In the shadow economy where digital theft meets open bidding, the source code of some of gaming's most celebrated worlds—Cyberpunk 2077 and The Witcher 3—passed into unknown hands this week after a ransomware attack on Polish studio CD Projekt Red culminated in a closed auction on a criminal forum. The studio, refusing to negotiate or pay, accepted the risk that its most proprietary assets would find a buyer, and by Thursday, February 11th, they had. What remains uncertain is not merely the buyer's identity or the final price, but what it means when the creative and commercial soul of a studio
CD Projekt Red's stolen game source code reportedly sold to unknown buyer
The studio chose not to negotiate, accepting the risk that proprietary code would reach the market.
Mark
So someone actually bought this stuff? The source code for games that haven't even finished their first year on the market?
Mimi
Yes. The auction closed on Thursday. We don't know who or for how much, but the transaction happened.
Luke
Wait—we know the starting price was a million and the buy-it-now was seven million. But we don't actually know what the final sale price was, right?
Mimi
Correct. The buyer negotiated privately and closed the auction. The terms of the actual sale are not public.
Mark
Why would someone buy stolen game code? What do you even do with it?
Mimi
That's the question. It could be reverse-engineered, studied for vulnerabilities, or used to create unauthorized versions. The buyer also got internal legal and financial documents.
Luke
And we're assuming it was one buyer, but the forum post just says "an offer from outside the forum." Could be a group, could be a company, could be a state actor.
Mimi
True. The only thing we know for certain is that the auction closed and the material left the forum.
Mark
CD Projekt Red said they wouldn't pay. So they basically accepted this outcome?
Mimi
They chose not to negotiate, yes. They disclosed the breach publicly instead of trying to contain it quietly.
Luke
Which is actually the responsible move from a transparency standpoint, but it also meant they had no leverage to stop the sale.
Mark
And the HelloKitty ransomware connection—does that tell us anything about who did this?
Luke
It tells us they used the same tool that hit a Brazilian power company. But HelloKitty is available to multiple criminal groups. It's not a fingerprint that points to one actor.
Il Polso
- A ransomware attack exposed not just game source code but the legal, financial, and human infrastructure of one of gaming's most celebrated studios—leaving CD Projekt Red acutely vulnerable.
- The studio's public refusal to pay or negotiate was a bold declaration, but it effectively handed the stolen material over to the highest bidder on a criminal forum frequented by hackers and security researchers alike.
- The auction opened at $1 million with a $7 million buy-it-now price, covering source code for Cyberpunk 2077, multiple Witcher titles, and sensitive internal documents—a digital fire sale of creative and corporate secrets.
- An outside buyer stepped in, closed the auction early, and reportedly agreed not to redistribute the material—a private condition offering cold comfort to a studio with no legal recourse over the transaction.
- The breach, traced to HelloKitty ransomware previously used against a Brazilian power company, signals that major creative studios are now targets in the same threat landscape as critical infrastructure.
In the shadow economy where digital theft meets open bidding, the source code of some of gaming's most celebrated worlds—Cyberpunk 2077 and The Witcher 3—passed into unknown hands this week after a ransomware attack on Polish studio CD Projekt Red culminated in a closed auction on a criminal forum. The studio, refusing to negotiate or pay, accepted the risk that its most proprietary assets would find a buyer, and by Thursday, February 11th, they had. What remains uncertain is not merely the buyer's identity or the final price, but what it means when the creative and commercial soul of a studio becomes a commodity on the open market.
On Thursday, February 11th, cybersecurity researchers confirmed that source code and internal documents stolen from CD Projekt Red—the Polish studio behind Cyberpunk 2077 and The Witcher 3—had been sold to an unknown buyer following an auction on Exploit, a forum active in criminal and security research circles. The buyer's identity and the final sale price remain unknown.
The breach had come to light earlier in the week, when CD Projekt Red disclosed a ransomware attack and published the hackers' ransom note. The stolen material included source code for Cyberpunk 2077, The Witcher 3, a ray-traced version of that game, Thronebreaker: The Witcher Tales, and a range of internal legal, HR, and financial documents. The studio announced immediately that it would not negotiate or pay—a decision that left the material exposed to the open market.
Screenshots verified by security firm Kela and the account vx-underground showed the auction starting at $1 million, with a $7 million buy-it-now option. The hackers ultimately closed the bidding after receiving an outside offer, with one condition attached: the buyer agreed not to further distribute or resell the data. Before the auction concluded, the hackers had already leaked source code for Gwent, CD Projekt Red's card game, which was independently verified as authentic.
The attack was executed using HelloKitty ransomware—the same malware previously deployed against a Brazilian energy company. CD Projekt Red's choice of transparency over quiet containment was a calculated risk. By Thursday, that risk had fully materialized: the stolen material had changed hands, the studio was still investigating, and the auction had already closed.
The stolen goods went to auction on a hacking forum, and someone bought them. On Thursday, February 11th, cybersecurity researchers confirmed that the source code and internal documents taken from CD Projekt Red—the Polish studio behind Cyberpunk 2077 and The Witcher 3—had found a buyer. The identity of the purchaser remains unknown, as does the final price, but the transaction appears to have closed the auction that began after the studio's ransomware attack came to light earlier in the week.
The theft itself was substantial. When CD Projekt Red disclosed the breach on Tuesday, the hackers' ransom note claimed access to source code from the studio's flagship titles, along with legal documents, human resources files, and financial records. The studio announced immediately that it would not negotiate or pay—a public refusal that left the stolen material vulnerable to wider circulation. By Thursday, that material was being auctioned to the highest bidder on Exploit, a forum frequented by cybercriminals and security researchers alike.
According to screenshots shared by the security firm Kela and verified by the Twitter account vx-underground, the auction lot included source code for Cyberpunk 2077, The Witcher 3, a ray-traced version of The Witcher 3, the spinoff Thronebreaker: The Witcher Tales, and internal company documents. The starting bid was set at $1 million, with a buy-it-now option at $7 million. The hackers announced on the forum that they had received an offer from outside the community and were closing the auction at the buyer's request—with a condition attached: no further distribution or resale of the material.
The breach itself appears to have been executed using HelloKitty ransomware, according to a security researcher who spoke with Wired. The same malware had previously been deployed against CEMIG, a Brazilian power company. Before the source code auction, the hackers had already leaked code for Gwent, CD Projekt Red's virtual card game, which Vice verified as authentic.
CD Projekt Red's refusal to pay or negotiate was a calculated gamble. The studio chose transparency over secrecy, disclosing the attack and the hackers' demands rather than attempting to contain the breach quietly. That decision meant accepting the risk that proprietary game engines and sensitive internal data would eventually reach the open market. As of Thursday, that risk had materialized. The studio told Vice it was still actively investigating the incident, but the auction had already closed, and the stolen material had already changed hands.
Citazioni salienti
CD Projekt Red said it would not negotiate with the hackers, even if that meant the stolen data would begin circulating online.— CD Projekt Red's public statement on the ransomware attack
Vuoi la storia completa?
Leggi l'originale su The Verge ↗
Business