A website claiming to sell a leaked PC copy of Grand Theft Auto VI for $50 is actually loaded with code designed to target visitors’ cryptocurrency wallets, according to security researchers.
The site presents itself as a polished GTA 6 fan page, complete with a countdown to launch, a map of the game’s fictional state of Leonida and accurate-looking release information. Buried among that legitimate material is an offer to buy a supposedly leaked copy of the unreleased game.
PCMag reported that cybersecurity firm Malwarebytes found the page offering the supposed game for either $50 or 1 SOL, which was worth roughly $102 when researchers examined it.
There is a fundamental problem with the offer. Rockstar Games has not announced a PC version of GTA 6. The game is officially scheduled to launch Nov. 19, 2026, on PlayStation 5 and Xbox Series X|S.
The Site Looks Like a Legitimate GTA 6 Fan Page
Malwarebytes said much of the website looks convincing because it mixes the fraudulent sales pitch with accurate information about the game.
Visitors see the correct Nov. 19 release date, a map of Leonida, gameplay information and a live countdown. The page even warns visitors that other sites selling leaked GTA 6 material are scams while presenting itself as the safe alternative.
Researchers believe the legitimate-looking portions may have come from an existing fan-site template, with the fraudulent sales material added afterward.
The Crypto Payment Option Loads a Wallet Drainer
Malwarebytes found that the page loads wallet-draining code as soon as a visitor arrives. Choosing the cryptocurrency payment option then prompts the visitor to connect a wallet.
One piece of code specifically targets Solana wallets. Researchers say it checks the wallet balance, leaves only a small amount for transaction fees and prepares to transfer the remainder to an attacker-controlled address.
A second, more capable script can inspect connected wallets across Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base and Fantom. It calculates the value of cryptocurrency, tokens and NFTs in the wallet and reports information about those assets to the operator.
The theft depends on a victim connecting a wallet and approving the malicious transaction or permission request. Depending on what is authorized, attackers could take assets immediately or obtain approval that allows certain tokens or NFTs to be transferred later.
The Site Gives Away Its Own Scam
Several contradictions provide clues that the offer is fraudulent. The site’s own information grid correctly describes GTA 6 as console-only, while its FAQ promises buyers a PC download. Its footer says the page does not offer purchases, downloads or payments even though payment buttons appear on the site.
Researchers also found errors in the fraudulent sales copy, including a misspelling of “download” and a reference to GTA IV instead of GTA VI..
Rockstar Has Not Announced a PC Version
Rockstar Games currently lists GTA 6 for PlayStation 5 and Xbox Series X|S with a Nov. 19 release date. Windows is not listed as a supported platform.
Rockstar opened official preorders June 25. Its support page identifies the Rockstar Store, PlayStation Store and Xbox Store among the legitimate places where customers can preorder the game. Rockstar says digital versions can begin preloading Nov. 12 ahead of the Nov. 19 launch.
Fake GTA 6 Offers Have Already Delivered Other Malware
The wallet drainer is part of a broader series of scams exploiting anticipation for GTA 6. In June, Malwarebytes investigated sites selling supposed early access for hundreds of dollars in cryptocurrency. Victims were instructed to make irreversible crypto payments but received no game.
In August, researchers found fake GTA 6 demo and “Extended Look” websites that delivered an information-stealing program instead. That malware targeted saved passwords, browser cookies and authenticated sessions rather than cryptocurrency alone.
What to Do Before Connecting a Crypto Wallet to a Website
A request to connect a cryptocurrency wallet should be treated as a request for access, not simply as another version of entering a credit card number. Before approving anything, read the wallet prompt closely. A transaction asking to transfer most of a balance or an approval granting a website continuing authority over tokens or NFTs is very different from authorizing a fixed purchase price.
Never connect a wallet to obtain a leaked game, unofficial demo or early-access copy that the publisher itself does not offer. For GTA 6, check Rockstar’s official site before trusting any download or purchase claim.
If a suspicious site has already been connected to a wallet, review recent transactions and active token or NFT approvals immediately. Malicious approvals can sometimes remain usable even after the website has been closed, so simply disconnecting the wallet from the page may not revoke permissions already granted.
Anyone who approved a suspicious transfer should move quickly to protect remaining assets and contact the wallet provider or cryptocurrency platform they use for guidance. Keep the website address, wallet addresses, transaction hashes and screenshots of approval requests as evidence.
The Federal Trade Commission warns that cryptocurrency transactions can be difficult or impossible to reverse once funds are transferred. Suspected crypto scams can also be reported through ReportFraud.ftc.gov.