Oddbean new post about | logout
 It stores them temporarily, and could exfiltrate them to the mempool or blockchain when used. 
 Same with passphrases? 
 In principle, yes. If you can exfiltrate any sequence of bits (eg a seed phrase), you can exfiltrate whatever you want (eg a BIP39 passphrase). But it may be impractical, and I don't know if there are actual exploits.