c68d50edebc57dbb35e4a16c45cdc740c83e920b6d05c22a382904839d075",
            "UsedN": 1,
            "UsedDateTime": "2022-10-21T17:06:49",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.02821192"
               }
            ]
         }
      },
      {
         "TransactionId": "5598cb033f74571b7008548c0d2934ee5a1473d49b916cfacf432848aea8dfee",
         "n": 1,
         "value": "0.00066664",
         "scriptPubKey_address": "mwT5PqSoLCeojDhghhBdXFCMMwGYxb34Ge",
         "datetime": "2022-10-21T17:06:49",
         "Used": {
            "UsedId": "e46c907ae25eeed9cb73c3fa095c21c2e36fdb7d597d13e693f52435330fff66",
            "UsedN": 1,
            "UsedDateTime": "2022-10-21T17:06:49",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00043564"
               }
            ]
         }
      },
      {
         "TransactionId": "65ceb923844fd8761751ab8584f4170ee6760b250e2ad19dcd66f5d8a618ce8d",
         "n": 0,
         "value": "0.00010000",
         "scriptPubKey_address": "mwT5PqSoLCeojDhghhBdXFCMMwGYxb34Ge",
         "datetime": "2022-10-21T17:06:49",
         "Used": {
            "UsedId": "6efbcda30b63948fba9bcae84976dfad16769feb593275a9cc34eff035a64726",
            "UsedN": 0,
            "UsedDateTime": "2022-10-21T17:06:49",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00009488"
               }
            ]
         }
      }
   ]
}

This is the "about"

--------------------------
Version 4.2.2

Electrum's focus is speed, with low resource usage and simplifying Bitcoin. You do not need to perform regular backups, because your wallet can be recovered from a secret phrase that you can memorize or write on paper. Startup times are instant because it operates in conjunction with high-performance servers that handle the most complicated parts of the Bitcoin system.

Uses icons from the Icons8 icon pack (icons8.com).
--------------------------

I just did another test.
I've created a new Key from my wallet and instad of copying and pasting it into election I type the WIF (one character at a time :-) )
When I request coins from a faucet , I experience the same problem
her's the new public address:

mvj3tFakMuFx15FewGtzpdhvxtrw5trvhw

https://blockstream.info/testnet/address/mvj3tFakMuFx15FewGtzpdhvxtrw5trvhw

Any idea what is happening???
Thanks

I've crated a wallet on electors importing a WIF (just one address).
After that I've requested several coins from faucets on Testnet.
When I see the history of transactions very time I receive some coins is immediately sent to a new address.
This is the public address:

muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH

Here's a link to a test explorer with the addresss:

https://blockstream.info/testnet/address/muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH

This is a brand new address that I've created on a wallet that I'm developing and imported the WIF in electrum.

Could this bee some type of "malware plugin" that recored the WIF when I've moved from one wallet to the other?
Has somebody else seen something like this?

Here's a JSON of each Vout and Vin

{
   "Transaction": [
      {
         "TransactionId": "8457733c113568bb53eba8a6d3160f6932bf167b916a1d3c31f76e43a6b1d3ec",
         "n": 1,
         "value": "0.01922572",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T19:52:28",
         "Used": {
            "UsedId": "b335d8e6f2ab6ea69677c46841aa47804433b198b313504b2c0b0e4259afc7eb",
            "UsedN": 1,
            "UsedDateTime": "2022-10-20T19:52:28",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.01899472"
               }
            ]
         }
      },
      {
         "TransactionId": "89721265fb77dac877ca687e151a20f495d6fa60737146d9a9f2ddab522d4411",
         "n": 0,
         "value": "0.00031480",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T19:52:28",
         "Used": {
            "UsedId": "ebd7af5aad4c08641723c88496c7fa2f444b329473ea01ffbdc7ee61327b2fbe",
            "UsedN": 0,
            "UsedDateTime": "2022-10-20T19:52:28",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00008380"
               }
            ]
         }
      },
      {
         "TransactionId": "a4d28ef0c9c714db2b247262bf5ff8088d859ff8cad833a9456198ee9fd9d853",
         "n": 1,
         "value": "0.00050000",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T19:52:28",
         "Used": {
            "UsedId": "0244a84c9f2d4a04d979e8fabe5b1e2baa4f75f3914c51619b00f00782a1e0c4",
            "UsedN": 1,
            "UsedDateTime": "2022-10-20T19:52:28",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00026900"
               }
            ]
         }
      },
      {
         "TransactionId": "c875f88f9f2ba613ec902f46588126ec6d1bb1bcedfc1ce62d006620fddb4b3a",
         "n": 1,
         "value": "0.00010000",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T21:39:10",
         "Used": {
            "UsedId": "ee6243dfbe9964512a807286c32c3b1603958b559825c61fa316e0d4f5d24d9a",
            "UsedN": 1,
            "UsedDateTime": "2022-10-20T21:39:10",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00009488"
               }
            ]
         }
      },
      {
         "TransactionId": "ec3f4ab0bca77aca9a9b9ac2c035d2d2c8e3079bac121a335f2ecff0cf4e7ee2",
         "n": 1,
         "value": "0.00010000",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T19:37:50",
         "Used": {
            "UsedId": "afc03d24ee2311a40ed98e97c8e3a5b5d783267a6a691c23727f0176a546fa72",
            "UsedN": 1,
            "UsedDateTime": "2022-10-20T19:37:50",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00009488"
               }
            ]
         }
      }
   ]
}