This question already has an answer here:
I did a test lightning transaction by sending 0.00001 btc to some exchange with using bitcoin core 0.16 (downloaded from bitcoin.org and installed to dedicated pc) and... it took the rest balance of my wallet which was sent to unknown address.
Here is the transaction: https://www.blockchain.com/btc/tx/5d6111094be588c180661cb2f0ee21a7de28a7dea8641cb9921b4aada3175dd5
As you can see there is 0.00001 btc sent to some exchange wallet and also 0.00948723 is sent to unknown address (exchange says it's not belongs to them).
What was the second transaction?