keylogger on his computer, they got just about everything he had.
Keyloggers by themselves isn't enough to steal coins unless you use a 3rd party website to hold them.
A keylogger basically records keystrokes and emails them to someone. A RAT would be more likely if it was taken from a wallet on your computer.
If it was a keylogger then you can decompile it and find out where it was sending your key strokes to. Most likely it will be to an email which is another step closer to whoever did it.
A RAT is a remote access tool. Someone gets you to download a program and then you run it. Everything looks fine but lo and behold theres a new process running that you don't recognize or even notice that is giving complete access to your computer to someone else.
They can download anything to or from your computer, access any files, hell they can even turn on your webcam if you have one and watch you yank the snake to pics of lizard people.
Basically it is teamviewer with perks and not being seen.
There are tools out there to decompile programs, some free and some cost money.