The unauthorized changes to trade.xyz documentation on November 2 came from a compromise of GitBook itself, the Hyperliquid perps platform said. Its internal review found no breach of trade.xyz infrastructure, and the team will move its docs off GitBook in the coming days.

In its post mortem, GitBook said the attacker abused a flaw in its SSO login flow to impersonate staff, reached internal repositories and a Cloudflare API key, and from there obtained production secrets. The attacker had access for about 2 hours 45 minutes on November 2 and about 40 minutes on November 3.

GitBook took its platform offline for about 16 hours, rotated every production and customer-managed secret, and revoked all API tokens issued before the cutoff.

GitBook said the activity focused on a single customer but treats all customer data as exposed, including API and integration tokens. Users were told to avoid links in the trade.xyz docs during the investigation, a reminder that hosted documentation is a phishing vector for DeFi front ends.