The Hyperliquid-based perpetuals venue for stocks and commodities detected unauthorized activity affecting its GitBook documentation on Monday morning. The docs were restored to their previous state as of 9:15 AM ET.

As a precaution, users are advised not to click any links inside the documentation while the investigation continues. The team has not disclosed what was altered or whether any user funds were affected.

Compromised documentation pages are a common phishing vector, where attackers swap legitimate links for wallet drainers. Further updates are expected as the review progresses.