Got hacked but can't find source of it
I woke up an hour ago to being spam called by a friend saying my Instagram was hacked. 6 hours prior to his call a new post and story appeared, it was something involving crypto but didn't read the posts to figure out if it was recommending or telling how to, I deleted them, and started to secure my account by kicking everyone out of the account, password change, 2factor etc.
Now I'm looking to find out how I was compromise but can't find the source. There was no new account in my insta, no log in or anything. Besides the post and account going public from private I see no sign of anyone ever accessing my account. I made sure to remove usuported browser extensions, running a pc virus check and updating password etc. But I don't know where exactly I got hit from.
My facebook was hit a week ago but in that case just a new log in (from my home?) and email was added that was a giberish email and googling the part after the @ resulted in no real result. I changed passwords but I assumed that it was some fluke because I don't have a high value account, low activity, low reach etc. why would it worth the trouble for someone to go the extra mile to be able to hide the traces this much.
What extra measures should I put in place, what should I still check to better protect myself in the future?
Is there any point in reaching out to Meta if I have control? Both in the finding the source and to be protected from any restriction for crypto posting bs.
Does the habit of often hibernating device overnight give me a lot of security vulnerability?