I use Exodus Wallet and have used them for a couple of years. My 12 word seed phrase is written down and in a fireproof safe. I do not have it saved anywhere on my PC. Exodus also asks for a password (though I know this is local only – anytime I open it). No one has been on my computer or in my house with any access to this other than myself.
I don't know where else to go for help. I realize that it's a slim to none chance I'll ever see my at the time $47K worth of BTC again. I posted this on Exodus Wallet and some other reddit forums but it keeps getting taken down. At the very least this should serve as a warning to others using Exodus Wallet (especially without a Trezor or some such linked to your Exodus wallet).
If I am not allowed to post details such as the transaction ID and the Wallet address that my BTC was transferred to then I apologize, a MOD can hopefully edit that out instead of delete my post. My hope is that maybe the thief will slip up and send it to a KYC exchange. Though, I'm still not sure of recovery chances if that occurs. I worked hard for this half a BTC and I am still in shock, I know time will heal all things but it has been a rough couple of days. This is a throw away reddit account because I am frankly ashamed and embarrassed that this occurred.
On April 28th around 2:20pm I had a malware infection which I discovered fairly quickly. I noticed my mouse cursor had the loading circle next to it repeating itself over and over… So I checked task manager and there was a program called "Azubuy" which I never saw before. I then shortly after saw "Opera" browser and "Anydesk" open up (neither installed on my machine and Anydesk sent big red flags because it's remote access). I cancelled all 3 of these from task manager and deleted their directories as well. I then went into startup programs and saw like 30 entries of "Azubuy" and turned them all off and restarted my PC.
When my PC booted back up Azubuy was again in my task manager. So I decided then to just format and reinstall Windows. I had backups of everything elsewhere and thought this is the best way to ensure whatever is going on is eliminated.
While Windows was now reinstalling I got an alert on my phone that someone was trying to get into my Gmail but 2FA thwarted it. An IP address from some ip address in Oklahoma. So that prompted me to check other things and when I loaded my Exodus app on my phone my heart sank as I saw all my BTC sent to some wallet I know nothing about. Looks like that wallet has accumulated over 3 BTC now and I'm not some amazing block chain forensic analyst but I'm sure they are going to want to cash that out somehow somewhere.
I know I clearly created the opportunity here for this by not having a Trezor and also getting malware'd. But hell how did they get my seed phrase for my Exodus wallet, isn't it encrypted even though it's stored locally on my PC? This all happened in less than 5 minutes mind you. I'd of been safer leaving my crypto in Coinbase at least I'd of had 2FA like on my Gmail. Live and learn… Any help or advice is GREATLY appreciated.
Apparently I can't post transaction or wallet ID's here – but I am willing to get them to anyone that thinks they can help me trace things.
