How to Avoid Wallets Compromised by Android Vulnerability

Question

I'm interested in understanding Bitcoin better, and developing good habits with regard to cryptocurrency, even though I'm not using Bitcoin very much at the moment.

But based on my very limited activity with Bitcoin, I think I've found myself in a vulnerable position through mechanisms that I don't understand. Here's what I've done:

1. Months ago, I set up Bitcoin Wallet on my Android phone. And it, of course, assigned me a Bitcoin address (1L...).
2. I visited a couple of those sites where you view an advertisement and get a trivial amount of Bitcoin, just to see how the transactions flowed. This worked, and I then had Bitcoin holdings that were too small to spend. I left it all alone for a while.
3. I installed Multibit on my desktop and imported my private keys from Bitcoin Wallet.
4. Bitcoin Wallet posted a notice of an Android vulnerability that affected Bitcoin wallets, and suggested moving funds to a new address. The app created a new address for me (1M...). I imported the new private keys to Multibit, but my holdings were of course too small to be moveable.
5. Recently I saw that an app developer who makes a free app that I find highly useful was taking tips in Bitcoin. I thought this would be a nice chance to go a little deeper into the Bitcoin ecosystem. So I purchased enough to cover my tip (with a little left over) from Coinbase, and then transferred them to my new, presumably uncompromised, address: 1M...
6. I initiated my tip to the app developer in Multibit. That transfer went successfully, but when I examine the blockchain, I see that the transaction has emptied my new address (1M...) and put it all in the old address (1L...) that Bitcoin Wallet warned me not to use any more.

The amounts I'm dealing with are quite small, so I'm not in a panic about it -- but I don't understand what happened here. Specifically,

1. Why did the transaction clear out the funding address rather than just take what it needed from it?
2. Did I do something wrong? Or, alternately, is there something I could/should have done to manage the transactions with more detail?

Answer 1

As this bug has been fixed the best idea is to archive those addresses which have been generated before the update (not all wallet applications support this feature). The other is to completely remove the wallet and replace with a new updated version.

As far as im aware no wallet supports deletion of addresses (for obvious reasons).

As for creating transactions, on specific wallets some have more detailed sending abilities than others, its all about a balance of userfriendly vs features. If you look at blockchain.info wallet it has advanced features allowing specific send from and change addresses to be set, most mobile apps will probabaly lack such sophistcation due to being made for mobile.