In the shadow of a troubled game launch, CD Projekt Red — the Polish studio behind Cyberpunk 2077 and The Witcher 3 — found itself the target of a ransomware attack that stripped away the source code of its most prized creations. The studio refused to negotiate, and within days, an auction for the stolen materials reportedly closed, leaving the buyer and price unknown. What lingers is a deeper question: whether this was an act of greed, grievance, or both — a reminder that in the digital age, reputation and security are bound together in ways studios are only beginning to reckon with.
Cyberpunk 2077 source code reportedly sold after CD Projekt Red hack
The code could be used by competitors, studied for vulnerabilities, or simply released as punishment.
Mark
So the hackers actually sold the code? How do we know that?
Mimi
Two separate cybersecurity firms, KELA and vx-underground, reported that the auction closed. They're credible sources in the security space.
Luke
But neither firm said who bought it or for how much. We're taking their word that a sale happened at all.
Mark
Why would the hackers close the auction if no one bought it?
Mimi
That's the logical assumption. But you're right—we don't have confirmation of an actual transaction.
Mark
And CD Projekt Red hasn't said anything?
Mimi
Nothing official. They confirmed the theft and said they wouldn't pay ransom. After that, silence.
Luke
Which could mean they don't know who bought it, or they're staying quiet for legal reasons, or the sale never happened. We just don't know.
Mark
What about the spite angle—does that hold up?
Mimi
A security expert told Wired it's plausible. The game's launch was a disaster. But that's speculation, not evidence.
Luke
Exactly. The motive is one person's theory. The only confirmed facts are the theft, the auction, and that the auction closed.
Mark
So we know less than the headline suggests.
Mimi
We know the code was stolen and the auction ended. Everything else is inference.
O Pulso
- Hackers breached CD Projekt Red's systems and walked away with the source code for Cyberpunk 2077, The Witcher 3, and other properties — some of the most commercially valuable game code in existence.
- The studio refused to pay any ransom, but that principled stand came at a cost: it surrendered all leverage over what would happen to the stolen materials.
- An auction opened at $1 million with a $7 million instant-buyout option, and within 48 hours, cybersecurity firms reported it had closed — buyer and final price still unknown.
- Security experts suggest the attack may have been fueled not just by money but by anger over Cyberpunk 2077's disastrous launch, framing the breach as a kind of digital vigilante punishment.
- The stolen code now exists somewhere beyond the studio's reach — potentially in the hands of competitors, researchers, or those who simply wish to cause further harm.
In the shadow of a troubled game launch, CD Projekt Red — the Polish studio behind Cyberpunk 2077 and The Witcher 3 — found itself the target of a ransomware attack that stripped away the source code of its most prized creations. The studio refused to negotiate, and within days, an auction for the stolen materials reportedly closed, leaving the buyer and price unknown. What lingers is a deeper question: whether this was an act of greed, grievance, or both — a reminder that in the digital age, reputation and security are bound together in ways studios are only beginning to reckon with.
On February 9th, CD Projekt Red confirmed that hackers had broken into its systems and stolen source code for Cyberpunk 2077, The Witcher 3, and other titles. The studio issued a firm refusal to pay any ransom and assured players that personal data had not been compromised.
The hackers moved quickly. By the following day, source code for GWENT, the studio's card game spinoff, had already leaked online. An auction was opened: bids starting at $1 million, rising in $500,000 increments, with a $7 million buyout option to end the auction immediately. By Thursday, cybersecurity firms KELA and vx-underground reported the auction had closed — though neither the buyer nor the final price was disclosed.
The motive behind the attack remains murky. Security specialist Tony Robinson suggested to Wired that the breach may have been driven as much by spite as by financial gain, pointing to Cyberpunk 2077's catastrophic December 2020 launch — plagued by bugs, poor performance on older consoles, and eventually pulled from the PlayStation Store — as a possible source of grievance. Some attackers, he argued, may have seen themselves as delivering a kind of punishment.
Whether the motivation was money, vengeance, or both, the consequences are real. The stolen code underpins games that have defined the studio's identity and generated billions in revenue. By refusing to negotiate, CD Projekt Red held its ground — but in doing so, it also lost any say in what comes next.
On Tuesday, February 9th, CD Projekt Red confirmed what had become clear to the gaming world: hackers had broken into the Polish studio's systems and stolen source code for some of its most valuable properties, including Cyberpunk 2077 and The Witcher 3. The company issued a statement refusing to pay any ransom demand. It also reassured players that personal data had not been compromised in the breach.
Within hours, the stolen material began surfacing. By Wednesday, February 10th, the source code for GWENT, CD Projekt Red's card game spinoff, had leaked online. The hackers, emboldened, opened an auction. The starting bid was set at $1 million. Bidders could raise the price in increments of $500,000. There was also a flash buyout option: $7 million would end the auction immediately and transfer ownership of all stolen source code and internal documents to the buyer.
Two cybersecurity firms—KELA and vx-underground—reported on Thursday that the auction had closed. Neither firm disclosed who had purchased the materials or what price had been paid. CD Projekt Red made no official statement about the sale. The identity of the buyer and the final transaction amount remain unknown.
Why the hackers targeted CD Projekt Red in the first place is still unclear. One theory, offered by security specialist Tony Robinson in an interview with Wired, suggests the attack was not purely financial. Robinson described it as potentially "opportunistic" but also possibly driven by "vengefulness and spite." He noted that while ransomware operators are typically motivated by money, CD Projekt Red had made promises to players and failed to deliver on them. Some attackers, Robinson suggested, might be acting out of a sense of righteousness, wanting to inflict damage on the studio as punishment.
That theory gains weight when considering Cyberpunk 2077's launch. The game arrived in December 2020 to widespread disappointment. Performance on older console hardware was poor. Players reported visual glitches and game-breaking bugs so severe that Sony removed the title from its PlayStation Store. The reputational damage was substantial. For a studio that had built its name on ambitious, polished releases, the failure was stark.
Whether the source code sale was motivated by money, spite, or some combination of both, the breach represents a significant loss for CD Projekt Red. The stolen materials include the underlying architecture of games that have generated billions in revenue and shaped the studio's identity. The code could be used by competitors, studied for vulnerabilities, or simply released to the public as further punishment. The studio's refusal to negotiate may have been principled, but it also meant losing any leverage over what happened next.
Citações Notáveis
I see it as more of an opportunistic attack, or perhaps maybe even vengefulness and spite. Ransomware operators are motivated by money, but CDPR promised a lot of things and failed to deliver on them, and there may be some that are just self-righteous and looking to make them hurt.— Tony Robinson, security specialist, to Wired
Quer a matéria completa?
Leia o original em InvenGlobal ↗
Technology