Auxerion Capital Investigation: Alan Skye, Tiffany Robbinson and Aurexion Capital
This case deserves particular attention because it involves more than a suspicious investment website. The official Washington State Department of Financial Institutions (DFI) warning describes remote computer access, unauthorized financial transactions, cryptocurrency transfers through OKX, and a reported loss of approximately $300,000.
Published on June 3, 2026, the warning identifies Auxerion Capital, Alan Skye, Tiffany Robbinson and a potentially related entity called Aurexion Capital. It also raises the possibility of a remote access Trojan, although malware infection was not conclusively established.
Department of Financial Institutions
The strongest angle for Cyb3rsect is to combine the investment fraud warning with a clear explanation of computer compromise and digital forensic evidence.
Ready-to-publish article
Auxerion Capital Scam Investigation: Alan Skye, Tiffany Robbinson, Aurexion Capital and $300,000 Investor Warning
Auxerion Capital, a purported private investment firm, has been named in an official investor warning published by the Washington State Department of Financial Institutions (DFI).
The warning, dated June 3, 2026, describes a Washington investor who reportedly lost approximately $300,000 after individuals claiming to represent Auxerion gained remote access to the investor’s computer and transferred money from financial accounts into cryptocurrency.
The individuals identified in the complaint used the names Alan Skye and Tiffany Robbinson. Another person, identified as Bryci Andres, reportedly introduced the investor to the investment opportunity.
Washington DFI also identified a possible connection to another name, Aurexion Capital.
Unlike investment complaints that primarily involve misleading trading dashboards or withdrawal fees, this case describes potential unauthorized control of a computer.
The regulator reports that the individuals instructed the investor to download AnyDesk, a legitimate remote desktop application. However, the complaint also raised concerns that a remote access Trojan may have been involved.
Funds were reportedly transferred to the OKX cryptocurrency platform, converted into digital assets, and withdrawn to multiple cryptocurrency wallet addresses.
Washington DFI has not independently verified the allegations or reported loss.
Nevertheless, the case illustrates serious risks involving investment impersonation, remote access, financial account compromise, and cryptocurrency transfers.
This Cyb3rsect report examines the regulatory warning, the reported sequence of events, and the digital evidence that may help affected investors understand what happened.
What Is Auxerion Capital?
Auxerion Capital was presented to the investor as a private investment firm.
According to Washington DFI, the investor was not provided with an official website for Auxerion.
This is an important detail because a financial business should ordinarily be able to provide verifiable information about its legal identity, professional representatives, and applicable regulatory authorizations.
Without a confirmed website or independently verified company identity, investors may struggle to determine whether the organization exists as described.
The complaint also mentions Aurexion Capital, which may be associated with Auxerion.
However, the regulator does not conclusively establish the corporate relationship between the two names.
It would therefore be inaccurate to assume they are the same registered legal entity without further evidence.
Washington DFI’s Official Auxerion Capital Warning
On June 3, 2026, Washington DFI’s Securities Division published an alert titled Alleged private investment firm Auxerion Capital may be fraudulent.
The warning identifies four subjects:
- Auxerion Capital
- Alan Skye
- Tiffany Robbinson
- Aurexion Capital
The regulator recorded a reported financial loss of approximately $300,000.
It categorized the complaint under cryptocurrency scams, romance scams, and pig-butchering scams.
These categories provide context for the suspected activity.
However, the published account does not establish every element of a romantic relationship or identify the true identities of the individuals involved.
The most distinctive feature of the complaint is the reported use of remote computer access to move funds from financial accounts into cryptocurrency.
How the Investor Was Introduced to Auxerion Capital
According to Washington DFI, the investor learned about the purported investment opportunity through an online acquaintance using the name Bryci Andres.
Andres introduced the investor to individuals associated with Auxerion Capital.
These individuals were identified as Tiffany Robbinson and Alan Skye.
The warning does not provide a detailed account of how the investor first met Andres or how long the relationship continued.
Nevertheless, the introduction is relevant because the investor was directed toward people claiming to possess investment expertise.
An introduction from someone familiar can make an unfamiliar financial opportunity appear more credible.
For an investigation, the original conversations with the introducer may help establish when the opportunity was first presented and which claims were made.
Who Are Alan Skye and Tiffany Robbinson?
Alan Skye and Tiffany Robbinson are the names associated with individuals described in the Washington DFI complaint.
Skye reportedly presented himself as an investment adviser with Auxerion Capital.
The regulator identifies the following email address used by Skye:
Tiffany Robbinson was also identified as a person associated with the purported investment firm.
The public warning does not independently verify either person’s legal identity, qualifications, or professional licensing.
These names should therefore be treated as identifiers used in the reported solicitation.
It would be inappropriate to accuse unrelated individuals who happen to share the same names.
The relevant evidence consists of the actual email accounts, messages, telephone numbers, and other contact information used in the investor’s case.
The Aurexion Capital Domain Discrepancy
The regulator identified an important inconsistency involving the domain associated with Alan Skye’s email address.
Skye reportedly used:
aurexion-capital.com
However, Washington DFI stated that this domain did not appear to be registered when it conducted its review.
The regulator also identified a separate domain:
aurexioncapital.com
DFI noted that the second website might be involved and potentially fraudulent.
These domains are not identical.
The difference matters because domain names can be used to create the appearance of a connection between businesses or individuals.
An email address resembling a company name does not independently establish that the sender represents a legitimate organization.
A domain investigation may examine historical registration records, email headers, website archives, and other technical evidence.
However, the public warning does not conclusively establish that both domains were controlled by the same operator.
How the Remote Access Incident Reportedly Began
According to Washington DFI, individuals claiming to work for Auxerion instructed the investor to download AnyDesk.
AnyDesk is legitimate remote desktop software used for technical support, administration, and remote collaboration.
The application itself is not inherently malicious.
The risk arises when an untrusted person persuades a user to grant remote access to a computer containing sensitive information or financial accounts.
Once access is granted, a remote operator may be able to interact with applications and websites according to the permissions available.
In the reported Auxerion case, the individuals allegedly gained access to the investor’s computer and began conducting financial transactions.
Some transactions reportedly occurred without the investor’s knowledge.
This makes the incident significantly different from a conventional investment complaint involving only voluntary deposits.
What Happened to the Investor’s Financial Accounts?
Washington DFI reports that the individuals claiming to represent Auxerion began withdrawing money from the investor’s financial accounts.
The funds were transferred to OKX.
Once there, they were reportedly converted into cryptocurrency and withdrawn from the platform to various wallet addresses.
The regulator states that the transactions were conducted remotely by the individuals involved.
Some were allegedly performed without the investor’s knowledge.
This sequence raises several investigative questions.
Which accounts were accessed?
Were the transfers authorized by the account holder?
What software or remote access methods were used?
Which cryptocurrency assets were purchased?
What receiving addresses were used when the assets left OKX?
These questions cannot be answered conclusively from the public warning alone.
A case-specific investigation would require original account records, device evidence, and transaction histories.
What Is OKX, and What Was Its Role?
OKX is a cryptocurrency trading platform.
In the complaint, OKX was reportedly used as an intermediary through which money was converted into cryptocurrency before being transferred to external wallets.
This does not establish that OKX operated Auxerion Capital or participated in the alleged wrongdoing.
A legitimate financial or cryptocurrency service can be used in a transaction initiated by someone engaging in fraud.
The important issue is whether the account activity was authorized and where the funds moved after conversion.
Relevant evidence may include account statements, deposit records, trade confirmations, withdrawal records, transaction hashes, and destination wallet addresses.
The public DFI warning does not identify the particular wallets receiving the cryptocurrency.
It also does not state that OKX has been accused of misconduct in this complaint.
Why the Possible Remote Access Trojan Matters
The regulator’s warning includes an additional technical concern.
Although the investor was instructed to download AnyDesk, Washington DFI stated that the individuals may have accessed the computer using a remote access Trojan rather than relying solely on AnyDesk.
A remote access Trojan, commonly called a RAT, is malicious software designed to provide unauthorized access to a device.
Depending on its capabilities, such malware may allow an attacker to control applications, observe user activity, access files, or interfere with security settings.
However, DFI did not conclusively establish that a RAT was installed on the investor’s computer.
The warning describes the possibility based on the circumstances reported.
A forensic examination would be necessary to determine whether malicious software was present and what actions it performed.
The Disabled Computer Settings
Washington DFI reports that numerous settings on the investor’s computer had been disabled.
These reportedly included the ability to turn off the Wi-Fi connection.
That detail is particularly concerning because an inability to disconnect a computer from the network may complicate efforts to stop unauthorized remote access.
However, altered system settings do not by themselves prove that a particular malware family was installed.
Such changes can result from different causes, including software configuration, administrative restrictions, or malicious activity.
An investigator would need to examine the operating system, installed applications, security logs, and other available evidence.
The goal is to determine whether unauthorized access occurred and identify the most likely mechanism without assuming a conclusion in advance.
Why Remote Access Investment Scams Are Dangerous
Remote access can turn a misleading investment solicitation into a direct account-security incident.
An investor may believe that an adviser is helping configure a trading platform or complete a legitimate financial transaction.
But if the adviser gains control of the computer, the person may be able to access banking sessions, cryptocurrency exchanges, saved credentials, and other sensitive applications.
The level of risk depends on the permissions granted and the security controls in place.
In the Auxerion complaint, the reported activity extended beyond investment advice.
The individuals allegedly performed financial transfers using the investor’s computer.
That is why preserving digital evidence and securing the device are especially important in this case.
The Reported $300,000 Loss
Washington DFI records a reported loss of approximately $300,000.
The public alert does not provide a complete transaction-by-transaction breakdown of that amount.
It does not identify the precise dates, bank account numbers, cryptocurrency assets, or receiving wallet addresses involved.
Therefore, it would be inaccurate to claim that the regulator has already traced the entire amount to a particular wallet or individual.
An independent financial reconstruction would begin with the investor’s actual bank and cryptocurrency account records.
Each transfer should be documented with its date, amount, beneficiary, asset, and destination.
The reported loss should be distinguished from any unverified claims about profits, account balances, or amounts that might be recoverable.
Is Auxerion Capital Legitimate or a Scam?
The available regulatory information raises serious concerns.
Washington DFI has issued an official warning identifying Auxerion Capital, Alan Skye, Tiffany Robbinson, and Aurexion Capital.
The complaint describes a purported investment firm whose representatives allegedly gained remote access to an investor’s computer and transferred money from financial accounts through a cryptocurrency platform.
The regulator also identified possible unauthorized software access and changes to device settings.
These are significant warning signs.
However, Washington DFI has not independently verified the complaint allegations or reported financial loss.
The evidence-based conclusion is that Auxerion Capital is the subject of a documented regulatory warning involving suspected cryptocurrency investment fraud and possible computer compromise.
The warning does not establish a final criminal conviction against any named individual.
What Evidence Should Auxerion Investors Preserve?
Anyone who interacted with Auxerion Capital or a potentially related Aurexion Capital operation should preserve relevant evidence.
Important materials include:
- Conversations with the person using the name Bryci Andres
- Communications with Alan Skye and Tiffany Robbinson
- Emails from alanskye@aurexion-capital.com
- Complete email headers where available
- Any links to aurexion-capital.com or aurexioncapital.com
- Investment proposals and account instructions
- AnyDesk installation details and session information, if available
- Records of other remote access applications
- Computer security alerts and unusual configuration changes
- Bank statements showing disputed transfers
- OKX account statements and trade confirmations
- Cryptocurrency withdrawal records
- Receiving wallet addresses and transaction hashes
- Correspondence with banks and cryptocurrency exchanges
Where possible, original records should be preserved rather than replaced with screenshots alone.
If malware is suspected, professional forensic assistance may be appropriate before the device is reset or wiped.
What to Do If Someone Still Has Remote Access
If an investor believes an unauthorized person still has access to a computer, immediate account and device security should take priority.
Disconnect the affected computer from the internet where safely possible.
If ordinary Wi-Fi controls are unavailable, disconnect the network cable or disable the relevant network connection through another trusted method.
Use a separate, trusted device to change passwords for important accounts.
Prioritize email, banking, cryptocurrency exchange accounts, and password managers.
Review multifactor authentication settings and active account sessions.
Contact financial institutions promptly to report suspected unauthorized transactions and request appropriate protective measures.
Do not use the potentially compromised computer to enter new passwords or recovery information.
Preserve available evidence before reinstalling the operating system or deleting software, unless immediate security needs make that impractical.
How Digital Forensics Can Help Investigate Remote Access
A digital forensic examination may help determine whether unauthorized remote access occurred.
Depending on the available evidence, investigators may review installed applications, system logs, remote access configuration, user accounts, browser activity, and security events.
They may also examine evidence of persistence mechanisms, unusual processes, or changes to network settings.
However, not every remote access incident leaves complete or recoverable logs.
The absence of one type of evidence does not automatically establish that no compromise occurred.
An investigation should distinguish confirmed findings from possibilities.
In the Auxerion case, the regulator’s suggestion that a RAT may have been involved should be treated as a hypothesis requiring technical verification.
Can Cryptocurrency Transferred Through OKX Be Traced?
If cryptocurrency was withdrawn from OKX to public blockchain addresses, transaction records may provide investigative leads.
An analysis could begin with the exchange’s withdrawal confirmations, including the cryptocurrency asset, blockchain network, transaction hash, and destination address.
Subsequent blockchain activity may then be examined where the relevant records are public.
However, blockchain addresses do not automatically identify their controllers.
Some movements may involve custodial services that maintain additional records outside the public blockchain.
The DFI warning does not publish the destination wallet addresses associated with this complaint.
It would therefore be misleading to claim that the reported $300,000 has already been traced to a specific individual or exchange account.
Tracing cryptocurrency does not guarantee recovery.
Reporting Suspected Auxerion Investment Fraud
Anyone who believes they experienced similar activity should report the incident to the relevant financial institutions and authorities.
Banks should be informed promptly about potentially unauthorized transfers.
Cryptocurrency exchanges should receive the relevant transaction details and account information.
U.S. investors can report internet-enabled financial fraud to the FBI’s Internet Crime Complaint Center.
Washington residents may also submit complaints to Washington DFI.
If unauthorized computer access occurred, the incident should be documented as both a financial matter and a potential cybersecurity compromise.
Victims should also be cautious of recovery services promising guaranteed results in exchange for upfront payments.
How Cyb3rsect Can Assist With an Auxerion Investigation
Cyb3rsect provides digital-investigation, computer-forensics, and blockchain-forensics services relevant to suspected investment fraud involving unauthorized device access.
For an Auxerion-related case, an evidence review may begin with the investor’s communications, computer activity, bank transfers, and cryptocurrency account records.
A computer forensic examination may help assess whether remote access software or malware was present.
Financial records can help reconstruct the movement of funds from bank accounts to cryptocurrency platforms.
Where transaction hashes are available, relevant blockchain activity may be examined for additional investigative leads.
The objective is to distinguish independently verifiable transactions and device activity from unsubstantiated claims about the individuals involved.
Any investigation should clearly explain the limits of the evidence and avoid guarantees of financial recovery.
Contact Cyb3rsect About Auxerion Capital
If you encountered Auxerion Capital, Aurexion Capital, or individuals using the names Alan Skye, Tiffany Robbinson, or Bryci Andres, preserve your original communications and financial records.
If remote access was involved, secure your accounts using a trusted device and preserve the affected computer where appropriate.
Cyb3rsect can assess the available digital evidence and determine whether further investigation may be suitable.
Useful starting information includes emails, remote access details, bank transfer records, OKX withdrawal confirmations, and cryptocurrency transaction hashes.
Never provide passwords, private keys, or wallet recovery phrases.
Contact Cyb3rsect to discuss an evidence-based review of a suspected investment fraud and computer compromise incident.
Final Assessment
The June 3, 2026 Washington DFI warning describes a serious investor complaint involving Auxerion Capital and a potentially related name, Aurexion Capital.
The investor reportedly encountered the opportunity through Bryci Andres and was introduced to individuals using the names Alan Skye and Tiffany Robbinson.
The complaint describes remote access to the investor’s computer, transfers from financial accounts to OKX, conversion into cryptocurrency, and withdrawals to external wallet addresses.
The regulator also raised the possibility that a remote access Trojan was involved.
The investor reported losing approximately $300,000.
Washington DFI has not independently verified the allegations or loss.
Nevertheless, the case illustrates how an investment solicitation can develop into a potential cybersecurity incident involving unauthorized computer access and financial transfers.
For affected investors, immediate account security, preservation of device evidence, and careful reconstruction of financial transactions are essential.
Official Source
https://dfi.wa.gov/alerts/alleged-private-investment-firm-auxerion-capital-may-be-fraudulent
Editorial notice: This article summarizes a public regulatory complaint. It does not claim that Cyb3rsect independently verified the reported loss, identified the individuals using the named identities, confirmed the presence of a remote access Trojan, or traced the cryptocurrency transfers described in the warning.
