Cowrie Research

harpie-primary-sources-2026-04-28

4 min read

Harpie primary-source snapshot

Fetched: 2026-04-28 UTC

1) Official homepage / product framing

Source: https://harpie.io/

Selected excerpts from the official site:

Harpie is the first on-chain firewall preventing hacks, scams, and theft.

we monitor your wallet for suspicious activity hundreds of times a second

we transfer your assets to a safe location as soon as we detect theft

Additional signals from the source:

  • The homepage framing is explicitly interventionist, not just advisory: Harpie presents itself as an active theft-response layer
  • The page emphasizes trusted-network setup, audited/open-source contracts, and support for apps, tokens, and NFTs
  • The marketing copy is consumer-facing, but it implies a deeper operational system behind the scenes

2) Verified GitHub organization / broader product signal

Source: https://github.com/Harpieio

Selected excerpts/signals from the official GitHub org:

Harpie protects your crypto wallet for life. Currently developing our API in stealth.

Additional signals from the source:

  • GitHub verifies that the org controls the harpie.io domain
  • The org publicly exposes both a docs repo and a contracts repo, suggesting a real technical surface beyond the homepage
  • The “API in stealth” phrasing helps explain why the public docs are somewhat uneven but clearly API-oriented

3) Background Check API / malicious-address intelligence

Source: https://raw.githubusercontent.com/Harpieio/docs/main/docs/background-check-api/introduction.md

Selected excerpts from the official docs:

Harpie’s Background Check API screens any Ethereum address, letting you know if it’s been involved in hacking, phishing, and other cybercrime.

we have a database of over 800,000 smart contracts, along with their deployer and contract name

we’ve indexed over 1.8 million malicious addresses and 800,000 verified smart contracts

Additional signals from the source:

  • This page is the clearest evidence that Harpie is not only a consumer wallet product, but also a risk-data/API vendor
  • The docs describe results as human-readable and actionable, which suggests an embedding target in third-party wallet or transaction flows
  • The page exposes a dashboard login path and even a rate-limited test key, implying the API was at least partially productized publicly

4) Transferer contract / rescue-path constraints

Source: https://raw.githubusercontent.com/Harpieio/docs/main/docs/contracts/transferer.md

Selected excerpts from the official docs:

The Transferer contract has the ability to move your tokens to our noncustodial Vault. It cannot transfer your tokens anywhere else.

These functions transfer user assets into the Vault when we detect a malicious transaction.

Additional signals from the source:

  • The docs define a narrow transfer path: assets move to the vault, not to arbitrary Harpie-controlled destinations
  • Harpie says transfer EOAs are controlled by its automated detection algorithm
  • The presence of batch transfer functions suggests the system was designed with large-scale attack handling in mind, not only one-off incidents

5) Noncustodial Vault / withdrawal and emergency design

Source: https://raw.githubusercontent.com/Harpieio/docs/main/docs/contracts/noncustodial-vault.md

Selected excerpts from the official docs:

The Vault contract receives tokens from Transferer and allows users to withdraw those tokens at a later time.

They can withdraw any fees stored in the contract, but never withdraw any tokens

These emergency functions allow users to freely withdraw their crypto irrespective of any fees.

Additional signals from the source:

  • The docs describe a user-registered recipient address that becomes the authorized withdrawal destination
  • Harpie claims the fee controller can reduce fees but never increase them, and can withdraw only fee payments rather than user assets
  • The emergency-fee-removal role is described as a multisig with majority control by custodians outside the Harpie team, which is an important trust-model claim

6) Audit surface

Source: https://raw.githubusercontent.com/Harpieio/docs/main/docs/contracts/audit.md

Selected excerpts from the official docs:

Harpie has been auduited by Sherlock, and will be undergoing more contract audits in the future.

Additional signals from the source:

  • The page links a 2022 Sherlock audit report for Harpie
  • The wording and spelling on the page are rough, which is a reminder that the docs are not especially polished, but the audit link itself is still a meaningful primary-source signal

7) Current docs maturity / caveat

Sources:

Selected signals from the official docs repo:

  • The repo currently includes sections for background-check-api, contracts, and transaction-scanning
  • Some pages are clearly unfinished or placeholder-heavy, including example pages filled with generic “Hello, world!” or sample React-clock code
  • That makes the repo useful for architecture and product-surface discovery, but not a fully reliable polished docs portal

Notes

  • Harpie appears best cataloged as wallet firewall / onchain theft-response infrastructure / address-screening API / transaction-scanning security tooling.
  • The strongest current primary sources are the homepage plus the verified GitHub docs/contracts surface rather than a canonical whitepaper.
  • No standalone whitepaper or litepaper surfaced in this pass.

Graph View