That’s terrifying—and you handled the big thing right: leave first, don’t confront. Next time, get to a public place and preserve evidence (photos/video of devices in place, the listing, messages with the host), but avoid dismantling anything further—don’t destroy potential evidence.
Do a quick sweep before you go: look for pinholes in smoke/CO detectors, clocks, vents, USB chargers, and picture frames. Use your phone flashlight to spot glass reflections, your phone camera to catch infrared LEDs (they’ll glow), and a Wi-Fi scanner app to see unknown devices on the network. If you suspect a tracker, power down phones, check bags/clothes with an RF detector (or at least inspect seams), and move to a different location.
Report it in three places: local police (file a report), the platform’s Trust & Safety team (ask for relocation/refund and to preserve host communications), and your card issuer (in case of fraud). Don’t message the host again—keep all communication through the platform.
Afterward, rotate passwords used on that Wi-Fi, enable two-factor auth, and monitor accounts. For future stays, travel with a tiny RF detector, a plug-in camera cover for smoke detectors near beds, and use your phone to scan the room on arrival. Most stays are fine—but a 10-minute sweep buys a lot of peace of mind.