Audit log

Every state-changing event for Fake GTA 6 Leak Wallet-Drainer Campaign: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-09 01:53:26Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 445,490,640

   sig

   eyZUA7pVcgtT…g67BtaZ6copyexplorer ↗

   hash

   4T3uKwCAPPss…PCMesw4Wcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (13397 B) ▸

   {"actor":"system:backfill","investigation_id":"d6eca0a0-8fdb-4965-ad1b-c4aa3394fab6","kind":"publish","page_slug":"fake-gta-6-leak-wallet-drainer-campaign","published_at":"2026-09-09T01:53:26.231Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Fake GTA 6 Leak Wallet-Drainer Campaign","sections":[{"content":"The campaign centers on a website styled as a fan-made GTA 6 countdown page, reusing genuine Rockstar Games promotional assets to appear legitimate. It invites visitors to buy an alleged leaked, playable copy of the game for $50 or 1 SOL. Grand Theft Auto VI's publisher, Take-Two Interactive, and developer Rockstar Games have publicly and repeatedly confirmed a retail launch date of November 19, 2026, most recently reaffirmed in Take-Two's August 2026 financial disclosures. Because the game has not been released, no legitimate 'leaked' or purchasable pre-release copy can exist; any site offering one is, by definition, fraudulent. Rockstar Games and Take-Two are the impersonated brand in this campaign and bear no responsibility for the scam.","heading":"Nature of the scam and why any 'leaked copy' offer is fake","severity":"high","sources":[{"credibility":2,"name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet"},{"credibility":1,"name":"Grand Theft Auto 6 Release Date And Everything Confirmed — Forbes","type":"news_article","url":"https://www.forbes.com/sites/brianmazique/2026/05/12/grand-theft-auto-6-release-date-and-everything-confirmed/"}]},{"content":"Malwarebytes researchers identified inline code in the site's payment section built specifically to target Solana wallets. According to the report, the code disregards the advertised $50/1 SOL price entirely: on wallet connection it reads the victim's balance, calculates an amount to reserve for network fees, and prepares the remainder of the balance for transfer to an attacker-controlled address. The advertised price functions only as bait to get a wallet connected — it does not cap the potential loss, and a victim who approves the resulting transaction can lose their full spendable balance minus dust.","heading":"Solana-specific drainer mechanism","severity":"critical","sources":[{"credibility":2,"name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet"},{"credibility":2,"name":"Dangerous Fake GTA 6 Leak Site Drains Crypto Wallets 2026 — TronWeekly","type":"news_article","url":"https://www.tronweekly.com/fake-gta-6-leak-site-drains-sol-eth-wallets/"}]},{"content":"Alongside the Solana-specific code, the site loads a separate, larger drainer script (reported by Malwarebytes at roughly 2.4 MB) described as a rented wallet-draining tool covering Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base and Fantom. This component is reported to profile a connected wallet's holdings — including recognizing major stablecoins and NFT collections — before prompting for token or collection 'approvals' that, once granted, let the operators pull assets out. Reporting indicates the drainer retrieves operator identifiers and configuration from a remote server at runtime, which allows the operators to redirect where stolen funds are sent without modifying the visible front-end of the site, and that the tooling includes measures intended to evade automated security scanners. Because these details concern how a live drainer evades detection and reroutes funds, this dossier does not reproduce the underlying code, configuration values, or domains it fetches from beyond what defenders need to recognize the pattern.","heading":"Multi-chain EVM drainer and remote operator infrastructure","severity":"critical","sources":[{"credibility":2,"name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet"},{"credibility":2,"name":"Dangerous Fake GTA 6 Leak Site Drains Crypto Wallets 2026 — TronWeekly","type":"news_article","url":"https://www.tronweekly.com/fake-gta-6-leak-site-drains-sol-eth-wallets/"}]},{"content":"Multiple outlets covering this campaign identified concrete red flags visible before any wallet interaction: (1) a wallet-connect prompt appearing on what claims to be a game storefront or fan page — legitimate game purchases never require connecting a crypto wallet or approving token allowances; (2) internal contradictions on the site itself, including a footer statement that the site does not process purchases sitting alongside an active payment flow, and marketing copy claiming a PC download despite console-only claims elsewhere on the page; (3) sloppy or inconsistent copy, including a reported reference to 'GTA IV' rather than 'GTA VI' and misspellings around the word 'download'; (4) any transaction request that asks to transfer 'all or nearly all' of a wallet's balance rather than a fixed, bounded amount; and (5) any prompt to 'approve,' 'allow,' or 'grant access' to tokens or NFT collections rather than a simple, itemized payment. Independently, the fact that GTA 6 has not yet shipped (confirmed launch November 19, 2026) means the entire premise — a purchasable leaked copy — is itself the clearest warning sign.","heading":"Warning signs a user can recognize before connecting a wallet","severity":"high","sources":[{"credibility":2,"name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet"},{"credibility":2,"name":"Dangerous Fake GTA 6 Leak Site Drains Crypto Wallets 2026 — TronWeekly","type":"news_article","url":"https://www.tronweekly.com/fake-gta-6-leak-site-drains-sol-eth-wallets/"}]},{"content":"Malwarebytes' advisory recommends that anyone who connected a wallet to the site, or approved any transaction or token/NFT allowance through it, should immediately: revoke the granted permissions using a wallet-approval-checking tool for the relevant chain(s); disconnect the wallet from the site; review balances and transaction history across all chains the wallet touches, not only the one used to visit the site, since a connected wallet can expose activity across multiple networks; and, if compromise is confirmed or suspected, move any remaining assets to a newly generated wallet with a fresh seed phrase rather than continuing to use the exposed one. The advisory also explicitly warns against paying any third party for 'fund recovery' services, which are commonly a secondary scam targeting drainer victims.","heading":"What to do if you already connected a wallet or approved a transaction","severity":"high","sources":[{"credibility":2,"name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet"}]},{"content":"This wallet-drainer site is part of a broader, ongoing wave of fraudulent sites exploiting anticipation for GTA 6's release. Malwarebytes separately reported in August 2026 on fake sites impersonating GTA 6's 'Extended Look' gameplay reveal and a fake demo download that delivered an infostealer rather than a wallet drainer. This is reported as a distinct campaign using different malware (credential/data theft rather than direct wallet draining), but it indicates that GTA 6 hype is being actively exploited across multiple, separate malicious campaigns and that new imitators should be expected as the November 19, 2026 launch approaches.","heading":"Related pattern: broader wave of fake GTA 6 sites","severity":"medium","sources":[{"credibility":2,"name":"Fake GTA 6 Extended Look and demo sites deliver an infostealer — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer"}]},{"content":"Malwarebytes' September 1, 2026 report identifies the phishing infrastructure by domain names including centrodigestionedellarapina[.]life and dasunerforschtelandamendederwelt[.]sbs. As of this investigation on September 9, 2026, direct automated attempts to load the primary reported domain returned an HTTP 403 (forbidden) response rather than the drainer page or a clear takedown notice; this is consistent with, but does not confirm, either an active anti-bot/anti-scanner block (a behavior the original report says the drainer's infrastructure is designed to include) or a takedown or geofencing action by a host or registrar. No source located in this investigation confirms the site has been formally taken down, and no source confirms it remains actively serving the drainer to ordinary visitors. Readers should treat the campaign as an active threat absent a confirmed takedown notice from a security vendor or registrar.","heading":"Current status of the phishing site (checked September 9, 2026)","severity":"medium","sources":[{"credibility":2,"name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet"}]}],"sources_used":[{"credibility":2,"name":"Fake GTA 6 leaked copy drains your crypto wallet — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet"},{"credibility":2,"name":"Dangerous Fake GTA 6 Leak Site Drains Crypto Wallets 2026 — TronWeekly","type":"news_article","url":"https://www.tronweekly.com/fake-gta-6-leak-site-drains-sol-eth-wallets/"},{"credibility":2,"name":"Fake GTA 6 Extended Look and demo sites deliver an infostealer — Malwarebytes","type":"research","url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer"},{"credibility":1,"name":"Grand Theft Auto 6 Release Date And Everything Confirmed — Forbes","type":"news_article","url":"https://www.forbes.com/sites/brianmazique/2026/05/12/grand-theft-auto-6-release-date-and-everything-confirmed/"}],"summary":"A live phishing campaign, first documented by Malwarebytes on September 1, 2026, impersonates a fan countdown site for Rockstar Games' Grand Theft Auto VI and offers a 'leaked' pre-release copy for $50 or 1 SOL. Behind the payment flow, the site runs two malicious wallet-drainer scripts — one built specifically for Solana and a separate multi-chain tool covering Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base and Fantom — that empty a connecting wallet down to fee-covering dust once a user approves a transaction. Rockstar Games and its parent Take-Two are impersonated brands and are not implicated in any wrongdoing; GTA 6's confirmed retail launch is November 19, 2026, meaning any offer of a playable 'leaked copy' before that date is fraudulent by definition.","timeline":[{"date":"2026-08","event":"Malwarebytes separately reports a distinct wave of fake GTA 6 'Extended Look' and demo sites delivering an infostealer, an earlier and different campaign exploiting the same GTA 6 hype.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer"},{"date":"2026-09-01","date_evidence":"Malwarebytes blog post dated September 1, 2026 (URL path /2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet), reporting the site 'examined this week'","event":"Malwarebytes publishes research identifying a fake GTA 6 leak site running Solana-specific and multi-chain EVM wallet-drainer scripts, disguised as a fan countdown page offering a 'leaked copy' for $50 or 1 SOL.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet"},{"date":"2026-09","event":"Crypto and tech outlets including TronWeekly, U.Today, CoinoTag and CoinGabbar republish and expand on the Malwarebytes findings, confirming the multi-chain scope (Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, Fantom) and cataloguing additional red flags on the site.","source":"TronWeekly","source_url":"https://www.tronweekly.com/fake-gta-6-leak-site-drains-sol-eth-wallets/"},{"date":"2026-09","date_original":"2026-09-09","event":"AVOID.NET investigation attempts to verify whether the reported phishing domain is still live; automated access attempts return an HTTP 403 response, an inconclusive result that neither confirms the site is down nor that it is actively serving the drainer.","source":"AVOID.NET investigation","source_url":"https://www.malwarebytes.com/blog/scams/2026/09/fake-gta-6-leaked-copy-drains-your-crypto-wallet"},{"date":"2026-11","date_original":"2026-11-19","event":"Confirmed retail launch date for Grand Theft Auto VI, per Take-Two Interactive and Rockstar Games' public statements — the benchmark against which any pre-release 'leaked copy' offer can be judged fraudulent.","source":"Forbes","source_url":"https://www.forbes.com/sites/brianmazique/2026/05/12/grand-theft-auto-6-release-date-and-everything-confirmed/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5a0fcc66-3070-4cc1-96bd-de9b20a7faf1copy