need help, my BTC transaction seems off. Could I be hacked?

Bitcoin core V25.0.0 Running on Windows 10, and my setup is a custom-built Ryzen 3 from 2018. I sent a transaction of 0.02 btc plus fees to the correct address, but now the blockchain is showing an extra 0.17966 BTC was sent to a different address. Am I getting hacked? If so, what steps can I take to retrieve the rest of my BTC from my wallet? Do I need to use the private keys for that? I’m not sure if my links or images are showing up, so if there’s a problem, just let me know what I might be messing up.

But you balance is correct on the wallet? Check the lists of your addresses on your wallet under change address. You will see the address among your change addresses. If you do not know how to check your wallet addresses, you can let us know the wallet that you used so we can give you a guide on how you will see your addresses on the wallet. If it is your change address, that is the address the change of the coin your sent is sent to. The change is the UTXO that is sent to your change address.

Balance is correct on computer 1HAdCm5Fo2MG4aDNhw9BQ4YwRPVeVLsHSx is the address that i sent from Balance is now zero on chain I need the guide, i couldn't find the "change wallet" though I swear I seen that before Thank you

I suggest you hop over to https://learnmeabitcoin.com to learn how Bitcoin transactions work. A transaction spends so-called inputs, these are chunks of coins, and creates new unspent transaction outputs (UTXO). Any input will be spent completely and destroyed. Suppose you have an UTXO from a former transaction to your wallet of the value 0.2BTC. Now you want to send 0.02BTC to some destination address. In your transaction the input is your chunk of 0.2BTC, one output is your desired 0.02BTC to some address. Now what about the rest of your input, the 0.18BTC? Something must happen with it as you don't want it to become transaction fee in full. Remember: transaction fee equals sum(input(s)) minus sum(output(s)) If you don't provide a change output back into your own wallet, then the 0.18BTC would become transaction fee. You certainly don't want that. Therefore your wallet adds a second change coin output, e.g. the 0.17966BTC to return the excess of your input back into your own wallet. The resulting transfer fee in my constructed example will be: 0.2BTC minus sum(0.02 + 0.17966) equals 0.00034BTC  --- 34,000sats seems a bit excessive for a transaction of one input and two outputs, but hey it's just an example. Did you "upgrade" your current wallet compared to in 2017 when your address 1HAdCm5Fo2MG4aDNhw9BQ4YwRPVeVLsHSx was funded with 0.19966345BTC? I'm not sure if Bitcoin Core would switch address types unless you explicitly ask for it. Both your destination address and change address are now native segwit type instead of legacy.

Sounds like its just the change wallet address. On your previous transaction, your change address is "bc1qxq....jh68ha". In simple terms it's the "change" after paying/sending money from higher bill. You have 5, you pay 2 (including the fees), your change is 3. That's why your balance is still correct on your wallet.

Oh, I did not realize that. The Bitcoin core wallet has just been storing BTC for several years, sent to it but not from it. Guess I didn't notice back in the day because I wasn't tracking anything on the chain. I'll check out the link. I now use exodus mostly so what can I say   Hopefully my time limit has passed so I can post this now and especially hope all those drafts delete on their own. Thank you very much.  I really appreciate the help.

Bitcoin Core by default sends the UTXO to a change address of the same type as the destination address, in order to preserve privacy, currently it's one of the only wallets that provide this feature, you can change it with the command line in the bitcoin.conf file: changetype=bech32 You can replace bech32 with "p2sh-segwit", "bech32m", "legacy" and etc. Have you switched to a closed-source wallet? I don't know which wallet you used previously (it seems to be Bitcoin Core, due to the spending behavior and changing the type of address from the change address to the same type as the destination address). But for Bitcoin, the most recommended are Electrum, Sparrow and Bitcoin Core.

The block explorer shows https://blockchair.com/bitcoin/transaction/75b7e3e007e4c45ec6e06d947949b0b1dc63ac3370eb848a05ff313f7aeaa930 I believe the 2 outputs all belong to another different wallet and you send your bitcoin to two different addresses. None of two outputs are your change address because your inputs is 1HAdCm5Fo2MG4aDNhw9BQ4YwRPVeVLsHSx. It's a Legacy address. If a change address belongs to the same wallet, one of 2 outputs must starts with 1 too. Both output addresses are bc1 (bech32) segwit addresses and no way it belongs to a same wallet from which you make this transaction. Types of Bitcoin addresses Legacy: 1 Nested Segwit: 3 Native Segwit: bc1q Taproot: bc1p

Not necessarily.  Bitcoin core wallets can generate any type of addresses, and the change address can be a different type than the input address.  The OP already said his account balance is accurate, indicating he still has the change amount in his wallet.  He just needs to find it.

I join all of the above, the remainder will be returned or has already returned to you. I remember it happened to me when I just started using the Electrum wallet and was also scared until I came across this: Electrum and change addresses

Since he used Bitcoin Core v25.0, it should have a privacy feature of using the same change type as the output if the change/address type isn't specificized. References: Under "CWallet::TransactionChangeType": https://github.com/bitcoin/bitcoin/blob/v25.0/src/wallet/wallet.cpp#L2291-L2298Default v25.0 address type (fallback address type used by the code above): https://github.com/bitcoin/bitcoin/blob/v25.0/src/wallet/wallet.h#L125 One "ismine: true," result from: getaddressinfo bc1qxqj5nr97ln0uadepjvr6fufpdfwah9h8jh68ha should clear all his doubt, although he already acknowledged it in his last reply.

Hi, Just in case anybody ever has the same question and finds this thread.  Using the console command listaddressgroupings  finally listed all the wallets including the "change" wallets. Other commands like listreceivingaddresses did not. So all is well, the "missing" BTC was returned as change to my Bitcoin QT wallet. i panicked for no reason. Thanks again everyone, I would have posted this earlier but family things came up. Finally getting back to my project of transferring off the old machine before my hard drive fills up.