I Gave Someone Remote Access to My Computer and My Crypto Is Gone

You let someone into your computer — maybe because they claimed to be tech support, maybe because a friend recommended them, maybe because a pop-up warned of a virus and a number to call. Now your crypto wallet or exchange account is empty.

This is one of the fastest-moving theft vectors in crypto because the attacker has complete access the moment the remote session starts. Here's exactly what happened and what to do about it right now.

What Just Happened

How Remote Access Crypto Theft Works

Here's the sequence of what typically happens during a remote access crypto theft, from the moment access is established:

Secure Your Computer First

The device is compromised — treat it that way:

• Disconnect from the internet. Unplug ethernet, disable WiFi. Preventing ongoing access is the immediate priority.
• Do not use it for any financial accounts. Any credentials you enter on this device may be captured by installed keyloggers. Use a different device for all financial activity until this one is cleaned.
• Run a full malware scan. Use a reputable security tool (Malwarebytes, Windows Defender offline scan) from a bootable USB if possible to scan before the operating system loads.
• Consider a full wipe and reinstall. If you have reason to believe sophisticated malware was installed, a full OS reinstall is the only guarantee of a clean machine. Back up files to external storage first, but do not run executable files from the backup.
• Check for installed remote access software. Look in installed programs for AnyDesk, TeamViewer, LogMeIn, ConnectWise, or any other remote access tool you did not install yourself.

Secure Your Accounts

From a clean device (not the compromised computer), immediately:

1. Change passwords on all financial accounts. Exchange accounts, bank accounts, email accounts. Prioritize in that order. Use a strong, unique password for each.
2. Revoke API keys and connected apps on all your exchange accounts. Attackers sometimes create API keys or add OAuth connections to maintain access after you change your password.
3. Enable or reset 2FA. If 2FA was active on your exchange account, check whether the attacker modified the 2FA settings during the session. Re-enroll 2FA from scratch on all financial accounts.
4. Check withdrawal address whitelists. Some exchanges have withdrawal whitelist features — verify that no unauthorized addresses have been added.
5. Move remaining crypto to a new wallet. Any wallet whose seed phrase or private key was on the compromised computer should be considered permanently compromised. Transfer all remaining assets to a fresh wallet created on a clean device.
6. Contact your exchange's fraud team. Report the unauthorized access. Provide the transaction hash of the theft, the approximate time it occurred, and request that receiving wallets be flagged. Include your IC3 complaint number when you have it.

Can the Funds Be Traced?

Yes. The theft method — remote access — does not affect the on-chain traceability of the funds. Once the attacker moved your crypto, every subsequent transaction is permanently recorded on the blockchain.

A blockchain forensic trace follows the fund flow from your wallet through every subsequent hop, identifies clustering patterns that link wallets controlled by the same operator, and determines which exchange or service ultimately received the funds. If that exchange is regulated and holds the funds, there are legal mechanisms to pursue recovery.

See our detailed breakdown of how forensic investigators trace stolen crypto for what this process looks like. If your MetaMask was specifically targeted, see my MetaMask was drained — can it be traced.

Recovery likelihood depends on: how quickly you act, whether the funds are still on a regulated exchange, and whether that exchange is in a cooperative jurisdiction. See realistic recovery timelines for an honest breakdown by scenario.

How to Report It

• IC3.gov — FBI Internet Crime Complaint Center. File with the remote access tool used, the crypto amounts and transaction hashes, the wallet addresses involved, and how you were contacted. Use our step-by-step FBI reporting guide.
• FTC at ReportFraud.ftc.gov — Tech support scam reports feed consumer protection enforcement.
• Your exchange's fraud team — Report the unauthorized withdrawal and the receiving addresses. Request account review and wallet flagging.
• The remote access software provider — AnyDesk, TeamViewer, and similar tools have fraud abuse teams. Reporting the attacker's account ID (visible in session history) can help them disable the attacker's access to the platform.

Preventing It From Happening Again

• No legitimate company will call you to fix your computer or crypto account. Microsoft, Coinbase, MetaMask, and every other major platform do not make outbound support calls. Hang up.
• Do not install remote access software for anyone who contacts you first. If you need tech support, initiate contact with a company's official support channel yourself — never in response to a pop-up, email, or cold call.
• Hardware wallets eliminate the remote access risk for stored crypto. Funds in a hardware wallet cannot be stolen through remote access because transactions require physical confirmation on the device. See our guide on hardware wallet best practices.
• Never store seed phrases on any internet-connected device. Seed phrases written on paper and stored physically are not accessible to remote attackers. Any seed phrase stored in a document, note, or email is a permanent vulnerability.

Frequently Asked Questions

Can crypto stolen through remote access be traced?

Yes. The theft method doesn't affect on-chain traceability. Every transaction from your wallet creates a permanent blockchain record — wallet addresses, amounts, timestamps, and ultimately the exchange where funds landed. A forensic trace follows this trail.

What does a scammer do with remote access to steal crypto?

They scan for open exchange sessions, capture browser-saved passwords, extract wallet files, initiate withdrawals from authenticated accounts, and may install persistent malware. The entire process can take minutes once access is established.

What should I do first after remote access crypto theft?

Disconnect from the internet immediately. From a clean device, change all financial account passwords and revoke API keys. Contact your exchange's fraud team. File with IC3.gov. Get a forensic trace started while the on-chain trail is recent.

I was tricked by fake tech support — is this a known scam?

Yes — tech support scams are one of the most common remote access theft vectors. A pop-up, email, or call warns of a problem, you install a remote access tool, and your accounts are drained. The FBI received over $800 million in tech support scam losses in 2022 alone.

Is my computer still compromised after the scammer disconnected?

Possibly. Attackers often install persistent malware or keyloggers during the session that survive after the visible remote session ends. Do not use the compromised computer for financial activity until it has been fully wiped and reinstalled.