Is this script able to steal keys from their hardware wallet when they use it or are we assuming they are using a hot wallet?