EB1

EB1 needed real financial rails rather than a wrapper over someone else's dashboard: its own wallets, its own cards, its own verification, and an operations layer non-engineers could run day to day.

Consumer-grade mobile experience with bank-grade controls — verification, device trust, card lifecycle, a token economy and an operations platform — with no existing team to divide the work between.

• React Native / Expo client for iOS and Android over a shared domain model.
• NestJS API on PostgreSQL as the single source of truth.
• Semi-custodial wallet design, with custody boundaries made explicit in the product rather than hidden.
• Three separate operator interfaces — dashboard, manager and CMS — over the same model with role-based access control.
• Provider integrations isolated behind internal service boundaries: KYC, card issuance, notifications, email.

• Production backend: JWT authentication with 2FA, device fingerprinting, biometric integration, Sumsub KYC, card issuance, Expo push notifications and email, with comprehensive rate limiting and security controls.
• Native mobile app: real-time multi-asset crypto and fiat wallet management, digital card operations (freeze/unfreeze, top-up, withdrawal), live document KYC, passkey authentication and deep linking — released to both app stores.
• Solidity contracts: ERC-20, multi-stage presale with EIP-712 signatures, Chainlink ETH/USD feeds, two-sided referrals and staking — hardened for third-party audit with slippage and MEV protection, stablecoin depeg circuit breakers and exact-accounting refunds.
• Presale dashboard in Next.js with Wagmi/Viem and SIWE.
• Concierge request lifecycle across mobile, API and three admin interfaces: dynamic form builders, status workflows, agent assignment, invoicing, broadcasts, invitation codes and RBAC.
• Platform-wide security remediation closing cross-user card and transaction access paths.

• Closing cross-user access paths on live card and transaction data without disrupting customers already using the product.
• Writing contracts that would survive a third-party audit — depeg circuit breakers and exact-accounting refunds are cheap to specify and expensive to retrofit.
• Keeping authentication strict without making onboarding hostile.
• Owning six systems at once and keeping the seams between them honest.

A crypto-backed card and wallet product live on iOS and Android, with the backend, contracts, token economy and three operator platforms running behind it — and a hardened security posture after a platform-wide remediation.