Trade[XYZ] restores docs after GitBook breach, reports no evidence its systems were hit
Trade[XYZ] told users not to click links in its documentation after unauthorized activity on 2 November. GitBook has since published a post-mortem and treats all customer data as exposed.
· Effective · Verified 2026-11-06 via official announcement
Effective Nov 2, 2026: Trade[XYZ] restores docs after GitBook breach, reports no evidence its systems were hit. Affects: Anyone who followed links in Trade[XYZ]'s documentation around the morning of 2 November 2026. Source: x.com, verified Nov 6, 2026. If this rules trade.xyz out, our top-listed alternative is Lighter (0% round trip; code DEXSHEET, 10% fee rebate).
Trade[XYZ] said on 2 November 2026 that it had found unauthorized activity affecting its GitBook documentation that morning and had restored the pages to their previous state by 9:15 AM ET. It advised users not to click any links in the documentation while it investigated. It later said GitBook had confirmed the incident came from a breach of GitBook's own infrastructure, and that its internal investigation found no evidence of any compromise to Trade[XYZ] infrastructure.
GitBook's post-mortem, published on 4 November, says an attacker used a flaw in its SSO login flow to act as GitBook staff and went on to gain full infrastructure access. GitBook says the activity appears aimed at one customer, which it does not name, and that it found no evidence that any other customer's content was modified. It says the attacker had access to production for about 2 hours 45 minutes on the evening of 2 November and about 40 minutes early on 3 November. It took its app offline for about 16 hours, until 11:56 UTC on 3 November, and rotated its secrets.
GitBook treats all customer data as exposed, including API tokens, integration secrets and session signing secrets. It says billing information, passwords and IP addresses were not compromised, and it has told customers to replace API tokens and rotate third-party secrets.
Trade[XYZ] says its security controls kept the incident out of its own infrastructure and that it will move off GitBook's platform in the coming days. Its posts give no user loss figure, wallet count or list of the links involved, and do not say the warning on links has been lifted. KuCoin's news feed, citing Huo Xing Cai Jing, reports that SlowMist security chief 23pds identified Trade.xyz as the customer targeted; GitBook has not named it. Trade[XYZ]'s markets trade on Hyperliquid, and neither company's statement describes a compromise of Hyperliquid.
“As a precaution, we advise users not to click on any links within the documentation while our investigation remains ongoing.”
— trade.xyz on X, 2 November 2026
Who this affects
Anyone who followed links in Trade[XYZ]'s documentation around the morning of 2 November 2026.
trade.xyz at a glance
trade.xyz deploys perpetual markets on Hyperliquid through HIP-3, covering US and Asian stocks, ETFs, equity indices, commodities, FX and pre-IPO companies, all margined and settled in USDC. Hyperliquid's own engine matches orders and holds positions; trade.xyz sets the market rules and price feeds and runs a web interface at app.trade.xyz.
Full trade.xyz sheet · 0.018% round trip · Also affects Hyperliquid
More from the newsroom
Sources
Last checked . Fees and terms change often; the venue's own page wins if it disagrees with ours.
- trade.xyz on X - Unauthorized activity affecting GitBook documentation (2 Nov 2026) — checked 2026-11-05
- trade.xyz on X - Profile feed with follow-up: GitBook confirmed breach of its infrastructure — checked 2026-11-05
- GitBook - Security incident post-mortem (4 Nov 2026) — checked 2026-11-06
- GitBook Status - Security incident impacting published sites and GitBook app — checked 2026-11-05
- crypto.news - Trade.xyz restores GitBook docs but keeps link warning in place — checked 2026-11-05
- trade.xyz on X - GitBook confirmed breach; transitioning from GitBook (2026-11-04) — checked 2026-11-06
- TokenPost - Trade.xyz Says GitBook Confirmed Breach Behind Documentation Incident (2026-11-05) — checked 2026-11-06
- KuCoin News - GitBook Security Incident: Attack Targeted Trade.xyz — checked 2026-11-06
About DexSheet
DexSheet is an independent fee sheet for on-chain trading. It tracks the fees, custody, backers, incidents and availability of 98 crypto trading venues, with a dated source for every number. Every newsroom entry is checked against the venue's own announcement, docs or terms before it is published. Data: fees.json (CC BY 4.0) · RSS.