My Bitcoin Core Sent Bitcoins Without My Authorisation I am running Bitcoin Core version v0.19.0.1 (64-bit) on Windows 7, and on 27 February I noticed that it sent 0.0045 bitcoins on its own.

The wallet is encrypted at all times and I enter the passphrase to send as required.

I did NOT initiate the Send.

I am greatly concerned. The PC is regularly checked for virus and malware.

The transaction details are:-

Status: 320 confirmations
Date: 27/02/2020 16:37
To: bc1qz944eascuflps4nmsc0w5cpz9p3cxdyqjmmqw7
Debit: -0.00447194 BTC
Transaction fee: -0.00002806 BTC
Net amount: -0.00450000 BTC
Transaction ID: 3c138afea7d634ce5e8b608e1a751122d6d33ba9bd8e00a02de02cb57aad039d
Transaction total size: 214 bytes
Transaction virtual size: 133 bytes
Output index: 0

The previous transaction:-

Status: 455 confirmations
Date: 26/02/2020 18:27
From: unknown
To: 3Hb61TTkbxPTUCA6EvUStb8PPMZUjPASfd (own address, label: coinfloor)
Credit: x.xxxxxxxx BTC
Net amount: +x.xxxxxxxx BTC
Transaction ID: 5697d9b298647c216a727f95dbdecfc658a9f8da3c45f98bc8c8a2439c8f1cfc
Transaction total size: 404 bytes
Transaction virtual size: 214 bytes
Output index: 1

The last time I sent was with this:-

Status: 43126 confirmations
Date: 17/05/2019 07:25
To: Coinfloor 5 10 13vk63282b4FkhyyV9mmgQTxpao9ECnnmB
Debit: -x.xxxxxxxx BTC
Transaction fee: -x.xxxxxxxx BTC
Net amount: -x.xxxxxxxx BTC
Transaction ID: d23b6c3f42339ace670d0ebdca4eabcfe45c34b0ccab44c9767a519682e415ba
Transaction total size: 932 bytes
Transaction virtual size: 530 bytes
Output index: 1

I would like to know how this could have happened, because I definitely did NOT initiate this send.

Any suggestions about how to diagnose this? I expect there's no way to recover the 0.0045 coins.
You do not explain why you believe your bitcoin core process sent the bitcoins. It is perfectly possible (from looking at your logs) that it was not sent from your bitcoin core, but from elsewhere on the bitcoin network. It may be possible to track down where the tx was sent from if enough nodes log the IP address of where the transaction was initiated, but there is nothing in your logs to suggest it was initiated from your node. In fact, your logs suggest that it was not initiated from your node.

Therefore, at some point the private keys for your bitcoin address were obtained. This could have been done if your computer contains malware, perhaps a key-logger, which was able to capture your wallet password, in combination with the wallet file.

The output that was spent was populated on 2018-12-28 19:12, but the private key associated with the address could have been created years earlier, as Bitcoin Core by default creates 100 addresses when it is first started, so the private key to this address could have been stored on a computer of yours for some time, perhaps even in an wallet with no password, if you initially didn't enable the password until later. So the time of intercept (of the private key) is theoretically any time between when you first ran Bitcoin Core and when the theft occurred.