The overpaid fee was sent from a hot wallet using the address "bc1qr3...zpw3," which commenced operations in June earlier this year. On-chain activity associated with this address indicates automated processing of fiat-denominated withdrawals, closely resembling the behavior of an inactive wallet labeled as PayPal on oxt.me, specifically "bc1qhs...kx4n." The Bitcoin transaction fees are typically determined by market demand and network congestion. They can vary significantly, but a fee exceeding $500,000 for such a small transaction is considered highly unusual. Image Source The transition from the old wallet to the new "bc1qr3...zpw3" wallet can be distinctly observed on-chain through an intermediate address, "bc1qlm...yvaf," adding further evidence to the software bug theory. To confirm this finding, actual known PayPal withdrawals were traced on-chain, ultimately leading to the conclusion that the issue likely originated from within PayPal's management system.