CRYPTO WALLET DRAINERS - FAKE GAME DOWNLOADS

Is that GTA 6 leaked download real? The "1 SOL" button on one fan site is written to take everything in your wallet.

GTA 6 is due on 19 November 2026, and pages selling an early "leaked" copy are already waiting for the searches. We read the code behind one of them, latestgta6.com, and followed its drainer file to twelve more scam sites.

SB

SafeBrowz Threat Research Security Research · 13 November 2026 · 8 min read

A countdown site with a checkout it should not have

On first look, latestgta6.com is a tidy fan page. It has a countdown to 19 November, a concept map of Leonida with Vice City, Port Gellhorn and the Leonida Keys, a "Systems to watch" section and a sign-up box for alerts. It even warns that the sites cashing in on "free GTA 6" searches are fake: "None of them are real."

Then come two buttons that do not belong on a fan page: BUY NOW FOR 50$ and OR BUY FOR 1 SOL. The domain was registered on 24 August 2026, sits behind Cloudflare, and was still live when we checked it on 13 November.

The site argues with itself, and that is the quickest way to catch it. Its own "confirmed facts" box says GTA 6 is "console-only at launch" with "no confirmed PC date yet". A few screens down, the page's own FAQ answers "Will GTA 6 come to PC?" with "Yes, you can download it to PC after the purchase", and "Can I buy GTA 6 right now?" with "Yes. It for sale now, Just for 50$ leaked game." The leak warning is part of the pitch too: the same box that says "None of them are real" ends with "The only way to eventually buy GTA 6 is this website." Warning you about scams is how this one earns your trust.

Malwarebytes wrote up a site matching this description on 1 September 2026, and the Solana address in its indicators is the same one we found in this page's code. Two months on, the page is still up, which is why it is worth knowing exactly what the button does.

The 1 SOL button, read line by line

The "OR BUY FOR 1 SOL" button runs a short script in the page itself. We read it from the page source rather than clicking it. In plain terms it does five things:

1. Checks that a Phantom wallet is installed, and tells you to install one if not.
2. Asks the wallet to connect, which hands the page your public address.
3. Asks a Solana node for your balance.
4. Works out the amount to send as your balance minus 0.005 SOL, the part it leaves so the network fee can be paid.
5. Builds one transfer of that amount to a fixed address, 21iWU6FJWJ9FKKz4Jek2CyTh2x1fqs5jawjrNgE3nHjN, and asks your wallet to sign and send it.

The heart of it is two lines from the page's own source, shown here for reference:

const feeReserveLamports = 5_000_000; // 0.005 SOL in lamports
const transferLamports = balanceLamports - feeReserveLamports;

Nothing in that calculation uses 1 SOL. The label on the button is the only place the price exists. If you hold 1.2 SOL, the request is for 1.195 SOL. If you hold 25 SOL, it is for 24.995 SOL. The only defence left at that point is the wallet's own confirmation screen, which shows the real amount. Malwarebytes gives the same advice: reject any transaction that would move all or nearly all of your balance instead of the price you expected to pay.

A Solana transfer like this is not an approval you can revoke later. Once it is signed and sent, the SOL has left your wallet.

The same drainer file on twelve other sites

The 1 SOL button is the crude part. The page also loads a 2.4 MB script from a path ending in files/lucifer.v8.js. It is a wallet kit built on Reown AppKit and WalletConnect that supports many chains, and its code carries the approval calls a drainer needs, such as permit and setApprovalForAll. Malwarebytes describes a drainer on the page that loads its settings from the operator's server, reports to the attacker, and targets Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base and Fantom. Lucifer is also the name of the drainer-as-a-service operation that Flare researched earlier this year, which we covered in our Lucifer drainer kit report. We have not confirmed that this file comes from that same operation, so treat the shared name as a lead, not a link.

A file name is a fingerprint. Searching urlscan.io for that file name turned up the same script on twelve more domains, scanned between 14 October and 13 November 2026. Eight of them still served it when we checked on 13 November. Three now sit behind a Cloudflare challenge page and one has gone offline. The GTA 6 shop is one costume. The others are:

• wazirxkyc[.]com, a WazirX "Re-KYC Verification" page with a "Verify linked wallet" button
• irscrypto[.]info, titled "Crypto Wallet Checker", which puts an "Official IRS Website" link next to a "VERIFY WALLET" button
• limpidwallet[.]com, a free "AML check" for your wallet, and nodiwallet[.]xyz, a crypto trading platform
• allbridge-core[.]pages[.]dev and waterx-app[.]pages[.]dev, using the names of the Allbridge Core bridge and the WaterX trading app on a free hosting service
• realfinancedrop[.]buzz, an "INK Community Airdrop" eligibility check, and reward-hubs[.]org, a "KuCoin Airdrop+" bonus page
• airdropradar[.]club and spacetrixairdrop[.]xyz, airdrop sites now behind a challenge page
• app-kamiral[.]online and blueguradian[.]com

Different brands, same back end: a game launch, an exchange "re-KYC", a tax agency, an AML check and an airdrop all end at the same wallet prompt. That is how a drainer kit works. One file is written once and dressed up for whatever people are searching for that week, and this week many of them are searching for GTA 6.

What the real GTA 6 launch looks like

Rockstar's official page at rockstargames.com lists Grand Theft Auto VI for 19 November 2026 on PlayStation 5 and Xbox Series X|S. There is no PC date. You buy it through the PlayStation Store, the Microsoft Store or a normal retailer, and you pay in your local currency. Malwarebytes puts it bluntly: Rockstar does not ask buyers to connect a cryptocurrency wallet or send crypto to a wallet address.

So any of these, before or after launch day, is a scam: a "leaked" or "early" copy, a free PC download, a crack, or any purchase paid from a crypto wallet. The same applies to the "beta access" and "pre-release key" offers that tend to show up around big launches. We saw the same pattern this month with fake iPhone Duo preorder pages that opened before the real preorders did.

Red flags on any GTA 6 download offer

• It sells or gives away a copy of a game that is not out yet, or a PC version that has not been announced.
• It accepts crypto, or asks you to connect a wallet, to pay for a game.
• The price is fixed in SOL or ETH rather than in your currency.
• It warns you about leak scams while selling a leak.
• The domain is a few months old and is not rockstargames.com or a store you already know.
• The wallet's confirmation screen shows a bigger amount than the button promised. Stop there and reject it.

If you clicked, connected or paid

1. Opened the page but did not connect anything: close it. Visiting is not what drains a wallet. Signing is.
2. Sent SOL through the buy button: the transfer cannot be reversed. Note the transaction signature from your wallet history and report it (step 5).
3. Connected an Ethereum-style wallet and signed something: check what you approved with revoke.cash and revoke anything you do not recognise. Then move what is left to a new wallet, as a signed permit can be used later.
4. Typed a recovery phrase anywhere: treat the wallet as lost. Make a new one on a clean device and move everything at once. Our guide to what to do after a seed phrase is stolen walks through the order.
5. Report it: in the US, file at ic3.gov with the site address, the transaction signature and the receiving address above. Elsewhere, report to your national fraud centre. Report the page itself to Google Safe Browsing so browsers start warning about it.

Be wary of anyone who offers to "recover" the funds for a fee after you post about it. That is the second scam, and it targets people who just lost money to the first.

Catch the drainer page before the buy button runs

A fake download shop gets you to visit it before it gets you to sign. That visit is where a scanner helps. SafeBrowz checks the address before the page loads, in the browser extension for Chrome, Firefox and Edge and in the Android app. latestgta6.com, the twelve kit sites listed above and the two drainer servers Malwarebytes named are all on our block list now, so each of them comes back as danger in the extension, the app and the web URL checker.

A copycat on a fresh domain is the harder case, and this is where the code matters more than the name. When our server reads a page, it now flags the whole-balance sweep seen here and this kit's loader. That page read runs in the Android app's scan and in the web checker's deep scan. Free users get one full verdict a day on each, other sites show a caution, and Premium is unlimited. Before turning it on we ran the check over more than 950 real pages, including the sites of the top 500 DeFi protocols, and none of them tripped it.

Now the honest limit. GTA and Rockstar are not names in our brand-impersonation rules, so a new GTA 6 shop is not flagged from its address alone, and a copycat built differently can still slip past the page read. Those depend on the AI reading the page or on someone reporting the site so it can be blocked. No scanner replaces the wallet's own confirmation screen. If the amount there is not the price on the button, reject it.

Add to Chrome Add to Firefox Add to Edge Get it on Google Play