GTA 6 Fake Leak Site Allegedly Drains Wallet Assets
Cybersecurity company Malwarebytes reports that a website is disguising itself as a countdown and "leaked version" sales page for GTA 6, priced at $50 or 1 SOL, luring visitors to connect their crypto wallets and approve malicious transactions.
The official game release date is set for November 19 on PlayStation 5 and Xbox Series, with no announcement for a PC version yet. The page mixes real release information and claims that other leak sites are scams. Analysis indicates that the site contains two sets of code: one targeting Solana wallets, which does not consider the price and prepares to transfer most funds while leaving a small fee; the other is a script of about 2.4MB that can enumerate assets and stablecoins on Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base, Fantom, etc., returning to the operator and prompting pending approval transactions. Simply connecting a wallet is usually not enough; the danger lies in subsequent transfers or token authorizations. The script checks the source of access before triggering and avoids certain countries. Malwarebytes recommends rejecting any site selling GTA 6 leaked versions, verifying authorizations before approval, and refusing requests to transfer the entire balance or unlimited token permissions.
The price is bait, with the loss limit being the assets that can be authorized in the wallet. Various GTA 6-themed scams have emerged this year. Misspellings and contradictions regarding the PC version are identification points.
Demand for piracy has been rewritten as authorization phishing. The "authorization" on the wallet pop-up is more expensive than "paying $50".
In market mechanics, the buyer is a visitor wanting to play the game early, while the seller is the scammer deploying wallet-draining scripts. The driving force is the major game release schedule and leak rumors, constituting a criminal event. Stolen assets are immediately exchanged and laundered. Beneficiaries are companies selling security software and on-chain monitoring, while the pressured party is retail wallet users accustomed to one-click authorizations in browsers.
Source: Public Information
ABAB AI Insight
The release schedule for GTA 6 itself is a traffic driver. What Malwarebytes sees is not a sale, but a reason to connect wallets disguised as "buying a leak." $50 and 1 SOL are just psychological anchors; the script calculates based on balance, and the authorization scope is the bill. Seven EVM chains plus Solana indicate a front-end standard for multiple wallets. Geographic filtering reduces noise for analysts and law enforcement jurisdictions but does not lessen the impact on target users. The official site has no PC version, yet the FAQ promises PC downloads, which is contradictory but still attracts clicks. Authorizing unlimited tokens is more enduring than a single transfer.
The capital path is immediate conversion of stolen funds. Scammers buy domain names and scripts, selling the victim's authorization. The motivation is to lower the reading of transaction pop-ups by exploiting entertainment desires; the strategy is to first intimidate with "other sites are scams" and then demand connection. Security vendors exchange reports for subscriptions, and on-chain analysis feeds stolen addresses into their products.
Comparable objects include fake Steam keys, fake airdrop rewards, and NFT minting pages that drain upon approval. Major game cycles repeatedly exhibit the same template. The phase shifts from piracy CD scams to signature authorization scams.
This is a technical replacement. What is replaced is traditional piracy card issuance. The mechanism is that browser wallets turn "payment" and "giving up asset control" into the same type of pop-up. Users think they are buying a game, but they are actually signing permissions. The educational cost is higher than the cost of copying the script.
ABAB News · Cognitive Law
When priced at $50, the bill could be the entire wallet.
Connecting is not enough; the real loss is written in the next authorization.
The more it resembles the official release schedule, the less one should pay in the browser.