OneKey's Wang Yishi on Premature Optimization and Why AI Now Arms Both Sides
Wang Yishi bought his first Bitcoin on Taobao in 2013 as a college junior. He went on to work as a product manager at ByteDance and co-found Bixin before launching hardware wallet OneKey in 2020.He joined Binance Square's "Blockchain 100" to discuss that trajectory and what he has learned about product, security and where the industry is heading.The Order Matters More Than the PolishAsked about the costliest mistakes in product development, Wang points to one: over-designing and over-optimizing.The correct sequence, in his view, is to prioritise growth, get users using the product, and make it usable before gradually optimising. "This order is very important and useful," he says.He offered a ByteDance product as the counterexample — one that relied on Q&A for user acquisition and was eventually shut down over poor data despite rigorous A/B testing and data-driven decisions.The lesson he draws from it is counterintuitive. Too many resources and too rapid growth can be a curse. Once a company is perceived as having abundant resources — hiring when needed, raising budgets when short, buying traffic when necessary — those levers mask the real problems.AI Speeds Up Vulnerability Discovery for Both SidesThe development that most worries practitioners, Wang says, is how quickly AI is accelerating vulnerability discovery. Someone scanning hardware wallets or other products for security flaws in bulk would represent an entirely new category of risk.But he is explicit that the acceleration is symmetric.Common blockchain attacks historically involved finding contract vulnerabilities and combining them with replay attacks, flash loans and oracle manipulation. Those methods still exist but have become less prevalent, because many protocol developers now use auditing tools and formal verification to close most vulnerabilities before deployment — making the attempt less cost-effective for attackers.OneKey uses AI models for self-testing. Some tools can run offline after deployment, enabling low-cost security audits every week and with each release, which substantially raises audit frequency."Like a kitchen knife, it can be used to kill or to chop vegetables," he says of the tools. The outcome depends on how teams use them.Supply Chain Attacks Have Become the New Front LineWang flags a shift in where attacks originate.Attackers increasingly bypass the product itself and target upstream third-party dependencies and development toolchains instead. Those incidents are becoming more common, forcing the industry to re-examine the security boundaries of code dependencies.The point lands with particular weight this month. A fraudulent government request that passed Revolut's internal verification checks exposed customer passports, home addresses and full Bitcoin transaction histories — a failure of authorisation rather than of encryption, which is structurally the same category of problem.Hardware Wallets Are Not Inherently SecureWang is direct about the limits of his own product category.Security labs have reproduced vulnerabilities in Ledger devices. Major incidents such as the Bybit theft have demonstrated repeatedly that negligence at any point — the signing process, front-end display, supply chain, human error — can be amplified.That candour has an immediate reference point. The Coldcard exploit ran across four waves between late July and early August, affecting more than 4,585 addresses and removing over $120 million in Bitcoin.The consequence was visible in custody flows. Binance's Bitcoin reserves rose by approximately 77,000 BTC since late April to surpass 693,000, with security concerns following the Coldcard incident cited among the drivers. A hardware wallet failure pushed some holders toward exchange custody — the opposite of what self-custody advocates would want.For OneKey, Wang frames security as a long-term project requiring continuous investment and iteration rather than a one-time achievement.Paid Trial Tasks Reveal What Interviews CannotOn hiring, Wang described a specific method.Candidates receive a real problem to complete within one or two days, and they are paid for it. The payment signals respect for their time; their seriousness about the task reveals actual ability and work ethic.He considers collaborating briefly on real work a more reliable assessment than an interview alone.Sticking With What He Is Already DoingWang was asked about the constant supply of new opportunities — memecoins, trading agents, new listings.He acknowledges the industry will keep producing things that are "completely unknown before they appear, and only become apparent after they appear," and that chasing them is natural when funds are limited and returns are wanted quickly.His own answer is different. If someone has no unwavering attachments, switching tracks is perfectly acceptable. For him, the answer is to stick with what he is doing.He has worked on wallets for a long time and considers himself better suited to it than most. The mistakes he made along the way are valuable experience, and he does not intend to waste them.He will remain focused on OneKey for some time, keeping an open mind about the more distant future while concentrating on making the product better and being patient.
