BTC $76,756 
ETH $2,255 
MGLOEURO $111,813 
USDT $0.9986 
BNB $698.47 
XRP $1.25 
USDC $0.9993 
SOL $92.08 
TRX $0.3186 
FIGR_HELOC $1.07 Hacks & Security · Explained
Trade.xyz restores GitBook docs but warns users off documentation links
The Hyperliquid perps platform says unauthorized activity hit its GitBook pages and that an investigation is ongoing.
Key takeaways
- Restored, not cleared. Trade.xyz said the documentation was back to its previous state by 9:15 a.m. ET, but the advice to avoid links inside it remains in force.
- Details withheld. The notice gave no start time, no method of access, no list of altered links and no loss figure.
- Timing. The incident surfaced four days after Trade.xyz announced a strategic investment from ICE, owner of the NYSE.
What happened
Trade.xyz, which runs perpetual futures markets tied to stocks, indices and commodities on Hyperliquid, alerted users on Monday to avoid clicking any links in its documentation after it found unauthorized activity on the GitBook pages hosting those docs, according to Unchained and Crypto.news.
In a post on X shortly before 10 a.m. ET, the company said it had noticed the activity earlier that morning and that the documentation had been fully restored to its previous state as of 9:15 a.m. ET. It said it was actively reviewing the incident and would share more information as appropriate.
The link warning was not lifted with the restoration. "As a precaution, we advise users not to click on any links within the documentation while our investigation remains ongoing," the company wrote, as quoted by both outlets.
The statement did not explain what the unauthorized activity involved, how it happened, when it started, or whether any pages or links were altered. It also did not say whether the trading application, its smart contracts or user funds were affected.
Why it matters
Documentation pages are a routine reference point for traders on a venue like Trade.xyz, who use them to find official links, market specifications and setup instructions. If those pages are changed without authorization, users can be steered toward destinations the company never intended, which is why the warning covers links even after the pages were restored.
The notice is narrowly framed. Trade.xyz identified its own documentation as the affected service and did not describe any intrusion into Hyperliquid's underlying trading infrastructure, according to Crypto.news. The company also did not attribute the incident to a flaw in GitBook's platform, name a compromised administrator account or stolen credentials, or publish a list of malicious links.
Background
The disclosure came four days after a significant corporate announcement. On Oct. 29, Trade.xyz said Intercontinental Exchange, the parent of the New York Stock Exchange, was making a strategic investment in the company and planned to build a U.S. market for 24/7 Hyperliquid perpetual futures with it, subject to Commodity Futures Trading Commission approval. Billionaire investor Stan Druckenmiller, whom Trade.xyz named as another backer, confirmed his stake separately.
Trade.xyz's existing markets operate under Hyperliquid's HIP-3 framework, and the company said at the time of the ICE announcement that they had passed $650 billion in volume in just over a year. Kraken parent Payward has also proposed a route for U.S. traders to reach Hyperliquid-linked perpetuals.
The GitBook notice landed two days after a separate cluster of website incidents in DeFi. On Oct. 31, Blockaid flagged Flap, Kintsu and 10 other projects over compromised frontends, with some pages said to be serving the Step Drainer toolkit. Flap confirmed a DNS hijack had redirected visitors to an unauthorized site, and StonkFun later said it had restored its website after taking it offline and moving infrastructure. Trade.xyz did not name Step Drainer or link its GitBook incident to those attacks.
What to watch
The main open questions are what the unauthorized activity actually was and whether any documentation links were changed before the restore. Trade.xyz has said it will provide further updates as appropriate, so any follow-up statement describing the mechanism, the affected pages or the scope of exposure would clarify the risk to users. Until then, the company's guidance is to treat links inside the documentation as off-limits.
Questions readers ask
Were user funds affected?
Trade.xyz's notice did not say whether the trading app, its smart contracts or user funds were affected, and it disclosed no loss figure or affected wallet count.
Is the documentation back online?
Yes. The company said the documentation was fully restored to its previous state as of 9:15 a.m. ET on Nov. 2, though it still advises against clicking links within it.
Was GitBook itself compromised?
The notice described unauthorized activity affecting Trade.xyz's own documentation and did not attribute the incident to a failure across GitBook's platform.
