However, even full access to the computer means that you cannot empty all crypto wallets just like that, unless they are not protected by a password at all, or the attacker knows which wallets the user has and prompts him to open them and thus find out the password.
He’s actually been studied, a lot of infos is probably in their hands before performing the attack.. The attack will also be done at once to prevent early notice which might disrupt their plan.
Gaining access to to a victims computers gives almost equal access as the user.. all they need it to wait while they monitor his activities and also perform more social engineering tactics to get what they needed since they already have a trusted way(to the victim) of doing that..
Losing such amount is a pain