- Encrypted keys. Each trading wallet key is encrypted with AES-256-GCM under a master key that lives only on the trading server, readable only by the system. Keys are never sent to your browser unless you export them.
- Telegram confirmation. Withdrawals and key exports need a tap in Telegram. A stolen browser session cannot move your SOL or see your key.
- One-time login links. Links work once and expire in 2 minutes. Sessions are stored in a secure, HTTP-only cookie.
- Separate wallets. Copies use only the trading wallet balance. Your main wallet is never connected.
Important. Trading wallets are held by FOMAFIA so that copies can be signed without you. Treat them like an exchange account: keep only what you trade, and withdraw profits regularly.