lock down your openclaw's bankr wallet with allowed IP addresses. don't give your agent a private key. make it impossible for it to fumble the bag.