Trade.xyz restores GitBook docs after unauthorized activity, warns users off links

GitBook is the documentation host used by a large share of crypto projects, including Trade.xyz, which runs stock, index and commodity perpetual futures on Hyperliquid. Attackers have repeatedly targeted project documentation and Discord channels in past years to insert phishing links that mimic legitimate interfaces, since these pages carry user trust but often sit outside a project's own security perimeter. GitBook's own infrastructure, not just a single client's content, was compromised in this case.

Traders and developers who rely on Trade.xyz's docs for API references or contract addresses had to treat every link there as hostile for roughly a day, until the previous version was restored at 9:15 a.m. ET on November 2. GitBook's response went further: it shut down affected systems and reset tokens, forcing any team using its platform to rotate credentials, not just Trade.xyz. That cost falls on documentation teams across the industry, regardless of whether their own content was altered.

A breach in a shared documentation host exposes a weak point that sits outside any single project's control: users assume a docs page is safe because the protocol behind it is audited, but the hosting layer rarely gets the same scrutiny. GitBook's disclosure that the intrusion was AI-assisted adds a newer variable to an old problem, phishing through trusted-looking links, without changing the basic lesson that supply-chain dependencies carry risk even when the underlying protocol is sound.

The open question is scope: whether GitBook's investigation finds other projects' documentation altered during the same window, and whether Trade.xyz's own review turns up any user harm tied to the malicious period before Monday's warning. GitBook's token reset and shutdown suggest containment, but confirmation of how many credentials or projects were touched, and any follow-up disclosure from Trade.xyz once its probe closes, will determine whether this stays a contained incident or widens.

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.