How Mamori Uses ML to Tackle Web3’s “Unknown Unknowns” — A Q&A with Founder Andy M. Lee
Mamori is building an ML-enabled pathfinder for blockchain value extraction—applied to zero-day economic exploits, MEV, and intent solving. This candid Q&A with founder Andy M. Lee covers how the system works, who thrives at Mamori, and how Hyphen accelerated hiring.
Fast Facts
• Founded: 2023 • Based: Hong Kong
• Focus: ML for exploit detection, MEV, intent solving
• Seed round publicly announced: July 2024
Founder Bio
Andy M. Lee is the Founder & CEO of Mamori. His background blends ML and economics, mechanism design for decentralized exchanges, and hands-on research/engineering across security and systems. He started Mamori to push beyond snapshot audits toward continuous, state-aware security for Web3.
Q&A — Alberto × Andy
Alberto (Hyphen): For people new to Mamori—what unique problem do you solve that others miss?
Andy (Mamori): Most DeFi risk isn’t a missing semicolon—it’s economic attacks that only emerge through specific sequences under particular chain states. Traditional audits are expensive snapshots that go stale after every upgrade. Manual review doesn’t scale: hundreds of new protocols launch monthly while expert auditors remain scarce. Static tools drown teams in false positives and can’t reason about multi-step state interactions.
Our approach: make comprehensive coverage accessible through automation rather than luxury manual services, so re-auditing after changes becomes feasible. Because the cost base is compute-heavy (not service-heavy), we can scale horizontally—analyzing thousands of protocols without human bottlenecks.
Alberto: “ML pathfinder” sounds new. In practice, how is it different from audits or monitoring?
Andy: Audits look at code. We look at evolving states—and at how an attacker could profit. Under the hood:
- Centralized State Pool — we persist and share all “interesting” states discovered during search; multiple executors build on each other instead of restarting from zero.
- State-diff discovery — a low-level wrapper observes which storage slots prior executions accessed/modified so we can zoom into promising areas.
- “Interestingness” (not just coverage) — we prioritize states that touch critical storage, trigger balance anomalies, or sit one branch away in the control-flow graph.
- CFG-guided constraint learning — constraints carry across sessions; we adapt step sizes (think gradient-descent vibes) with smart fallbacks to close on an exploit path.
- ML-enabled search — constraint-based targeting + non-linear optimization to generate the right next states.
Net effect: we don’t just flag suspicious code; we surface exploit paths—how an attacker would actually extract value.
Alberto: Who thrives at Mamori—and what signals misfit?
Andy: People with systems depth and transfer-learning chops thrive—EVM internals (opcodes/storage/bytecode), Rust systems programming, DeFi economics, binary analysis, strong math/CS fundamentals. The through-line is adversarial thinking and the ability to explain one domain clearly while connecting it to another.
Red flags: narrow, tool-only security (e.g., using fuzzers without understanding feedback mechanisms or mutation logic), “I only do X, not Y,” resistance to documentation/code review, or purely mercenary motivation.
Alberto: Can you walk us through the hiring funnel—ratios and speed?
Andy: Typical flow: Hyphen screen → Founder interview → Written technical task → Technical presentation + live follow-ups. Current pass rates: Founder 67.9% → Written 30.6% → Presentation 63.63%—which nets about 13.2% interview→offer. Our usual timeline is 2–6 weeks end-to-end.
Funnel Snapshot
Founder 67.9% → Written 30.6% → Presentation 63.63% → Offer ≈ 13.2%
Typical time-to-hire: 2–6 weeks
Alberto: What helps candidates stand out—what should they study?
Andy: Three things:
- EVM internals beyond Solidity—storage layouts, opcodes, bytecode reading.
- Adversarial modeling—how state evolves across interactions and why CFG distance matters.
- Cross-domain transfer—optimization or ML concepts applied to search strategies.
Bring a short write-up: a recent exploit you studied, why it worked, and how you’d detect it with state-aware search (not just pattern matching).
Alberto: Any resume red flags even when skills look decent?
Andy: Over-indexing on buzzwords with no shipped work, or only surface-level audits without reasoning about state transitions. Weak communication is also a problem—if you can’t explain an exploit clearly, it’s hard to collaborate at speed.
Alberto: How do you retain top talent when competitors are hiring aggressively?
Andy: We optimize for learning and ownership. People get real research/engineering runway, freedom to innovate, rapid promotion for impact, and problems that genuinely move the industry. We’re adaptive, flat, and result-driven—focused on setting an automation standard for value extraction.
Today: headcount 11.
Next 6 months: in Q1 we’re expanding Security Research and Growth—keep an eye on our socials.
Alberto: Let’s talk outcomes—what was Hyphen’s impact on your hiring?
Andy: Direct inbound had a high mismatch; many failed the first round. With Hyphen, ~60% of our team came through that pipeline, and 6-month retention is ~83.3%. Typical time-to-hire sits in the 2–6 week range.
Candidate Prep — Quick Links
- MEV explainers (Flashbots) and Ethereum.org primers on MEV/EVM/oracles
- Mamori’s high-level whitepaper/notes (conceptual overview is enough to prep)
- Your own 5–7 minute exploit walkthrough (clear, state-aware detection plan)
Partner Perspective — How Hyphen Helped Mamori Hire
The Challenge
High mismatch from direct inbound; many failed the first round and screening time ballooned.
The Solution
Hyphen built a curated pipeline mapped to Mamori’s research-driven bar and the roles most needed (Rust systems, on-chain research, ML/LLM infra).
The Results
- Time-to-shortlist: days, not weeks
- Time-to-offer: 2–6 weeks
- % of hires via Hyphen: ~60%
- 6-month retention: ~83.3%
Andy’s take
“Hyphen uniquely matched our demand with the right people—and advised through hiring and post-employment HR strategies.”
Explore careers via Hyphen → hyphen-connect.com/careers
Need to hire? Start with Hyphen → hyphen-connect.com/discover-talents
Disclaimer
This article is for informational purposes only and reflects the interviewee’s views at the time of publication. It is not investment, legal, or technical advice. Quotes are published with permission; any company metrics referenced were provided by the interviewee. Hyphen may have a commercial relationship with the featured company.