A page dressed up as a Grand Theft Auto VI fan countdown is selling a leaked copy of the game for 1 SOL, worth about $102 when researchers looked, and running code that tries to empty whatever cryptocurrency wallet the visitor connects. The advertised price has nothing to do with what the page actually takes.
Malwarebytes examined the site and places it as the third distinct GTA 6 scam it has tracked this year. In June, sites sold early access for hundreds of dollars in crypto and delivered nothing. In August, fake demo pages delivered an infostealer. This one asks for a wallet. Their full analysis is here.
The accurate half is the bait
Most of the page is correct: a live countdown to November 19, a map of Leonida, and release facts that match Rockstar's own announcements, PlayStation 5 and Xbox Series X|S with no PC version announced. Two purchase offers sit inside that accurate material, alongside a claim that every other site selling leaked material is a scam and this is the only safe place to buy, a standard way of reassuring somebody who is already suspicious. The footer, directly beneath the two payment buttons, states that the page offers no purchase, download or payment of any kind.
The price on the button is fiction
There are two pieces of code. The first is written into the page and handles Solana. It never charges the advertised price: it reads the wallet's balance, sets aside just enough for the transaction fee, and prepares to move everything else.
The second is a separate script of about 2.4 MB. Wrapped around a legitimate, widely used library for connecting websites to wallets is malicious code that inventories the connected wallet, works out what its holdings are worth, reports that to the operator, and fetches transactions for the victim to approve. It covers seven networks, Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base and Fantom. Depending on what the victim signs, it can move funds immediately or take a standing permission to move tokens and entire NFT collections later.
It profiles before it prompts, sending the operator the wallet's estimated dollar value, its tokens and NFTs, the visitor's IP address and country, and how many times that wallet has connected before. One setting, named CIS_Protection, turns away visitors in Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan and Uzbekistan. Excluding that group is a long-standing convention in criminal tooling, usually read as avoiding local law enforcement, and Malwarebytes is explicit that a country list alone settles nothing about who is behind this.
The Solana address hard-coded into the page appears nowhere in the larger script, which instead pulls an operator ID and its settings from a remote server that also prepares the transactions victims are shown. Malwarebytes says this resembles a hosted service with multiple customers, while noting they cannot identify the product.
The approval screen is the last line
Connecting a wallet does not by itself let a site take anything. The moment that matters is the approval prompt. Phantom, for one, simulates each transaction before you sign and shows a plain-language preview, and other reputable wallets do the same. None of that helps if the prompt is approved unread. Reject any transaction that moves all or nearly all of your balance instead of the price you expected to pay, and reject any request to approve or grant access to your tokens or NFTs, because a shop selling a video game has no reason to want ongoing access to your assets. If you already connected, revoke the site's permissions, disconnect it, and move anything of value to a new wallet.
Malwarebytes published the drainer domains centrodigestionedellarapina[.]life and dasunerforschtelandamendederwelt[.]sbs, plus the Solana address 21iWU6FJWJ9FKKz4Jek2CyTh2x1fqs5jawjrNgE3nHjN used by the page's inline transfer.
Nobody has a playable copy of GTA 6 to sell, and nobody will until Rockstar ships it on November 19. The lure is the least interesting part. A rented drainer that can be repointed from a server has no attachment to Grand Theft Auto: kits like it turned up last month behind fake wallet safety checks, and one will be waiting behind whatever people are excited about next.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.