BTC MISSING INVESTIGATION - ELECTRUM WALLET

[suzanne5223]

Why not try to recover again the wallet using 12 words seed? First of all make a backup and be assured he own all words.
After he try to reload again this wallet... just because for what I know , malware clipboard modify the address AFTER you copy and paste, if he was correctly seeing the address this means it was already generated by that electrum wallet?!

The wallet address in the subject was never among the OP friend electrum wallet, and the trick is just the clipboard attack in which the attackers always create a wallet address that looks almost identical to the victim's wallet.
But what I don't understand is the reason why the attackers sent 0.004BTC back to the victim's wallet address after the attack.

Yes this is whats so confusinggg. Also the stolen funds have been untouched since then which is also weird. Like why would you steal but not use or transfer the funds to your main wallet afterwards i guess

Honestly, this issue is too complicated. The major of online theft is stealing from you but sending some change back is what I don't understand.
OP, how long have you known your friend?
Whats his response to this message you said you forwarded to him?
The fund you sent to him is helpful, is there any chance that he will refund it back at some point? Just to be sure maybe there's a reason for him to lie about this issue.

[DaveF]

Honestly the last justification I want to resort to is that my friend did something dishonest.

Unfortunately, it seems so.

Or there is someone else that has access to the wallet. Eliminating all the hacked or installed malware options. Do they know who really has access to the device in question?
You don't want to accuse your friend, does your friend not want to think about the fact that there may be a dishonest person living or working with them?

I know nobody wants to go down that thought path, but if you eliminate everything else, it's always a possibility.

-Dave

[hosseinimr93]

Or there is someone else that has access to the wallet.

I doubt this is the case.
bc1q.....nsa which received 0.004 BTC is owned by OP's friend. OP said that it's shown in the wallet.
If someone else had access to the wallet, he wouldn't send 0.004 BTC to OP's friend. He would steal all the fund.

[nc50lc]

-snip-
Honestly the last justification I want to resort to is that my friend did something dishonest.

To be fair, if your friend is innocent, he will indeed see 0.004BTC incoming to his Electrum wallet from his perspective.
However, if the "hacker" sent 0.004 to your friend to trick that he have received short amount.
That hacker should at least know your deal's situation because otherwise, no hacker would send some of his "income" to the intended receiver.

For now, check your previous conversation to know who's to blame regarding the missing funds.
If the address bc1qcj3f0kllhwctsvgud4k9zv5gxqf574fm2qlj5t was given by him, then it's his fault.
If he's given you the address bc1qfg0a4ns3z4ud2d90t8hfgc2a2x6j65y7j3rnsa instead, it's your fault.

And I've also read the replies in the Reddit thread.
Take note that even if blockexplorers say that it's "change address" it doesn't mean that it's true because the tag is only based from guesswork.
For example, in the txn between the two addresses in the OP, the sent amount is 0.004 which is a "round amount" while the other received 0.01005506 which is an "exact amount".
Most blockexplorers will tag the one that received the exact amount as the change because wallets usually send the change up to the last satoshi while the receiver usually receives round amount.