I'm using this type of partition for the last 5-6 years or more. The only way I see here is that somehow there's some sort of malware on my iMac or some clipboard copier or whatever but I can't figure out how to check that
Several years ago, there was a virus called ElectroRAT. If you say that you have been using a server on a virtual machine for several years, could a similar virus somehow hide in your system and wait for the right moment to connect to your crypto wallet? It’s just that all your actions show that you are careful when using the computer, but if there was remote access, your actions could be monitored by virus software.
https://intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/