1. What happened to the Trade.xyz documentation?
Trade.xyz, which runs stock, index and commodity perpetual futures markets on Hyperliquid, told users on Monday, November 2, to avoid every link in its documentation after it detected unauthorized activity on the GitBook pages that host those docs. The Trade.xyz GitBook incident was reversed within hours, with the pages restored to an earlier state, but the company kept its warning in place.
In a post on X published shortly before 10 a.m. Eastern time, the company said it noticed the activity earlier that morning. It said the documentation had been restored to its prior state as of 9:15 a.m. ET, that it was actively reviewing the incident, and that it would share updates as appropriate.
The company described the instruction not to click documentation links as a precaution while the investigation continues. Users were advised not to follow any link found inside the docs until further notice.
2. What has Trade.xyz not disclosed?
The statement was brief, and several basic questions remain unanswered. The company did not describe what the unauthorized activity was, how it took place, or when it began. It did not say whether any pages or links had been changed, which is the detail that would show whether users were exposed to altered content.
It also did not say whether anything beyond the documentation was affected. The post made no mention of the trading application, the smart contracts that underpin its markets, or user funds. Without that information, the extent of the problem cannot be assessed from the public record.
The absence of detail is common in the first hours after a security event, when a team is still gathering facts and may prefer to confirm findings before publishing them. It does mean that the only firm conclusions are the ones the company stated: unauthorized activity was seen, the pages were restored, and links should not be clicked.
3. Why does documentation security matter for a trading platform?
Documentation pages look like a minor part of a product, yet for a trading platform they are a place where users go to find official links, market specifications and setup instructions. People treat those pages as trusted because they are published by the company itself.
That trust is what makes them attractive to attackers. If a link on a documentation page were replaced with one that points to a counterfeit site, a user who follows it could be asked to connect a wallet or sign a transaction on a page controlled by someone else. A single changed link can therefore do more harm than the visual simplicity of a documentation page suggests.
This is the reason the company's advice is to avoid all documentation links rather than only some. Until it can say which links, if any, were modified, treating every link as untrusted is the cautious approach. Users who need official resources can reach them by typing known addresses themselves or using bookmarks they saved earlier, rather than clicking through from the docs.
4. What is GitBook and why would it be targeted?
GitBook is a service that many software and crypto projects use to publish documentation. It lets teams write and organize pages that are then hosted on the service and presented under the project's own branding. Because it is a third-party platform, a project's docs depend both on the security of the project's own accounts and on the way those accounts are protected on the service.
The company's statement refers to unauthorized activity on its GitBook pages and does not say how the access was obtained, so no conclusion can be drawn about the cause. Possible explanations range from compromised credentials to a problem on the hosting side, but none has been confirmed, and speculating about the method would go beyond what is known.
What the episode does show is that a project can face risk through the services that sit around its core product. Even if trading systems and smart contracts are carefully protected, the surrounding web presence needs protection too.
5. Who is Trade.xyz and what does it run?
Trade.xyz operates markets for perpetual futures tied to stocks, indexes and commodities on Hyperliquid. A perpetual future is a derivative that tracks the price of an underlying asset and has no expiry date, so a trader can hold a position for as long as margin requirements are met. These contracts are a staple of crypto trading, and Trade.xyz applies the format to traditional asset classes.
The company's markets run under Hyperliquid's HIP-3 framework. Trade.xyz said those markets passed $650 billion in trading volume in just over a year, a figure that indicates a considerable user base and a sizeable flow of activity that depends on users reaching the right interfaces.
Any incident that touches the public face of such a business draws attention for that reason. Users who trade at volume are accustomed to moving quickly, and a compromised link could take advantage of that speed.
6. How does the incident follow the ICE announcement?
The incident came four days after an announcement on October 29 involving Intercontinental Exchange, the owner of the New York Stock Exchange. Trade.xyz said ICE would make a strategic investment in the company and build a US market for round-the-clock Hyperliquid perpetual futures with it, subject to approval from the Commodity Futures Trading Commission.
Billionaire investor Stanley Druckenmiller, whom Trade.xyz named as a backer, separately confirmed his stake. The company's markets also sit within a wider conversation about how US traders might reach Hyperliquid-linked perpetuals: Kraken's parent company, Payward, has proposed a route for them to do so.
There is no stated connection between the documentation incident and the ICE announcement, and the company has not suggested one. The timing nonetheless means that the firm is under closer public scrutiny than usual, which raises the importance of a clear and complete explanation once its review is finished.
7. How can users protect themselves while the Trade.xyz GitBook incident is investigated?
The company's instruction is the main guidance: do not click links inside the documentation. Beyond that, general practices apply to anyone using a crypto trading platform. Reaching the service through a bookmark saved earlier, rather than through a link in a page whose integrity is in doubt, removes one common path for deception.
Users can also be wary of any prompt that asks them to connect a wallet, approve a spending permission or sign a message after arriving from an unfamiliar route. Wallet approvals can be difficult to reverse, and the safest time to question a request is before granting it. Hardware wallets that display transaction details on a separate screen give an additional chance to spot a request that does not match what the user intended.
None of this implies that any user has been harmed. The company has not reported losses, and it has not said that any link was changed. The advice is preventive and reflects the uncertainty that remains while the review is under way.
8. How do perpetual futures work on Hyperliquid?
Hyperliquid is a decentralized trading venue where traders can open leveraged positions in perpetual futures. Under the HIP-3 framework mentioned by Trade.xyz, outside teams can deploy their own markets on the platform, which is how a company can list contracts that follow stocks, indexes and commodities on a crypto-native exchange.
Because positions are leveraged, small price moves can have large effects on a trader's balance, and users often act quickly. That behavior is a reason attackers focus on the interfaces and links people use to reach a venue: a hurried user is less likely to examine an address carefully.
The same dynamic explains why the company has taken a conservative line on its documentation. Restoring the content addressed the immediate state of the pages, but the open question is whether anything harmful was visible in the interval before 9:15 a.m. ET.
9. What does a quick restoration tell us?
Restoring pages to a prior state is a common first response to an unwanted change, because it removes whatever content was placed there and returns the site to a version the team trusts. The company said it had done that as of 9:15 a.m. ET, which means the restoration preceded its public statement by roughly half an hour or less, based on the timing of the post shortly before 10 a.m.
A restoration does not, however, answer the question of how the change was possible. If the underlying cause is a weak credential, a stolen session or a misconfigured permission, the same route could be used again until it is closed. That is why a statement that the docs are back does not by itself end the matter, and why the company continues to ask users to stay away from the links.
Teams usually follow such a step with a review of access logs, a reset of credentials and a check of connected accounts. Whether Trade.xyz has taken those steps is not stated in its post, and the details are likely to appear, if at all, in the promised update.
10. What to watch next
The most important next step is the company's promised update. Users will be looking for a description of the activity, a statement about whether any links or pages were altered, and a clear answer on whether the trading app, contracts or funds were involved.
A signal that it is safe to use documentation links again would also be significant, since the current warning stays in force during the investigation. Until then, traders should rely on addresses they already know to be official.
Beyond this episode, the incident is a reminder for any crypto platform that documentation, social accounts and other public pages belong in the same security planning as the core product. How Trade.xyz reports its findings will indicate how it approaches that task as its ICE-backed plans proceed.