Yeah, that's the part nobody warns you about: the drain is the loud symptom, but a machine that ran attacker code is compromised until proven otherwise. A few things worth checking while you're in triage mode. Assume any credential that touched that machine is burned, browser saved passwords, exchange sessions, email, SSH keys, cloud tokens. Revoking is right, but also check what those sessions did before you cut them, since an attacker with a live token often exfiltrates or re-keys before you notice. Look at login history and recent device lists, not just password changes. Watch for the persistence: launch agents and daemons on macOS, cron jobs, scheduled tasks and Run keys on Windows, systemd units or shell rc files on Linux. If you only deleted the repo, the payload may still be resident. Honestly, on a box that ran real malware, often the cleanest move is wipe and reinstall, because a thorough manual sweep misses things. And the painful one, any other seed phrase or key that existed on that disk, even in a screenshot, a notes app, a password manager vault that was unlocked, is now suspect. The interview-lure malware specifically hunts wallet files and keystores. What OS was it? That changes what a cleanup actually looks like, and whether a wipe is worth the hassle versus a targeted hunt.