GitBook Hack: AI-Agent Attack Forces Crypto Docs Token Resets

By Nodora News · 4 November 2026

GitBook says an AI-agent attack exposed infrastructure credentials, forcing API token resets as PancakeSwap and trade.xyz moved to protect crypto docs.

GitBook, the documentation platform that hosts official guides for a large share of crypto projects, says an attacker using AI agents gained access to some of its infrastructure credentials on November 2, 2026. The company has revoked every customer's API tokens and is telling teams to rotate their integration secrets, while crypto names including PancakeSwap (CAKE) and Hyperliquid-based trade.xyz took precautions with their docs. No user funds have been reported lost.

Key takeaways

• GitBook says the intrusion began at 19:00 CET (18:00 UTC) on November 2 and was detected immediately.
• Integration tokens, Git Sync secrets, API tokens and questions asked to the GitBook Assistant may have been accessed.
• GitBook found no evidence that customer content was changed, and services were back online by November 3.
• PancakeSwap moved its docs off GitBook; trade.xyz restored its docs and told users not to click links in them for now.
• Customers need to rotate GitBook and third-party tokens and re-authenticate the GitBook MCP server.

What happened in the GitBook breach

In a security notice published on November 3, GitBook described the incident as "a sophisticated, highly targeted attack using AI agents." AI agents are tools that can carry out a chain of actions on their own, such as running commands or calling software, rather than just answering questions. GitBook has not said which AI systems were involved, how the attacker used them or how the credentials were obtained, and it has not suggested its own AI products were to blame.

Once it spotted the access, the company says it blocked the attacker, closed the weaknesses involved and replaced every credential and secret across its infrastructure. As a precaution it took the GitBook app and login-protected docs sites offline, while keeping public documentation readable from cached copies for as long as it could. By 16:21 CET on November 3, GitBook said its app, API and published docs were available again, with a few services still recovering.

What data may be exposed, and what teams must do

GitBook listed four types of information the attacker may have reached:

• Integration tokens that connect GitBook to other services
• Git Sync secrets that link documentation to code repositories
• API tokens that let software talk to GitBook automatically
• Questions that site visitors typed into the GitBook Assistant

The company did not give a count of affected customers or records. It has already revoked all personal API tokens, so teams that rely on them will need to create new ones. GitBook's checklist is to rotate any existing GitBook API tokens, rotate any third-party tokens or secrets used to connect other tools, rotate secrets in published integrations, and re-authenticate the GitBook MCP server (MCP is a standard that lets AI assistants plug into services like GitBook).

Why the GitBook incident matters for crypto users

Documentation sites are where many users go to find official contract addresses, app links and setup steps. That makes them a tempting target: if an attacker can quietly change a link in a trusted guide, they can send people to a fake site that drains wallets. GitBook says it has seen no sign that content was edited, but the exposed secrets could still be useful for later phishing or for reaching tools that teams connected to their docs.

Crypto teams reacted quickly:

• trade.xyz, which runs stock, index and commodity perpetual futures markets on Hyperliquid (HYPE), said it found unauthorized activity on its GitBook docs on the morning of November 2 and restored them to their previous state by 9:15 a.m. ET. It advised users not to click any links in its documentation while it investigates, and said user funds, trading and on-chain settlement were not affected.
• PancakeSwap said its docs were not compromised and its app was not affected, but it took the docs offline as a precaution and then moved them to infrastructure it controls, with old links still working. It reminded users that its docs never ask them to connect a wallet or approve tokens.
• Unit temporarily suspended access to its own GitBook page and gave similar link warnings.

Notably, trade.xyz's restore time came before the access time GitBook disclosed, and neither company has said the two incidents are linked.

The breach lands during a tense week for crypto security. Binance's own incident report this week traced its record hack to a fake job interview and a compromised internal AI tool, and Binance founder Changpeng Zhao has warned of more AI-driven attacks. You can read more in our coverage: Binance (BNB) $6.3B Hack Began With a Fake Job Interview, Report Says.

Market reaction

Markets shrugged off the news, since no protocol or user funds have been reported hit. Prices on OKX around 20:00 UTC on November 3:

• Hyperliquid (HYPE): about $85.22, up 2.2% in 24 hours
• Bitcoin (BTC): about $77,540, up 0.8%
• Ether (ETH): about $2,287, up 1.8%

PancakeSwap's CAKE token is not listed on OKX spot. trade.xyz, whose markets settle on Hyperliquid, has been in the spotlight after US regulators cleared stock perpetual futures this week; see CFTC Approves Stock Perpetual Futures in the US for the First Time.

Track more coins on the Nodora charts page.

What to watch next

• A fuller GitBook post-mortem explaining how AI agents were used and how the credentials were taken
• Whether trade.xyz shares what the unauthorized activity on its docs actually was
• Other crypto projects confirming whether their GitBook-hosted docs or integrations were touched
• Phishing campaigns that copy project docs or reuse leaked links

What should users do? Until projects give the all-clear, reach apps through bookmarked official URLs rather than links inside documentation, and remember that a genuine docs page should never ask you to connect a wallet or approve tokens. This article is for information only and is not financial advice.

#Hyperliquid #GitBook #PancakeSwap #Security #Hack

This article is general information, not financial advice.