Projects

The challenge

PokéVault wanted to bring the offline TCG community online without losing the dopamine hit of opening a booster pack — and without becoming a target for card fraud, fake grades or bot scalpers. They needed pack-opening animations that felt as good as cardboard, a marketplace where graded cards could be trusted, and a trading flow where two strangers could safely swap without anyone getting cheated.

Our solution

We built a real-time platform where every booster pack is opened on a server-authoritative RNG with a signed, auditable seed (no client-side rigging possible). The marketplace integrates PSA/BGS grading APIs and locks cards into our bonded vault until both sides confirm. Trades use an escrow contract: both users commit cards, both confirm, both receive — atomic, no half-trades. Stripe Connect handles payouts; Cloudflare bot-protection plus device fingerprinting keep scalpers out.

The outcome

Platform launched with 12,000 day-one users and crossed HKD 50M GMV within four months. Pack-opening retention beat the team's offline benchmarks; trade dispute rate sits below 0.3%.

The challenge

Professional HK racing bettors spend hours every race day stitching together fragmented data — past performances, jockey/trainer combinations, track conditions, live-odds movements and whispered stable intel. None of it lived in one place, the smart-money flow was invisible to retail bettors, and stable-side information stayed locked in WhatsApp groups. Stable Edge wanted a single platform that surfaced everything in real time.

Our solution

We ingested 30 years of HKJC race results, sectional times, jockey/trainer/horse records and barrier-trial data into a feature store. A gradient-boosted prediction model retrains nightly and outputs win/place probabilities per horse with calibrated confidence intervals. Live odds stream in via WebSocket every 5 seconds; a smart-money (熱錢投注) detector flags abnormal money flow within seconds of it hitting the tote. A private channel ingests stable-side bet signals from a vetted network of jockeys and trainers — encrypted, deniable, and integrated as a separate confidence layer the bettor can toggle on or off.

The outcome

Subscribers report a 41% improvement in ROI versus betting blind on form-guide picks. The smart-money signal alone detects roughly 70% of significant late odds moves more than 60 seconds before they show up on the tote board.

The challenge

Velocity needed to win two different races. (1) On Cityline, Urbtix and HK Ticketing, premium concerts sell out in 15–30 seconds — the only way to acquire bulk inventory for their B2B reseller clients was to out-execute every other automated and manual buyer. (2) On Polymarket, asymmetric information shows up briefly as mispriced contracts — they needed an execution layer that could detect a must-win signal and submit an on-chain order in under 100 ms. Both problems demanded extreme latency engineering and infrastructure that could survive being adversarial-tested by every other serious player on the platform.

Our solution

For ticketing: a Rust + Playwright pipeline running on a fleet of geographically distributed residential proxies, each with a unique browser fingerprint and warmed-up account history. Sessions are pre-warmed on every platform so checkout begins the instant the queue opens; CAPTCHA solving falls through a hybrid model + human-in-the-loop pipeline; a distributed lock prevents two workers from contending for the same seat. For Polymarket: a Rust WebSocket listener streams the order book and our signal aggregator combines multiple alpha sources (news scrape, on-chain wallet tracking, custom prediction models). Execution runs on Polygon with EIP-1559 priority gas, and we co-locate the executor in the same region as Polymarket's matching layer. End-to-end latency from signal to submitted tx: ~80 ms.

The outcome

Velocity's premium-concert acquisition rate jumped from ~12% (manual purchasing) to ~78% (automated). On Polymarket, the bot's edge-capture rate on high-confidence signals improved 4× versus their previous manual desk, with ROI exceeding 31% across a six-month live period.

The challenge

Atlas wanted to ship four distinct AI products on a single shared backbone: an autonomous traveling-VTuber posting daily content across Instagram, Facebook, Threads and OnlyFans; a Pokémon TCG market-intel agent that gathers daily price moves and drafts marketing posts; and a WhatsApp chatbot offering fortune-telling (算命), horoscopes (星座) and trip planning — without standing up four separate AI stacks or four separate ops teams. They also needed a self-hosted option for clients with strict data-residency requirements.

Our solution

We built a Hermes-based agent orchestrator (with OpenClaw for browser-level automation) that routes every task to either frontier APIs (Claude / GPT) or a self-hosted Gemma instance, based on per-customer policy. The traveling-VTuber agent generates persona-locked images, captions and short videos, then cross-posts on schedule to Instagram, Facebook, Threads and OnlyFans. The Pokémon market agent ingests pricing from PSA, eBay and TCGplayer, ranks daily movers, drafts marketing posts and queues them for one-click human approval. The WhatsApp chatbot is a persona-locked Hermes agent with three skill modules (fortune / horoscope / travel planner) and per-user long-term memory backed by pgvector.

The outcome

Atlas now operates four agent products with two engineers. The VTuber content engine cut creator workload by 85% per week, the Pokémon market bot grew the marketing newsletter 4× in three months, and the WhatsApp persona handles 8,000+ daily conversations at a unit cost below HKD 0.04 per message.

The challenge

Meridian's portfolio managers were being front-run repeatedly on-chain, losing 2–4 bps per trade in MEV — at their volume, more than USD 2M a year. They needed institutional-grade execution: aggregated liquidity, real MEV protection, and a UI that didn't require the desk to think about which chain anything lived on. Off-the-shelf wallets and public aggregators didn't meet any of those requirements.

Our solution

We built a custom router that simulates routes across 1inch, 0x, Paraswap, Kyber and CoW, then selects based on net-of-MEV price (including private-mempool routing via Flashbots Protect and CoW Swap). Cross-chain swaps use intent-based execution on Across and LiFi. Smart contracts independently audited; the desk's keys live in MPC across three geographically separated HSMs. The whole thing is wrapped in a portfolio-manager UI that shows a single token-pair input, regardless of the actual underlying chain.

The outcome

Meridian's average execution slippage dropped 78%; MEV losses fell to near zero on the private-mempool path. The desk now routes ~80% of daily flow through the in-house aggregator versus external venues.

The challenge

PayFlow had been pitching for nine months with a deck that buried the real story (B2B SME card-acquiring with embedded credit) under generic 'payments' language. Their financial model didn't survive the first 20 minutes of any due-diligence call. With 7 months of runway left, they needed a reset of the narrative, a model that would survive scrutiny, and warm intros to the right investors — fast.

Our solution

We started with a two-week positioning sprint, rewriting the company story around the SME card-acquiring wedge with explicit unit economics and a clear path to embedded-credit. We rebuilt the financial model from cohort revenue up, with sensitivity analysis on take-rate, churn and CAC payback. We set up an investor-grade data room on DocSend with view-tracking, prepared the founders for partner meetings with mock pitches, and drew on our banking network to make warm introductions to 18 funds — including the eventual lead.

The outcome

Lead term sheet from a tier-1 APAC growth fund in week 11. Closed USD 12M (plus a USD 2M strategic from a payments incumbent) at week 14, at a valuation 2.4× the founders' pre-engagement expectations.

The challenge

The insurer's CISO knew the customer portal was a high-value target — credentials, claims data, beneficiary details — but the last pentest was 18 months old and the new portal had shipped four releases since. The CISO wanted a no-warning red-team engagement to validate the security posture before regulators did it for them.

Our solution

A five-week black-box engagement with three lead testers. We chained an obscure type-confusion in the legacy SOAP layer with an unsanitised parameter in the new GraphQL gateway to reach internal admin endpoints, then pivoted to remote code execution on a misconfigured worker pod — all within rules of engagement. Findings were delivered weekly so the security team could begin fixing in parallel; the final report included an executive summary for the board and a remediation playbook keyed to the dev team's sprint cadence.

The outcome

Critical chain fixed within 72 hours of disclosure. 16 of 19 findings remediated before the final report. The insurer passed a follow-up HKMA cyber assessment the following quarter with zero high-severity findings.