[IGNORE, I'm an idiot]

[Nancarrow]

(This is all from memory at the moment as I don't have access to that computer right now, but will try to get it again in a few days)

Got hold of a family member's laptop. Had to wipe the Windows system partition and reinstall Win7 plus all the programs, I'm sure we've all been there.

Reinstalled electrum, the latest version, 2.9.3.

On opening it, was expecting to be told to create a new default wallet.

Instead I gazed upon a wallet that was neither mine, nor that relative's (I have theirs on a separate USB stick). It had over 13 BTC on it!
Naturally I first wondered if it was spendable (I'm only human) but no, it's seedless. It has transactions going back to June 2011 and up to just recently. There are several for 0.1 or 0.01 etc, and quite a few for 0.0000543 which IIRC was/is the minimum relay fee for the core client.

Can someone explain this behaviour? Is there some kind of 'test' wallet that electrum installs if it has nothing else to go on?

[1714071028]

1714071028

[1714071028]

1714071028

[pooya87]

are you sure you really installed "Electrum" and not a scammy version of it downloaded from somewhere else like a malicious website?
and did you verify the signature of the installation file that you downloaded?

so far this behavior was either because people downloaded a malicious version from some other website or it is because there has been an installation of Electrum on that computer beforehand which left behind that wallet file which now new installation is using.

[Nancarrow]

Sorry, I just realised what was up. When I installed Electrum, I DID in fact put a watching-only wallet on there, just as a placeholder before transferring the real wallets. It was watching the 1BitcoinEaterAddressDontSendf59kuE address.