GitBook, a documentation platform used by many crypto projects, says an attacker gained unauthorised access to some of its infrastructure credentials.
The company described the incident as “a sophisticated, highly targeted attack using AI agents.” It said the access took place at 7pm Central European Time on Monday, 2 November, and published its disclosure on Tuesday.
GitBook says it detected the intrusion immediately and moved to contain it. It had not explained how the credentials were obtained at the time of writing.
What may have been exposed
GitBook says the following may have been exposed:
- API tokens and integration tokens
- Git Sync secrets, which connect documentation to code repositories
- other integration secrets
- questions submitted to GitBook’s AI assistant
The company says it found no evidence that any hosted content was changed.
GitBook’s response
GitBook says it has revoked personal API tokens, invalidated customer API tokens, replaced its own infrastructure credentials and fixed the vulnerabilities involved.
It also took its app and login-protected documentation sites offline, while public docs stayed available through cached copies. By Tuesday afternoon, the app, API and published docs were back online, though GitBook said some services could remain slow or limited.
GitBook has told customers to rotate their GitBook API tokens, replace any third-party API tokens and secrets connected to GitBook, and re-authenticate if they use its MCP server.
PancakeSwap moves its docs
PancakeSwap temporarily took its documentation offline and redirected visitors to its homepage while the incident was investigated.
The exchange said its “docs are not compromised and [the] PancakeSwap app is not affected.” It has since moved its documentation from GitBook to infrastructure it controls, and existing links still work.
No losses of user funds had been reported at the time of writing.
What happens next
Crypto teams that use GitBook should follow its advice and rotate any connected tokens and secrets. Users should take care with documentation links until projects confirm their docs are secure, because docs pages are a common target for phishing.
