The target of this attack was neither an exchange nor a protocol contract, but a place where many crypto projects host their white papers and documentation.
GitBook disclosed that at 19:00 on November 2 (Central European Time), attackers obtained some infrastructure credentials. The company described it as “a highly targeted, sophisticated attack using an AI Agent.” GitBook then took its application and login-protected documentation sites offline. Public documentation remained available via cache, and service was restored on the afternoon of November 3.
There are four types of information that may have been exposed: integration tokens, Git Sync keys, API tokens, and visitors’ questions to GitBook Assistant. GitBook says it has found no evidence that any documentation was altered. It has revoked all customers’ API tokens and asked customers to rotate their GitBook and third-party integration keys, and reauthenticate GitBook MCP servers.
According to Decrypt, PancakeSwap first temporarily took its documentation offline, then migrated away from GitBook. $CAKE If users have noticed the documentation URL changing over the past few days, that's why.
My take:
1) The attack surface in crypto has long extended beyond smart contracts. Documentation, front ends, domains, developer tools—any of them can become a phishing vector if compromised. Just last week, a front-end was hit by a DNS hijacking attack.
2) The phrase “AI Agent attack” is worth noting. GitBook hasn’t said exactly how AI was used or how the credentials were lost; we’ll have to wait for the official postmortem for the details.
3) For everyday users, the most practical advice is still the old rule: cross-check contract addresses and official links across multiple official channels. Don’t trust just one page.
If your project uses GitBook and has Git Sync or third-party integrations connected, rotate your keys if needed—don’t wait.
Sources: GitBook’s official security announcement (November 3), Decrypt, crypto.news, TokenPost.