A new wave of crypto threats tied to Grand Theft Auto VI has emerged, combining a $350,000 cashout from a wallet linked to the 2022 GTA VI leaks with a fresh wallet-draining scam built around a fake early-access and leak download site.
On September 1, 2026, blockchain analysts reported that a wallet associated with the individual behind the 2022 Rockstar Games intrusion moved approximately $350,000 in digital assets. According to Coinbase director Conor Grogan, the GTA 6 hacker responsible for the Cyberleek coin cashed out roughly $350,000, sourced entirely from liquidity provider fees, and washed funds through various OTC providers. Investigators noted this is an unusual pattern, as the actor profited from liquidity provision rather than dumping a token.
The suspected hacker, an 18-year-old British youth, was arrested in September 2022 as part of a multi-country investigation into the Lapsus$ cybercriminal group. He faces charges including unauthorized computer access, blackmail and conspiracy. Although he remains in custody in the United Kingdom, the latest transaction raises questions about who controls the associated addresses, with authorities monitoring whether other group members or automated mechanisms can still move funds.
The original GTA VI leak included around one hundred videos and screenshots of an in-development version of the game. Rockstar Games confirmed the authenticity of the material and described the incident as an illegal intrusion. During the blackmail attempt, several cryptocurrency addresses were exposed, allowing blockchain security analysts to track subsequent movements.
On September 2, 2026, cybersecurity firm Malwarebytes revealed a separate scam: a fake GTA 6 website posing as a fan countdown and offering an alleged leaked copy of the title. The page mixes legitimate promotional material with malicious payment options. One offer asks for $50, while another requests 1 SOL, worth about $102 at the time of analysis. Malwarebytes found two pieces of malicious code in the payment section: one targets Solana wallets and calculates a transfer designed to leave only enough funds behind to cover transaction fees; the second, larger script can target wallets across Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base and Fantom by posing as a legitimate wallet-connection tool.
The site contains inconsistencies, including a footer stating it does not offer purchases, a claim that GTA 6 is console-only while its FAQ promises a PC download after payment, and references to GTA IV instead of GTA VI. Malwarebytes had previously identified fake GTA 6 demo and Extended Look pages, indicating a sustained campaign targeting crypto users around the highly anticipated game.
The combined developments highlight how the Grand Theft Auto VI brand continues to be exploited for crypto scams and how security analysts remain focused on illicit fund flows tied to high-profile cyberattacks.
