The short answer is that PAKE is single-use, so the attacker only gets one guess (and their attempt prevents the legitimate peer from trying either). Each time they consume someone else's transfer attempt, they get a 1-in-65k chance of succeeding, and a 65535-in-65536 chance of alerting the peer that they failed.

For the attacker to have a 50/50 chance of successfully stealing your file transfer, you'd have to (on average) re-run the `wormhole send` program over 30000 times. I don't know about you, but I'm not that patient, and I'd give up long before they had a significant chance of success :).

This is covered in their docs, along with mitigation.

https://magic-wormhole.readthedocs.io/en/latest/attacks.html