We’ve seen scam sites built around Grand Theft Auto VI (GTA 6) targeting visitors in three different ways this year.
In June, we looked at sites selling GTA 6 “early access” for hundreds of dollars in cryptocurrency. You paid, got nothing, and could not reverse the payment. In August, we found fake Extended Look and demo sites delivering an infostealer instead of a game.
The site we examined this week looks like a GTA 6 fan countdown site but offers to sell a leaked copy of the game. It loads a wallet drainer the moment you arrive: code designed to steal cryptocurrency and other assets from connected wallets. Choose to pay with cryptocurrency, and the drainer asks you to connect a wallet. It can target assets across several blockchain networks.
What the page looks like
The disguise works because much of the page uses accurate-looking information. There is a live countdown to November 19, a map of Leonida, and a grid of release facts and gameplay tiles. The release details match Rockstar’s own announcements: GTA 6 is scheduled for November 19 on PlayStation 5 and Xbox Series X|S, and Rockstar has not announced a PC version.
Two offers sit among that accurate material. One sells a leaked copy for $50. The other offers the same thing for cryptocurrency: 1 SOL (worth about $102 at the time of writing).
The page then tells visitors that every other site offering leaked material is a scam and this one is the only safe place to buy. Warning visitors about other scammers is a common technique designed to reassure anyone who is already suspicious.
The site also contradicts itself in ways anyone can check. Its footer states that the page offers no purchase, download, or payment of any kind, directly beneath two payment buttons. The signup box is headed “Get notified. Not scammed.” The facts grid says the game is console-only, while the FAQ promises a PC download after purchase, and claims no price has been confirmed, months after Rockstar opened pre-orders in June.
The writing splits in two as well. The countdown and map sections are clean copy. The sales copy contains multiple errors, including a misspelled “download” and a reference to GTA IV rather than VI. Our reading is that a legitimate-looking fan template was reused and the sales pitch added by someone else who did not proofread it.
What happens when you connect a wallet
There are two pieces of code here, and they are very different.
The first is written into the page and targets a Solana wallet. It does not charge the advertised price. Instead, it checks the wallet’s balance, leaves a small amount to cover the transaction fee, and prepares to transfer everything else to the attacker. The advertised price plays no part in the calculation.
The second is a separate script of around 2.4 MB, and it is far more capable. It includes a legitimate, widely used tool for connecting websites to cryptocurrency wallets, allowing it to work with many wallets rather than just one. Added to that tool is malicious code that inventories the connected wallet, calculates what its assets are worth, reports the details to the attacker, and retrieves transactions for the victim to approve.
The script is configured to target wallets across seven blockchain networks: Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom. It recognizes major stablecoins on those networks and can request several kinds of access. Depending on what the victim approves, it could transfer cryptocurrency immediately or gain permission to move tokens and entire NFT collections later.
A transfer takes assets immediately. An approval can give the attacker access to them later. This script supports both.
It checks where you are first
Before asking the visitor to connect a wallet, the script downloads its settings from the operator’s server. If a particular setting is enabled, it uses the visitor’s IP address to identify their country and checks it against a fixed list: Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan, and Uzbekistan.
Visitors from those countries see “This website is unavailable in your region” and are redirected to a blank page. Everyone else continues.
The setting that controls this country-blocking feature is named CIS_Protection in the code.
Excluding this group of countries is a long-standing convention in some criminal tooling, usually interpreted as an attempt to avoid local law enforcement. We would not draw conclusions about who is behind this from a country list alone. What it shows is that whoever built the tool made a deliberate decision about who they were willing to rob and wrote that decision into a settings file.
It works out what your wallet is worth
The script profiles visitors before asking them to approve anything. It checks their holdings across different blockchains, calculates their total value, and sends the details to the operator. These include the wallet’s estimated dollar value, its tokens and NFTs, the visitor’s IP address and country, and how many times the wallet has connected.
The script is also designed to make analysis more difficult. It can detect the automated browsers used by security scanners, suppress messages that would normally appear in the browser’s developer console, interfere with developer tools, and conceal its server addresses inside the code.
Several details suggest that the drainer is rented rather than homemade. The Solana address written into the webpage does not appear in the larger script. Instead, the script downloads an operator ID and settings from a remote server, which also prepares the transactions shown to victims. This resembles a hosted service used by multiple customers, although we cannot identify the product. It also allows the destination of stolen funds to be changed without altering the website.
The fake GTA 6 sites we investigated in June asked victims to send a fixed payment, limiting the immediate loss to that payment. This site can try to take everything in the connected wallet. Depending on what the victim approves, the attacker could either transfer the wallet’s current balance immediately or gain permission to take tokens and NFTs later.
What to look for before you approve anything
Simply connecting your wallet does not allow the site to take anything. The danger comes when you approve the transaction or permission request that follows.
That approval screen is an important last line of defense. The Phantom crypto wallet, for instance, says that it simulates every transaction before you sign and shows a plain-language preview of what will happen, including a warning if something looks suspicious. Other reputable wallets do the same, but they cannot protect you if you approve a request without reading it.
Check the wallet’s approval screen for two warning signs. First, reject any transaction that would transfer all or nearly all of your balance instead of the price you expected to pay. Second, reject any request to approve, allow, or grant access to your tokens or NFTs. That could let the attacker move those assets later, and a shop selling a game has no reason to request such permission.
How to protect yourself
- Nobody is selling a playable copy of GTA 6 yet. Rockstar is selling pre-orders for a November 19 release. Any site offering a leaked, early, or playable copy is not an authorized seller.
- Treat a wallet connection request on a game site as a stop sign. Legitimate GTA 6 purchases are available through Rockstar’s authorized stores and retailers. Rockstar does not ask buyers to connect a cryptocurrency wallet or send cryptocurrency to a wallet address.
- Read the approval screen every time, and reject anything that moves close to your entire balance or asks for ongoing access.
- Don’t let the accurate parts vouch for the rest. A correct release date and real artwork cost an attacker nothing.
- Keep large balances out of the wallet you browse with.
- Block the pages before they load. Malwarebytes Browser Guard is free and blocks scam and malicious sites while you browse.
What to do if you connected a wallet
- Review and revoke any permissions granted through the site. These permissions may allow the attacker to take assets later, even if nothing has been stolen yet.
- Disconnect the site from your wallet to end the current connection. This does not cancel any permissions you have already granted.
- Check the wallet’s full contents, including tokens and NFTs on every chain you use.
- If funds have been taken or you entered your recovery phrase, move anything of value that remains to a newly created wallet.
- Report the receiving address to your wallet provider and a public scam-reporting service. This may help providers identify the address and warn other users.
Be wary of anyone offering to recover stolen cryptocurrency for a fee. This is often a second scam aimed at the same victim.
A completed transfer cannot be reversed. The code we analyzed does not request or expose the wallet’s recovery phrase, so connecting to the site alone doesn’t compromise that phrase. If you entered it anywhere during the process, treat that as a separate compromise and move your remaining assets to a newly created wallet. Any permissions you granted remain active until you revoke them.
Remember
The lure has not changed since June. It’s still a promise to play GTA 6 before Rockstar releases it, and that promise is still impossible to keep.
What has changed is what sits behind it. One approach charged a price. Another stole passwords. This one asks for approval to access wallets using a tool built to be rented, reconfigured, and pointed at whatever people are excited about next.
GTA 6 is scheduled to arrive on November 19, 2026, through the same stores gamers already use. No unauthorized playable copy before launch should be treated as legitimate.
Indicators of compromise (IOCs)
Drainer infrastructure
centrodigestionedellarapina[.]lifedasunerforschtelandamendederwelt[.]sbs
Solana address used by the page’s inline transfer
21iWU6FJWJ9FKKz4Jek2CyTh2x1fqs5jawjrNgE3nHjN