Cybersecurity firm Malwarebytes has revealed a website impersonating a leaked GTA 6 download page is tricking users into connecting their crypto wallets, thereby stealing on-chain assets. The page falsely presents a game countdown and a “leaked version” download link, but secretly embeds wallet-stealing scripts targeting multiple blockchains.
Impersonating a game leak page
This type of page incorporates seemingly authentic GTA 6 information and lures visitors into making payments or connecting their wallets under the pretense of “early access” or “leaked versions.” Malwarebytes reports that two payment methods are presented on the page: one demanding $50 and another requiring payment of 1 SOL.
The operators also attempted to build credibility by reminding users that other leaked websites were scams. However, researchers still found multiple errors in the page content, including spelling mistakes and the incorrect reference to GTA IV instead of GTA VI.
Can simultaneously attack multiple blockchains
Malwarebytes stated that the malicious code primarily appears in the payment options section, containing two separate components:
- A suite designed for Solana wallets
- A suite of wallets compatible with Ethereum chains
Among these, Solana-related scripts calculate the transfer amount, leaving only a minimal balance in the victim’s account sufficient to cover the transaction fee. Another, larger set of scripts masquerades as a legitimate wallet connection tool but incorporates malicious functionality on top of the original code.
According to Malwarebytes, the latter can launch attacks against wallets on multiple networks, including:
- Ethereum
- Polygon
- BNB Smart Chain
- Avalanche, Arbitrum, Base, and Fantom
GTA 6 themes have been repeatedly used in crypto scams.
Malwarebytes has previously identified multiple scams exploiting the hype around GTA 6, including fake "early access" offers, counterfeit demo pages, and pages related to the "Extended Look." These websites typically blend genuine game information with fabricated transaction processes to lower user vigilance.
U.Today also noted that just a few days ago, another wave of crypto activity linked to the GTA VI leak was tracked by on-chain analytics firms, revealing fund movements. The report showed that a wallet associated with CYBERLEEK transferred approximately $350,000, though the identity of the operator remains undisclosed.
Such incidents demonstrate that popular games, airdrops, and exclusive content remain common disguises for crypto phishing. For users, any page requiring upfront payment, downloading, or connecting a wallet to claim “exclusive content” is a high-risk scenario.