Exactly how the money leaves — and what to check in any wallet
Under each way: what happens, a real incident, a one-minute check, and an honest answer for Mitilena. “How we do it” blocks are checked against the app code. Not “trust us”: you can run the web build through a local proxy and see all traffic decrypted.
The key is born elsewhere
The wallet generates the key on a server or sends it there right after creation — as a “cloud backup” or “restore by phone number”. From that moment you are not the only one who can spend your coins.
The key is random — but predictable
A key is a very large random number. If the RNG is weak, there are few real keys, and attackers brute-force every customer at once — sometimes years later. A hardware wallet does not save you: the generator sits there too.
The key leaks through logs and analytics
Nobody meant to steal. A crash report or analytics event captured the whole screen — seed phrase included. Logs sit at a third-party service, open to dozens of people and anyone who hacks that service.
You see one thing, you sign another
On screen: a transfer to mom. In the signature: a transfer to a thief or a contract owner change. A clipboard trojan, a browser extension, or a hacked UI swaps it. The signature is real — yours — and the network will accept it.
You are not signing a transfer — you are signing an approval
A site asks you to “connect the wallet and confirm”. You sign an unlimited approve or a Permit — and a foreign contract can pull your tokens whenever it wants: a day later or a month later.
An update with a backdoor
The wallet is honest; the library or build is not: a hacked developer account, a swapped dependency, foreign code on the build machine. The next update lifts keys from everyone at once — and all you did was tap Update.
A fake posing as the wallet
A store clone with the same name and icon, a lookalike site, ads above the real one, an “update” in Telegram. Inside: a form that says “enter your seed to restore”. Whatever you type goes straight to the thief.
Custodial dressed as non-custodial
The UI looks like a wallet, but you have no key: coins sit on the company’s account and you are a row in its database. The company can freeze, ask for documents, go bankrupt, or vanish. That is a different product — and they should say so outright.
The key sits on the device in the clear
The wallet saves the key “for convenience” — in an unencrypted file, an iCloud or Google backup, a screenshot. After that you do not need to break cryptography — just access to the backup or five minutes with the phone.
The key leaks through the signature itself
The quietest way. An ECDSA signature carries a random number, and a tweaked library can hide pieces of your key inside two or three ordinary signatures. Everything works; whoever reads the chain reassembles the key.
Quiet skim on the swap
The wallet is not “stealing” — it is “earning”: the swap runs through its own wrapper contract, a markup is baked into the rate, slippage is set so you do not notice. The money still leaves quietly.
They ask for the seed from inside
“Support” in the wallet chat, a popup “confirm your recovery phrase”, an email “security update”. The wallet may be real; the window is not: an extension, a page overlaid, mail to a leaked customer list.
Check your wallet in five minutes
Twelve questions. The more “yes” answers, the calmer you can be. Save it and run any wallet through it — including ours.
What a wallet will not stop
Stolen key does not mean stolen at oncefirst of all
The wallet may have been compromised a year ago; the money leaves the day you deposit a large amount — and you will not remember what you installed where. So from time to time open a new wallet, move funds to a fresh key — especially before a large top-up — and keep the app updated.
A virus on your device
A keylogger, a clipboard trojan, “remote access” for support. Signing happens where you start it: on an infected phone there is no safe wallet. For large amounts — an NFC card or signing on a device with no internet.
Seed in the open
A photo in the gallery, a note in the cloud, a sticker on the monitor. The wallet stores the key correctly — you gave the copy away yourself.
You signed it yourself
A scam project, a “manager with guaranteed yield”, “confirm the withdrawal”. The wallet will show what you sign — the decision stays yours.
A public blockchain
Addresses, amounts, and transfer times are visible to everyone forever. Privacy comes from care with addresses or networks like Monero — not from the wallet.
Do not trust “open source” blindly
A public repository does not save you: one inject at release is enough. A real check is your own traffic on a stand with a local proxy where everything is decrypted. That is how we invite you to inspect Mitilena: the key does not leave in the exchange — you see it with your eyes, not “because GitHub is green”.
When software is not enough — take a dumb carrier and air-gap
Not a “magic chip from the factory”. A Mitilena NFC card is just memory for a key you encrypt yourself. The ultimate kit adds generation and signing on a device with no internet: the key has nowhere to leak over the network. Cards arrive blank — courier and warehouse are out of the equation.
A virus on your device
Sign on a separate phone with no SIM and no internet: the transaction goes there by QR and returns signed; the key never sits on a networked device. Simpler tier — a card on your main phone: the key appears in an isolated environment for the second of signing and is wiped.
Seed in the open and screenshots
There is no seed: the key is born in Mitilena Air offline and written to the card encrypted. Nothing to photograph; a found card or sticker without the password is useless plastic.
Lost, soaked, burned
Five mirror copies in the box: two NFC cards and three stealth stickers in waterproof plastic for 10+ years. One is gone — the rest still work.
A scam you confirmed yourself
No carrier replaces your eyes: amount and address on screen are yours. Offline signing gives an extra second to check the transfer on a separate device, but it does not think for the button. A public chain does not hide either — that is what Monero and address hygiene are for.
What people ask after reading this far
A hardware wallet with a “secure chip” — that is cold, right?
Often no. A secure element is a mini-computer with closed code: it creates keys and signs by itself, and what sits in the silicon is invisible. Coldcard already showed it: a weak RNG in firmware, keys brute-forced without device access. Ledger has spoken openly about access on a police request. Real cold is when the carrier is dumb and you encrypt and sign. That is how Mitilena NFC cards work: empty memory for your ciphertext, not someone else’s microcomputer.
How do I know the wallet has my key?
Directly — you cannot: traffic is encrypted. Indirectly — airplane mode at creation, key export, work without a server, named libraries, no trackers. If the wallet “restores” a key by email or phone number — it definitely has the key.
What if I signed an approval for a scammer?
Revoke it immediately (revoke.cash or your network’s equivalent) and move tokens to a new address. The approval stays until revoked, even if the site is gone.
How do I check that the key does not go to the server?
Not via “open our GitHub”. Via a stand: a local proxy decrypts all app traffic — inspect the packets yourself. If the key is not in the exchange, you see it. Guide: mitelena.com/our-code-is-open-for-verification.