+- Hack Forums (https://hackforums.net)
+-- Forum: Money (https://hackforums.net/forumdisplay.php?fid=241)
+--- Forum: Crypto Currency (https://hackforums.net/forumdisplay.php?fid=380)
+--- Thread: Exodus wallet compromised (/showthread.php?tid=6332613)
Pages: Pages
1
2
Exodus wallet compromised - Tightarse - Sep 27, 2026
My exodus wallet was compromised in some way.
I went to load exodus and has a notification that it went to the bin on my Mac due to malware.
Loaded exodus on my windows PC to find....
About .5 BTC.worth of funds stolen.
.45 BTC, $2.8k USDT, 800ETh, they didn't take my $150 USD of litecoin 😂.
Any recommendations on what to do next?
RE: Exodus wallet compromised - Wake - Sep 27, 2026
I would suggest you head over to the Malware, Rat, and Virus Removal I am almost certain you have downloaded some malware, in the mean time I would disconnect your machine from the internet to prevent any more harm.
5chn4pp and Tha Sneak are two solid members that will help you with removing this, either move across to that section or give one of them a convo.
Sorry for lots of edits, I would also advise getting any funds in any wallets remaining on that machine and getting them moved into a wallet that has never been logged into from the infected machine.
RE: Exodus wallet compromised - Honey Singh - Sep 27, 2026
Damn man,
Sorry for your loss.
RE: Exodus wallet compromised - Sift - Sep 27, 2026
Damn man.
Sorry for your loss.
RE: Exodus wallet compromised - SUI-3183372 - Sep 27, 2026
If Exodus its self was flagged and went to the bin, then it sounds like you downloaded a fake Exodus wallet at some point in time. Wouldn't be many ways that the executable gets quarantined like that other than it being backdoored.
RE: Exodus wallet compromised - StuffSneak - Sep 27, 2026
Most likely you got infected. If the funds are moved from the wallet then they are pretty much gone to be honest.
You should contact to Exodus support & send them all info along with the diagnostics logs I think exodus generates. If it is somehow their fault (which I doubt 99.9% its not) they will suggest further.
RE: Exodus wallet compromised - Dark Skin - Sep 28, 2026
Damn, that’s fucked
Sorry for your loss
RE: Exodus wallet compromised - Lyralei - Sep 28, 2026
That's sad. Some things don't change I guess. No matter how secure your wall is - it won't matter if there's infiltrators. Never trust any freebies or random executables online - shit even open source projects, never trust any of em.
RE: Exodus wallet compromised - Tightarse - Sep 28, 2026
After dropping many logs into Gemini....
I was using antigravity to vibe code a Tiktok downloader app.
Instead, the infection occurred through a classic Malvertising / Fake Installer Campaign that happened around the exact same minute you were setting up the project:
The Web Download Vector: At 20 September 23:37–23:50, while searching the web for a Tiktok downloader solution or setting up Python/Homebrew dependencies, you downloaded or ran an installer package (.dmg, .pkg, or terminal setup script) masquerading as a prerequisite (e.g., a fake Python update, a fake Homebrew installer, or a trojanized utility).
The Password Capture: That fake setup prompt displayed a native macOS dialog box asking for your admin password. When you entered XXXXXXX, the fake installer dropped AMOS (AccountsHelper / mdworker_shared) and established the .service and .mdworker persistence loops.
RE: Exodus wallet compromised - junooo - Sep 28, 2026
So sorry that happened to you :(
RE: Exodus wallet compromised - DramaKing - Sep 28, 2026
Do you have a good antivirus on your Mac?
RE: Exodus wallet compromised - Binance - Sep 28, 2026
(Sep 28, 2026 02:24 AM)Tightarse Wrote: After dropping many logs into Gemini....
I was using antigravity to vibe code a Tiktok downloader app.
Instead, the infection occurred through a classic Malvertising / Fake Installer Campaign that happened around the exact same minute you were setting up the project:
The Web Download Vector: At 20 September 23:37–23:50, while searching the web for a Tiktok downloader solution or setting up Python/Homebrew dependencies, you downloaded or ran an installer package (.dmg, .pkg, or terminal setup script) masquerading as a prerequisite (e.g., a fake Python update, a fake Homebrew installer, or a trojanized utility).
The Password Capture: That fake setup prompt displayed a native macOS dialog box asking for your admin password. When you entered XXXXXXX, the fake installer dropped AMOS (AccountsHelper / mdworker_shared) and established the .service and .mdworker persistence loops.
Sorry for your loss.
Next, take secure practices seriously.
I am guilty of it too, we often get lazy when completing tedious tasks.
RE: Exodus wallet compromised - Tightarse - Sep 28, 2026
(Sep 28, 2026 08:52 AM)DramaKing Wrote: Do you have a good antivirus on your Mac?
None, what av should I have?
I've been poorly advised that it's not required on Mac.
RE: Exodus wallet compromised - DramaKing - Sep 28, 2026
(Sep 28, 2026 06:46 PM)Tightarse Wrote: None, what av should I have?
I've been poorly advised that it's not required on Mac.
Malwarebytes or BitDefender should be good over the basic antimalware solution on Macs. If you're installing a bunch of unvetted packages and handing over your user password, well, plenty can happen.
RE: Exodus wallet compromised - bebonzy09 - Sep 28, 2026
Pretty pathetic how there's not one good piece of advice on this thread. OP asked for recommendations or advice on what to do... not a pity party or fucking anti virus tech support. I think his main concern is his crypto loss right now?
OP, start tracking the wallets where the funds were sent to. Document all the theft addresses, your addresses, theft amount, et all. Go write an IC3 report (IC3 won't help get your funds back but its good for the record). After this, make a police report in your jurisdiction, give them all of the above and whatever they ask you for.
Second thing is see if the funds are at a CEX. IF THEY ARE immediately contact the CEX and get them to freeze funds, give them ANYTHING they ask for. Most likely police report # and other documentation. You have to pray that its at a CEX and not already mixed or swapped into other crypto.
Third option after that if its not successful... DM @ZachXBT on Twitter or any other crypto investigators. Get it out to as many of them as possible. These guys are smart and can find links or slip ups even if it was already swapped or at a DEX.
Hopefully you've done at least one of those things so far. Wish I could've seen this thread a bit earlier.