Malwarebytes has identified a deceptive website promising early access to GTA 6. This portal uses malicious code to empty digital wallets across several different blockchain networks.
The eight blockchain networks targeted by the drainer
According to Malwarebytes, the fraudulent site employs a sophisticated wallet drainer capable of stealing assets from eight distinct networks: Solana, Ethereum, Polygon, BNB Smart Chain, Avalanche , Arbitrum, Base, and Fantom. The attack is not a one-size-fits-all script; rather, it uses specialized components to maximize the theft from each specific ecosystem.
One specific piece of malicious code is dedicated solely to Solana wallets. As Malwarebytes reported, this script is designed to calculate a transfer that strips the wallet of nearly all its assets, leaving behind only the minimum amount of funds required to cover the transaction fees. This ensures the theft is completed without the transaction failing due to insufficient gas.
A second, more expansive script handles the other seven blockchains. This component masquerades as a standard wallet-connection tool , a common interface in the Web3 space, but contains hidden malicious code that triggers the drain once a user approves a transaction.
The $50 price tag and the GTA IV contradiction
The scammers attempt to build a veneer of legitimacy by mixing genuine promotional materials for Rockstar Games with fraudulent offrs. The site correctly identifies that GTA 6 is slated for PlayStation 5 and Xbox Series X|S, yet it contradicts itself by offering a PC download in its FAQ section—despite the fact that Rockstar Games has not announced a PC version of the title.
To lure victims, the site presents two primary options for obtaining the alleged leak: one requesting a flat fee of $50 and another requiring a cryptocurrency payment. This tiered approach targets different levels of user skepticism, attempting to make the "purchase" seem like a standard digital transaction .
Further scrutiny reveals sloppy execution in the site's copy.. Malwarebytes noted that the page contains blatant misspellings regarding the download process and, in a particularly jarring error, refers to GTA IV instead of GTA VI. These inconsistencies suggest that while the technical drainer is sophisticated, the social engineering side of the operation is rushed.
The $350,000 CYBERLEEK movement
This scam exists within a broader, more dangeerous economy of "leak portals" where anticipation for high-profile software is monetized. This pattern echoes the activities of a mysterious figure linked to previous GTA VI leaks, who has recently been the subject of blockchain analysis.
According to the report, this unidentified individual reportedly moved approximately $350,000 out of an operation known as CYBERLEEK. The movement of these funds highlights the significant financial incentives driving the creation of fake leak sites and the professionalization of the "leaker" persona to manipulate community trust.
Who is the unidentified operator of the CYBERLEEK operation?
Despite the blockchain analysis tracking the $350,000 transfer , the actual identity of the person behind the CYBERLEEK operation remains unknown. it is currently unclear if the operators of the fake GTA 6 download site are the same individuals behind the broader leak economy or simply opportunistic copycats.
Furthermore, the total number of victims who have connected their wallets to this specific drainer has not been disclosed. Because the site targets eight different blockchains, the full scale of the financial loss may be spread across multiple ledgers, making a comprehensive tally difficult without further forensic data.
Comments 0