When you order a batch of images, we set aside the credits it will cost before any work starts, and hand back whatever the batch does not use. Retrying a failed image had a fault in that arrangement, and it cost you twice.
An order holds one set-aside amount, but each retry created its own. Retry a second failed image from the same order and the first retry's amount was left behind, referenced by nothing. It was never spent and never returned, so it came off your available balance and stayed off it — indefinitely.
The same fault made the second retry fail. Both retried images drew on whichever amount the order was pointing at, and that amount was sized for one of them. The first went through; the second was refused, and reached you as a generation failure rather than as anything you could act on.
Both are now fixed. Retrying a second image raises the order's existing set-aside instead of creating a new one, so an order keeps exactly one and both retries can draw on it. If your balance genuinely cannot cover the retry, you are told so when you press retry — before the work is queued — instead of learning it minutes later as a failed generation.
We also went back through every account and returned the credits already held this way. If your balance rose on 6 September without you buying anything, that is why. Nothing was spent on your behalf and no order was changed; the credits were simply released back to you, and the records of what happened were kept.