A few years ago I received some bitcoin in Bitcoin Core (~0.4 BTC). Then I transferred some to Kraken (~0.1 BTC) and a few weeks later transferred some back (~0.1 BTC). Then I backed up wallet.dat and formatted that computer.
Now I wanted to sell these bitcoins. I opened the wallet by putting wallet.dat into the correct directory and then running bitcoin-qt -rescan. Bitcoin Core is not synchronized. For some reason it only shows the initial inward transaction of ~0.4 BTC (even that time range is not yet synchronized), but not the other ones.
Then I used listaddressgroupings, which gave me one address and used dumpprivkeys to export the private key for it. I pasted that private key into Electrum. After synchronizing, Electrum shows the initial inward transaction of ~0.4 BTC, but also an outward transaction of the entire sum 2 months later.
Stealing my wallet.dat would have been extremely difficult, because my computer is encrypted and I strictly run Debian with only software from the official repository. Even if the money got stolen the smaller transactions to and from Kraken should show up in Bitcoin Core and Electrum.
I'm a software developer, but I don't know how Bitcoin works specifically. Does anyone have any ideas what could have happened to my Bitcoins?