How about some more details about what actually happened.
What has Epik told you?
In order to transfer the domain at some point someone had to get your AUTH code.
Was your account logged into by another party at Epik?
Bare in mind Epik had a massive data breach that revealed passwords, credit cards, and other sensitive information. So, who knows what data was in the hands of a third party.
There have also been numerous reports of other unauthorized transfers.
GoDaddy might not be great, but I certainly don't trust Epik.com at face value. They have spent more than a year scamming customers, leaving a trail of victims behind.
Epik.com is still accredited under Epik Inc.
"Epik LLC" is not an ICANN accredited registrar. They are just pretending to be one.
They are either being run by the same clowns that created this mess to begin with, or new clowns that have no idea how to operate a registrar.
Either way. Get out while you can.
Brad