Topic starter
11/11/2026 6:02 pm
TL;DR: Attendees at a crypto event were allegedly pushed to install software that would give organizers remote control of their computers, according to Cyble. In practice, that kind of request can turn a conference laptop into a bridge to wallets, exchange accounts, and stored credentials.
Editorial analysis by NHI Mgmt Group, based on content published by Cyble: “Don’t Get Played: TOKEN2049 Security Event Faces Scam Claims”.
Key questions
Q: Why does remote control on a signed-in laptop create account takeover risk?
A: Remote control on a signed-in laptop can expose the active session, letting an attacker use the person’s authenticated browser, mail, cloud apps or cached credentials without needing to know the password.
Q: How do conference social-engineering scams get around normal device security?
A: They bypass normal device security by persuading the user to install remote-access software, approve a support prompt or hand over a one-time code, which turns the victim’s own device into the access path.
Q: What should teams do first when remote-access software is offered at an event?
A: Verify the request through an out-of-band channel, then refuse any installer or remote-access prompt unless it comes from a known internal support contact and an approved ticket.
Practitioner guidance
- Verify any software request through a separate channel Confirm the organiser, speaker, or support team through an independent contact path before installing anything on a conference device.
- Treat live crypto sessions as high-risk assets Assume any device with open wallets, exchange tabs, or password manager sessions can be abused instantly if remote control is granted.
- Quarantine any device that accepted remote access Move funds, revoke sessions, and change credentials from a clean device before using the affected machine again.
Bottom line: The allegation shows how a security-themed event can still function as a social-engineering vector when attendees are asked to install software.
Glossary terms: Remote Access Trojan, Browser Wallet, Social Engineering, Session Hijacking
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Event branding can become a trust primitive. A security-themed setting reduces suspicion, which means attackers can ask for actions that would be rejected in an ordinary scam. In this case, the alleged request to install software relied on the event's own credibility to lower resistance. The practitioner lesson is that legitimacy cues are now part of the attack surface.
A question worth separating out:
Q: What is the best way to review wallet tools without exposing a device?
A: Use a clean, isolated test device or a remote browser environment with no existing wallet extension, saved secrets or active accounts. A separate inspection profile, disposable virtual machine or read-only sandbox lets teams examine wallet setup, permissions and transaction flow without risking the main device’s seed phrase, private keys or signed-in session.
👉 Read our full editorial: Crypto event attendees allegedly urged to install remote access software