The leaf nodes are constructed so that they can only be extended by digitally signing them. Anyone with the right signing key may extend a leaf, ``spending'' the money. When you send money to someone, you create a new leaf node which can only be spent by signing with one of their keys.