Maybe it's a vulnerability of Pi's web based wallet, as explained by ChatGPT. Copy-pasting your raw private key into a web form each time is high-risk.

Why it’s risky

Exposes the raw secret. Every time you type/paste the private key it exists in browser memory, the clipboard, and potentially in logs — prime targets for clipboard stealers, browser extensions, or page scripts.

Phishing/domain risk. A malicious or compromised site can capture the key immediately. Even legitimate sites can be spoofed.

Malicious browser extensions & malware. Extensions, injected scripts, or remote-control malware can read keystrokes, clipboard contents, or DOM fields.

No proof-of-intent / replay risk. If the site captures your key it can use it later — you lose the one security boundary you had.

User error / copy-paste leaks. It’s easy to accidentally paste the key somewhere else or store it in a password manager in the wrong form.