Crypto: The Fake GTA 6 That Drains Your Wallet

The copy is almost perfect. The site mimics the appearance of a fan page dedicated to GTA 6, complete with official visuals and accurate information about its release. Between two gameplay tiles, it offers to sell a << leaked >> copy of the game for $50, or for 1 SOL, approximately $102. However, users who connect their wallet and validate the transaction risk losing much more: the code prepares to transfer their assets instead of charging the advertised price.

This is the third variation of the GTA 6 scam identified this year by antivirus publisher Malwarebytes. The first sold << early access >> for several hundred dollars in cryptocurrencies, the second disguised an infostealer as a playable demo. This one loads a wallet drainer as soon as the page opens, in other words, a code designed to siphon the assets of a wallet if its owner validates the transaction or the proposed authorization.

Key Points {#h-key-points}

• A fake GTA 6 fan site offers a << leaked >> copy for $50 or 1 SOL, but loads a wallet drainer as soon as the page opens.
• The 2.4 MB script targets seven networks (Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, Fantom) and requests transfers or approvals of tokens and NFTs.
• A parameter named CIS_Protection blocks visitors from ten countries of the former USSR, a classic convention of Russian-speaking criminal tools.
• Connecting the wallet does not steal anything: the danger lies at the signature screen, where one must refuse any transfer of the entire balance or any request for permanent access.

An Impeccable Facade, a Sloppy Store

The storefront shows no obvious flaws, according to observations by Malwarebytes experts. Countdown to November 19, Leonida map, information grid consistent with Rockstar's announcements: release on PlayStation 5 and Xbox Series X|S, no PC version planned. The copy-paste is clean because it comes from legitimate sources.

The commercial discourse, however, contradicts itself in every paragraph. The footer states that the site << does not offer any purchases, downloads, or payments of any kind >>, two centimeters below two payment buttons. The newsletter sign-up box is titled << Get notified. Not scammed. >> The grid announces a game reserved for consoles while the FAQ promises a PC download after purchase, and swears that no price has been confirmed even though official pre-orders have been open since June. The word << download >> is misspelled, and one line refers to GTA IV instead of VI.

Amid these inaccuracies, a well-rehearsed maneuver: the page warns that all other sites offering << leaked >> content are scams, and that it is the only safe place to buy. Denouncing competing scammers remains the most cost-effective way to disarm a wary visitor.

The scenario holds because a real leak did occur. In September 2022, ninety pre-alpha gameplay videos from Rockstar's internal systems were published by a teenager affiliated with the Lapsus$ group. Two successive reports have since moved the release from fall 2025 to May 26, 2026, and then to November 19. Each delay extends the window of opportunity available to the fraudsters. ![The site mimics the appearance of a fan page dedicated to GTA 6, complete with official visuals and accurate information about its release. Between two gameplay tiles, it offers to sell a "leaked" copy of the game for $50, or for 1 SOL, approximately $102. However, users who connect their wallet and validate the transaction risk losing much more: the code prepares to transfer their assets instead of charging the advertised price.

This is the third variation of the GTA 6 scam identified this year by antivirus publisher Malwarebytes. The first sold "early access" for several hundred dollars in cryptocurrencies, while the second disguised an infostealer as a playable demo. This one loads a wallet drainer as soon as the page opens, in other words, a code designed to siphon the assets of a wallet if its owner validates the proposed transaction or authorization. ![The site mimics the appearance of a fan page dedicated to GTA 6, complete with official visuals and accurate information about its release. Between two gameplay tiles, it offers to buy a "leaked" copy of the game for $50, or for 1 SOL, approximately $102. However, users who connect their wallet and validate the transaction risk losing much more: the code prepares to transfer their assets instead of charging the advertised price.

This is the third variation of the GTA 6 scam identified this year by antivirus publisher Malwarebytes. The first sold "early access" for several hundred dollars in cryptocurrencies, while the second disguised an infostealer as a playable demo. This one loads a wallet drainer as soon as the page opens, in other words, a code designed to siphon the assets of a wallet if its owner validates the proposed transaction or authorization. Malwarebytes' alerts have been picked up by the specialized press -- Source: X Account

A drainer offered as a service, with its exclusion list

Two pieces of code coexist on the page, of very different nature. The first, hardcoded in the HTML, targets Solana wallets. It never charges the displayed price: it reads the balance, leaves enough to pay the network fees, and prepares to transfer everything else to the address 21iWU6FJWJ9FKKz4Jek2CyTh2x1fqs5jawjrNgE3nHjN. The << 1 SOL >> on the button does not factor into any calculations.

The second is a 2.4 MB much more ambitious script. It includes a legitimate wallet connection library, widely used on the web, to which the malicious code has been grafted: inventory of assets, valuation in dollars, transmission of the profile to the operator, and then retrieval of transactions to be signed by the victim. Seven networks are covered: Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom, with recognition of major stablecoins.

The technical nuance decides everything. A transfer takes the funds immediately. An authorization does not move anything right away: it grants a third party the ability to later transfer tokens or NFT collections, as long as their owner has not revoked it. The script manages both scenarios and adjusts its requests based on the wallet's content.

Before even displaying the connection button, it downloads its configuration from the operator's server and geolocates the visitor by their IP address. Ten countries trigger a message << This website is unavailable in your region >> followed by a redirect to a blank page: Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan, and Uzbekistan.

Saving this group of post-Soviet countries is an old convention in certain criminal tools, generally interpreted as a precaution against local police. In the code, the parameter has an unambiguous name: CIS_Protection.

<< We would not draw conclusions about the identity of the perpetrators from a simple list of countries. Whoever built this tool made a deliberate decision about the people they accepted to rob, and they inscribed that decision in a configuration file. >>
Stefan Dasic, Senior Malware Research Engineer and Technical Lead for Web Protection at Malwarebytes ThreatLabs -- Source: www.malwarebytes.com

The rest of the toolkit follows: detection of automated browsers used by security scanners, suppression of console messages, hindrances to development tools, hidden server addresses. Most importantly, the Solana address listed on the page does not appear anywhere in the large script, which remotely retrieves an operator ID and its settings on an infrastructure that also fabricates the transactions presented to victims.

Changing the beneficiary of the thefts does not require touching the site. Several clues suggest a drainer offered as a service to various operators, even though Malwarebytes has not precisely identified the tool used. The two domains noted, centrodigestionedellarapina[.]life and dasunerforschtelandamendederwelt[.]sbs, belong to the analyzed malicious infrastructure.

The model reports: Scam Sniffer estimated the losses inflicted by these kits at nearly $494 million for the year 2024 alone, affecting over 330,000 addresses. ![The site takes on the appearance of a fan page dedicated to GTA 6, complete with official visuals and accurate information about its release. Between two gameplay tiles, it offers to buy a "leaked" copy of the game for $50, or for 1 SOL, about $102. But users who connect their wallet and validate the transaction risk losing much more: the code prepares to transfer their assets instead of charging the advertised price.

This is the third iteration of the GTA 6 scam spotted this year by antivirus publisher Malwarebytes. The first sold "early access" for several hundred dollars in cryptocurrencies, the second disguised an infostealer as a playable demo. This one loads a wallet drainer as soon as the page opens, in other words, a code designed to siphon assets from a wallet if its owner validates the transaction or the proposed authorization.](https://journalducoin-com.exactdn.com/app/uploads/2026/09/anonymous-GTA-6-mise-ne-garde-virus-leak-crypto.png?strip=all&quality=90&webp=90&lazy=1) ![The site takes on the appearance of a fan page dedicated to GTA 6, complete with official visuals and accurate information about its release. Between two gameplay tiles, it offers to buy a "leaked" copy of the game for $50, or for 1 SOL, about $102. But users who connect their wallet and validate the transaction risk losing much more: the code prepares to transfer their assets instead of charging the advertised price.

This is the third iteration of the GTA 6 scam spotted this year by antivirus publisher Malwarebytes. The first sold "early access" for several hundred dollars in cryptocurrencies, the second disguised an infostealer as a playable demo. This one loads a wallet drainer as soon as the page opens, in other words, a code designed to siphon assets from a wallet if its owner validates the transaction or the proposed authorization.](https://public.chaincatcher.com/upload/news/202609/31cf8c99a7fc4f98a745a5ed13799d3a.png) Even Anonymous warns its community about malware related to the release of GTA 6 -- Source: X Account

The wallet connection does not give anything to anyone. The connection exposes a public address, not the funds deposited there. Everything hinges on the next screen, where the wallet requests a signature.

Phantom simulates each transaction before validation and displays in clear language what will happen, with an alert when the operation seems suspicious. MetaMask and Rabby also offer simulation tools and security warnings. However, none of these safeguards withstand a reflex click on << Confirm >>.

Two signals are enough to stop everything. A transaction that moves the entirety or nearly all of the balance where one expected 1 SOL. And any request for approval, authorization, or access to tokens and NFTs: a store selling a video game has no reason to request a lasting permission on a collection.

For those who have already connected their wallet, the order of operations matters. First, you must revoke granted permissions, using a multi-chain tool like Revoke.cash, Etherscan's tool for Ethereum, or the explorer corresponding to the network used. Disconnect from the site afterward, knowing that this action does not cancel any already signed permissions. Finally, check the contents of the wallet, tokens, and NFTs, on each of the chains used.

If funds have left, or if a seed phrase has been entered somewhere, the rest must go to a new wallet. The analyzed code neither asks for nor exposes the recovery phrase, but any manual entry constitutes a distinct compromise. A completed transfer, however, cannot be undone.

As a last reflex, report the recipient address to your wallet provider and a public reporting service, then ignore the providential messages from << fund recoverers >> that appear in the following hours. Promising the return of stolen cryptos for a fee is often the second scam served to the same victim.

GTA 6 will be released on November 19 on PlayStation 5 and Xbox Series X|S, through the stores that players already use, and Rockstar does not ask anyone to connect a crypto wallet. In the absence of an announced PC version, any page promising a PC download after payment disqualifies itself even before displaying its connection button. Be careful, scammers will surely continue to ride the general enthusiasm a few months before the release of a highly anticipated game.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.