Strange Transaction while Tranferring BCH after the August Fork

[lupusc]

I wanted to transfer BCH to a new wallet after the August fork. So on a different machine (Ubuntu) I installed Bitcoin ABC and synced with the Blockchain. On the original Bitcoin core I exported the private keys and afterward imported them to the newly installed Bitcoin ABC, pretty much as decribed here: https://medium.com/@tmontgomery98/accessing-bitcoin-cash-24704a16a1a4

I expected the transaction appear in the ledger identical to the former ledger in Bitcoin core, but some strange things happened:

Some entries emerged with a different date/time than in the original ledger

There was an extra transaction spending some bitcoin (about 0.05) to an obviously valid address (confirmed more tha a thousend times, the client tells me). The amount spent was exactly the amount needed to bring the balance to zero after that suspicious transaction.

Next in the ledger I had reveived a little less than 1 bitcoin and a little later spent somewhat more than one. After that the balance shoult have been still above zero, but actually that very last transaction showed up with only the amount to bring the balance to zero, seemingly because the balance can never be negative.

Now I am very reluctant to import the very last private key, which should receive about 2 Bitcoin just before the fork.

Does anyone have an Idea, what could have happened with this additional transaction? I didn't recognize any compromizing of the blockchain so far. (I have screenshots of both ledgers, but I am reluctant to post them)

Should I add, that after the fork and before the just mentioned procedure I transferred the original BTC to a new address to a different wallet on yet a third machine, where they emerged just fine in the expected amount.

With kind Regards - Lupus

[1713977526]

1713977526

[1713977526]

1713977526

[LoyceV]

I expected the transaction appear in the ledger identical to the former ledger in Bitcoin core, but some strange things happened:

Some entries emerged with a different date/time than in the original ledger

There was an extra transaction spending some bitcoin (about 0.05) to an obviously valid address (confirmed more tha a thousend times, the client tells me). The amount spent was exactly the amount needed to bring the balance to zero after that suspicious transaction.

That means someone already claimed your Bitcoin Cash.

Now I am very reluctant to import the very last private key, which should receive about 2 Bitcoin just before the fork.

Can you check the address (NOT the private key!) in Bitcoin Cash Explorer?
And while you're at it, also check it at Bitcoin Gold Explorer.

Does anyone have an Idea, what could have happened with this additional transaction?

It sounds like someone got to your private key.

Should I add, that after the fork and before the just mentioned procedure I transferred the original BTC to a new address to a different wallet on yet a third machine, where they emerged just fine in the expected amount.

At least you secured your Bitcoins, that's something

[lupusc]

It took me a while but finally I figured making the mistakes of a bloody beginner.

Whenever you don't want to spend the entire balance of an address the change has to go somewhere. This suspicious address was simply one of my own where change went and for which I was able to dump the private key as well. Unfortunately this is not recognizable at the first glance in the ledger of Bitcoin core. After dumping this and some more private keys and importing them into Bitcoin ABC everything looks as expected.

The Blockchain explorer helped me a lot to figure this out. So many Thanks to LoyceV for the hint. Should have thought about them myself.

Nice season to all - Lupus