{"investigation":{"slug":"fake-gta-6-crypto-wallet-drainer-sites","entity_name":"Fake GTA 6 Crypto Wallet Drainer Sites","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.75,"status":"draft","content_type":"investigation","summary":"Security researchers at Malwarebytes identified phishing websites posing as GTA 6 fan countdown pages and \"leaked copy\" sale sites that deploy wallet-draining code against visitors who connect a crypto wallet to pay. The infrastructure includes a Solana-specific drainer and a separate script targeting seven EVM-compatible chains, with evidence pointing to a rented drainer-as-a-service backend and geofencing of CIS-country visitors. This is a confirmed active phishing/scam operation, not a legitimate entity, and it warrants the lowest possible trust rating.","sections":[{"content":"Malwarebytes reported that a website presenting itself as a Grand Theft Auto 6 fan countdown page also advertises the sale of an alleged \"leaked copy\" of the unreleased Rockstar Games title, for $50 or 1 SOL. The page reproduces accurate, publicly known release details — including a countdown to the game's announced November 19 release date on PlayStation 5 and Xbox Series X|S — to appear credible, alongside a live countdown timer, a map graphic, and gameplay-fact tiles. Rockstar Games has not announced or released GTA 6 for PC, and Malwarebytes noted the site's own footer contradicts its sales pitch, stating that the page offers no purchase, download, or payment of any kind directly beneath two payment buttons. The sales copy also contains a misspelled word ('download') and mistakenly references 'GTA IV' rather than 'GTA VI', inconsistencies Malwarebytes cited as red flags.","heading":"Nature of the Site and Deceptive Presentation","sources":[{"url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet","name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","credibility":2}],"severity":"high"},{"content":"According to Malwarebytes, the site loads wallet-draining code as soon as a visitor arrives, before any purchase is completed. Choosing the cryptocurrency payment option prompts the visitor to connect a wallet. One component, written directly into the page, targets Solana wallets: rather than charging the advertised 1 SOL, it checks the wallet's balance, leaves a small amount to cover transaction fees, and prepares to transfer the remainder to the attacker. A second, larger script poses as a legitimate wallet-connection tool but is capable of targeting wallets across seven additional networks: Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom. Malwarebytes reported that this script profiles a connected wallet's holdings (tokens, NFTs, estimated dollar value) and can either execute an immediate transfer or obtain approval permissions enabling later theft.","heading":"Dual-Chain Wallet Drainer Mechanism","sources":[{"url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet","name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","credibility":2},{"url":"https://www.tradingview.com/news/u_today:603137203094b:0-fake-gta-6-leak-site-targets-crypto-wallets-with-malicious-drainer/","name":"Fake GTA 6 Leak Site Targets Crypto Wallets With Malicious Drainer — U.Today (via TradingView)","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Malwarebytes stated that several details suggest the drainer is rented rather than homemade: the script downloads an operator ID and configuration settings from a remote server at runtime, which reportedly allows the destination wallet for stolen funds to be changed without modifying the phishing site's front-end code — a pattern consistent with a hosted \"drainer-as-a-service\" model used by multiple customers rather than a single bespoke build. Malwarebytes also reported that the code contains a feature named \"CIS_Protection\" that checks a visitor's IP address against a list of Commonwealth of Independent States countries — reported as Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan, and Uzbekistan — and redirects matching visitors to a blank page. Excluding this set of countries is a pattern that has been observed in other criminal tooling and is generally interpreted as an attempt to avoid drawing local law-enforcement attention, though Malwarebytes did not attribute the operation to a specific individual or group.","heading":"Alleged Drainer-as-a-Service Backend and Geofencing","sources":[{"url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet","name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","credibility":2}],"severity":"high"},{"content":"Malwarebytes identified two domains associated with the scheme: centrodigestionedellarapina[.]life and dasunerforschtelandamendederwelt[.]sbs, and published a Solana wallet address (21iWU6FJWJ9FKKz4Jek2CyTh2x1fqs5jawjrNgE3nHjN) linked to the scam. Malwarebytes advised users to reject wallet connection requests on unofficial game-related sites, to scrutinize transaction approval screens before signing, and noted that no legitimate playable copy of GTA 6 exists as of the report. This section's claims rest on a single primary technical source (Malwarebytes); secondary crypto-news outlets (Tronweekly, U.Today, COINOTAG, and others) republished the same findings without independent on-chain verification of drained-fund totals or victim counts, so scale of financial loss remains unconfirmed.","heading":"Identified Infrastructure and Wallet Addresses","sources":[{"url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet","name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","credibility":2},{"url":"https://en.coinotag.com/fake-gta-6-leak-site-drains-crypto-wallets-1-sol","name":"Fake GTA 6 Leak Site Demands 1 SOL to Drain Multi-Chain Crypto Wallets — COINOTAG","type":"news_article","credibility":3},{"url":"https://www.tronweekly.com/fake-gta-6-leak-site-drains-sol-eth-wallets/","name":"Dangerous Fake GTA 6 Leak Site Drains Crypto Wallets 2026 — Tronweekly","type":"news_article","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2026-09-01","event":"Malwarebytes published research documenting the fake GTA 6 leak site, its dual-chain wallet drainer (Solana plus seven EVM networks), the rented drainer-as-a-service backend, and CIS-country IP filtering.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet","date_evidence":"By Stefan Dasic | September 1, 2026"},{"date":"2026-09","event":"Crypto-focused news outlets (U.Today, Tronweekly, COINOTAG, and others) republished and summarized the Malwarebytes findings, extending coverage of the scam to a broader crypto audience.","source":"U.Today / Tronweekly / COINOTAG","source_url":"https://u.today/fake-gta-6-leak-site-targets-crypto-wallets-with-malicious-drainer"}],"sources_used":[{"url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet","name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","archive_url":"http://web.archive.org/web/20260918114951/https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet","credibility":2,"archive_timestamp":"2026-09-18T11:49:51+00:00"},{"url":"https://www.tradingview.com/news/u_today:603137203094b:0-fake-gta-6-leak-site-targets-crypto-wallets-with-malicious-drainer/","name":"Fake GTA 6 Leak Site Targets Crypto Wallets With Malicious Drainer — U.Today (via TradingView)","type":"news_article","archive_url":"https://web.archive.org/web/20260919125824/https://www.tradingview.com/news/u_today:603137203094b:0-fake-gta-6-leak-site-targets-crypto-wallets-with-malicious-drainer/","credibility":2,"archive_timestamp":"2026-09-19T12:58:24+00:00"},{"url":"https://u.today/fake-gta-6-leak-site-targets-crypto-wallets-with-malicious-drainer","name":"Fake GTA 6 Leak Site Targets Crypto Wallets With Malicious Drainer — U.Today","type":"news_article","archive_url":"https://web.archive.org/web/20260919170653/https://u.today/xrp-treasury-firm-lands-30-million-raise-to-buy-more-xrp","credibility":3,"archive_timestamp":"2026-09-19T17:06:53+00:00"},{"url":"https://www.tronweekly.com/fake-gta-6-leak-site-drains-sol-eth-wallets/","name":"Dangerous Fake GTA 6 Leak Site Drains Crypto Wallets 2026 — Tronweekly","type":"news_article","archive_url":"http://web.archive.org/web/20260911015207/https://www.tronweekly.com/fake-gta-6-leak-site-drains-sol-eth-wallets/","credibility":3,"archive_timestamp":"2026-09-11T01:52:07+00:00"},{"url":"https://en.coinotag.com/fake-gta-6-leak-site-drains-crypto-wallets-1-sol","name":"Fake GTA 6 Leak Site Demands 1 SOL to Drain Multi-Chain Crypto Wallets — COINOTAG","type":"news_article","archive_url":"https://web.archive.org/web/20260919140930/https://en.coinotag.com/fake-gta-6-leak-site-drains-crypto-wallets-1-sol","credibility":3,"archive_timestamp":"2026-09-19T14:09:30+00:00"},{"url":"https://tech.yahoo.com/cybersecurity/articles/scam-offered-gta-6-pc-235048010.html","name":"A Scam Site Offered GTA 6 for PC for $50. Researchers Say Connecting a Crypto Wallet Could Drain It — Yahoo Tech","type":"news_article","archive_url":"https://web.archive.org/web/20260919125436/https://tech.yahoo.com/cybersecurity/articles/scam-offered-gta-6-pc-235048010.html","credibility":2,"archive_timestamp":"2026-09-19T12:54:36+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-19T12:20:15.829484+00:00","updated_at":"2026-09-19T17:12:57.775016+00:00"}}