[Tightarse]

My exodus wallet was compromised in some way.

I went to load exodus and has a notification that it went to the bin on my Mac due to malware.

Loaded exodus on my windows PC to find....

About .5 BTC.worth of funds stolen.

.45 BTC, $2.8k USDT, 800ETh, they didn't take my $150 USD of litecoin 😂.

Any recommendations on what to do next?

[Wake]

I would suggest you head over to the Malware, Rat, and Virus Removal I am almost certain you have downloaded some malware, in the mean time I would disconnect your machine from the internet to prevent any more harm.

5chn4pp and Tha Sneak are two solid members that will help you with removing this, either move across to that section or give one of them a convo.

Sorry for lots of edits, I would also advise getting any funds in any wallets remaining on that machine and getting them moved into a wallet that has never been logged into from the infected machine.

[Honey Singh]

Damn man,
Sorry for your loss.

[Sift]

Damn man.

Sorry for your loss.

[SUI-3183372]

If Exodus its self was flagged and went to the bin, then it sounds like you downloaded a fake Exodus wallet at some point in time. Wouldn't be many ways that the executable gets quarantined like that other than it being backdoored.

[StuffSneak]

Most likely you got infected. If the funds are moved from the wallet then they are pretty much gone to be honest.

You should contact to Exodus support & send them all info along with the diagnostics logs I think exodus generates. If it is somehow their fault (which I doubt 99.9% its not) they will suggest further.

[Dark Skin]

Damn, that’s fucked
Sorry for your loss

[Lyralei]

That's sad. Some things don't change I guess. No matter how secure your wall is - it won't matter if there's infiltrators. Never trust any freebies or random executables online - shit even open source projects, never trust any of em.

[Tightarse]

After dropping many logs into Gemini....

I was using antigravity to vibe code a Tiktok downloader app.

Instead, the infection occurred through a classic Malvertising / Fake Installer Campaign that happened around the exact same minute you were setting up the project:
The Web Download Vector: At 20 September 23:37–23:50, while searching the web for a Tiktok downloader solution or setting up Python/Homebrew dependencies, you downloaded or ran an installer package (.dmg, .pkg, or terminal setup script) masquerading as a prerequisite (e.g., a fake Python update, a fake Homebrew installer, or a trojanized utility).
The Password Capture: That fake setup prompt displayed a native macOS dialog box asking for your admin password. When you entered XXXXXXX, the fake installer dropped AMOS (AccountsHelper / mdworker_shared) and established the .service and .mdworker persistence loops.

[junooo]

So sorry that happened to you :(

[DramaKing]

Do you have a good antivirus on your Mac?

[Binance]

After dropping many logs into Gemini....

I was using antigravity to vibe code a Tiktok downloader app.

Instead, the infection occurred through a classic Malvertising / Fake Installer Campaign that happened around the exact same minute you were setting up the project:
The Web Download Vector: At 20 September 23:37–23:50, while searching the web for a Tiktok downloader solution or setting up Python/Homebrew dependencies, you downloaded or ran an installer package (.dmg, .pkg, or terminal setup script) masquerading as a prerequisite (e.g., a fake Python update, a fake Homebrew installer, or a trojanized utility).
The Password Capture: That fake setup prompt displayed a native macOS dialog box asking for your admin password. When you entered XXXXXXX, the fake installer dropped AMOS (AccountsHelper / mdworker_shared) and established the .service and .mdworker persistence loops.

Sorry for your loss.
Next, take secure practices seriously.
I am guilty of it too, we often get lazy when completing tedious tasks.

[Tightarse]

Do you have a good antivirus on your Mac?

None, what av should I have?

I've been poorly advised that it's not required on Mac.

[DramaKing]

None, what av should I have?

I've been poorly advised that it's not required on Mac.

Malwarebytes or BitDefender should be good over the basic antimalware solution on Macs. If you're installing a bunch of unvetted packages and handing over your user password, well, plenty can happen.

[bebonzy09]

Pretty pathetic how there's not one good piece of advice on this thread. OP asked for recommendations or advice on what to do... not a pity party or fucking anti virus tech support. I think his main concern is his crypto loss right now?

OP, start tracking the wallets where the funds were sent to. Document all the theft addresses, your addresses, theft amount, et all. Go write an IC3 report (IC3 won't help get your funds back but its good for the record). After this, make a police report in your jurisdiction, give them all of the above and whatever they ask you for.

Second thing is see if the funds are at a CEX. IF THEY ARE immediately contact the CEX and get them to freeze funds, give them ANYTHING they ask for. Most likely police report # and other documentation. You have to pray that its at a CEX and not already mixed or swapped into other crypto.

Third option after that if its not successful... DM @ZachXBT on Twitter or any other crypto investigators. Get it out to as many of them as possible. These guys are smart and can find links or slip ups even if it was already swapped or at a DEX.

Hopefully you've done at least one of those things so far. Wish I could've seen this thread a bit earlier.