They can't steal your money having only one key.

All they can is only steal money which are on active order. When transaction is signed with your key.