Malwarebytes documented a third 2026 wave of sites selling a “GTA 6 leak” for about $50. The payload is not a ROM. It is a drainer: Solana plus several EVM chains, a prompt that looks like a cart and is a signature. Connecting is not enough. Signing is the theft.

The kit profiles the wallet, asks for a transfer or an unlimited approval, and leaves. Seed phrases are often not requested. Useless, if you already signed. A hardware wallet still saves you only if you read the screen and refuse a send-all.

How not to help the kit

Do not search “GTA 6 torrent” on a machine that holds keys. Do not disable the scanner “just this once”. Do not test the site with a “burner” that still has an old approval. Revoke on each chain (Revoke.cash, an explorer). See approval.

Fifty dollars for a game that is not there. A signature for a wallet that will not be there either.— The newsroom

Rockstar is not sending you a Discord. A leak with a connect button is a storefront for theft. File it as crime hygiene, not as gaming news.

What is held, what is not

  • Held: Malwarebytes’ third 2026 wave, a ~$50 lure, Solana and EVM drainers, signature-based theft.
  • Not held: that GTA 6 “is out”. A complete victim tally. That “only stupid people” sign.

If you signed: move what remains, revoke, assume the address is burned. If you did not: keep not signing carts that sell unfinished games.

Sources: Malwarebytes. Nothing here is legal advice.