Sort:  

getting the account based on a private key.

That's a very interesting way of doing it. So if you lose your private KEY, your Attacker just has your account as well at the same time.

I believe so