Highlights
- A fake GTA 6 leak site, styled as a fan countdown page, offers a supposed leaked copy of the game for $50 or 1 SOL.
- Malwarebytes found the site hides two wallet-drainer scripts, one targeting Solana and a larger one covering seven other chains.
- The bigger script, roughly 2.4MB, can identify and drain assets on Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base and Fantom.
- The scam checks visitors' IP addresses and deliberately avoids triggering in ten countries, including Russia and Armenia.
Cybersecurity firm Malwarebytes has uncovered a fake GTA 6 leak site that uses the game's hype cycle to run a cryptocurrency wallet drainer capable of hitting eight different blockchains at once. According to PANews, the site poses as a fan countdown page and invites visitors to download an alleged leaked copy of the game for $50, or alternatively 1 SOL, before connecting a wallet and signing what looks like a routine transaction.
How the Drainer Actually Works
Malwarebytes' own research write-up details two separate malicious components hidden behind the payment flow. One is a smaller script tuned specifically for Solana wallets, calculating a transfer amount precise enough to leave a victim just enough funds to cover transaction fees, likely to avoid triggering low-balance errors that would tip off the target. The second, a roughly 2.4MB script, is far broader: it scans connected wallets across Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base and Fantom, then either drains assets immediately or extracts permissions that let the attackers pull tokens and NFTs later, depending on what the victim signs.
Built to Dodge Detection
The operation layers in geofencing on top of the technical drain. Before the malicious script fires, the site checks a visitor's IP address and stands down entirely in ten countries, including Russia and Armenia — a pattern consistent with operators avoiding jurisdictions where local law enforcement is less likely to cooperate with cross-border cybercrime investigations, or where the operators themselves may be based. Malwarebytes also flagged social-engineering touches meant to build trust before the drain: the page cites accurate details, like GTA 6's real PlayStation 5 and Xbox Series X|S release platforms, and warns visitors that other GTA 6 leak sites are scams — even as its own footer claims to sell nothing and its FAQ contradicts the console-only framing by promising a PC download. Small tells, like a misspelling of “downloading” and a stray reference to GTA IV instead of GTA VI, are the kind of details that survive automated scanning but would catch a careful reader.
Related: X Users Flooded With Password Reset Emails as X Money Scales Up
Why Anticipation-Driven Scams Keep Working
GTA 6's release remains one of the most anticipated gaming events in years, and that anticipation is exactly what makes fans more likely to skip their usual caution and connect a wallet to an unfamiliar site promising early access. Wallet-drainer kits targeting multiple chains simultaneously have become increasingly common precisely because a single successful connection can expose a victim's entire crypto footprint, not just one asset on one network.
What to Watch
Expect similar drainer sites to resurface as GTA 6's actual release date approaches and hype intensifies further; Malwarebytes has already tracked earlier variants using “extended look” and demo bait. The practical defense stays the same regardless of the theme: never connect a wallet or sign a transaction to access game downloads, leaks, or early-access content promoted through unofficial sites.
FAQ
What does the fake GTA 6 site actually offer?
It claims to sell a leaked copy of GTA 6 for $50 or 1 SOL, but the payment flow is designed to trigger a wallet-draining transaction instead.
Which blockchains does the drainer target?
Solana through a dedicated script, plus Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base and Fantom through a second, larger script.
How does the scam avoid detection?
It checks each visitor's IP address and won't trigger the malicious script in ten countries, including Russia and Armenia.
How can users protect themselves?
Never connect a crypto wallet or sign a transaction on unofficial sites offering game leaks, demos, or early access — legitimate downloads never require wallet approval.
