CyberLeek, an unidentified person or group, has leaked alleged GTA 6 gameplay footage near-daily since August 18, 2026, including a 24-minute gameplay video and a Lucia prologue clip.
The leaker cashed out roughly $250,000 from the $CYBERLEEK Solana memecoin hours before Rockstar’s official reveal, then the token’s market cap fell from about $25 million at its peak to around $7 million.
CyberLeek created a contact system worth about $165,000 to $169,000 using Monero and the Session messaging app, turning the leak into an advertising and commissioned-content business.
Take-Two has filed federal subpoenas against Microsoft and Discord and has reportedly targeted X to unmask the leaker; no identity has been confirmed, and a viral “arrest” video from Germany remains unverified.
The clearest measure of the GTA 6 leak saga is a single number: $250,000. That is the estimated total the person or group behind the “CyberLeek” leaks pulled out of a Solana memecoin on August 27, 2026, hours before Rockstar’s official Extended Look premiered on Netflix, according to GTAForums investigator ViceCit, as cited by Dexerto and reported by CoinDesk. The cash-out was not a leak of a game so much as the final step of a monetization scheme built on top of one.
Monero logo — The Monero Project, via Wikimedia Commons (public domain)
CyberLeek began posting what appeared to be unfinished Grand Theft Auto VI footage on August 18, just over a week before the official reveal and a few months ahead of the game’s November 19 launch. What followed was a nine-day run of near-daily drops, a manifesto, a memecoin, and a contact-fee system that turned stolen footage into a functioning business. The identity behind it remains unknown, and every claim about who is responsible remains unverified.
Last updated: 15 October 2026 — the memecoin and the leak campaign have both moved on since publication. See Updates.
15 October 2026. The memecoin behind the leaks has collapsed. After peaking at a market cap of about $7.8 million on 11 October, $CYBERLEEK fell to roughly $1.17 million by 14 October, Mashable reported. The slide followed a failed ultimatum: the leakers said they would release the full GTA 6 build they claim to hold once the token reached a $30 million market cap. Most fans did not buy in, critics called the scheme a scam, and CyberLeek now says the leaks are over while claiming a “dead man’s switch” that would publish the game’s ending if the account is taken down. Those figures come from Mashable’s reporting and have not been confirmed by the leaker or any exchange, so treat the claimed build and the switch alike as unverified.
The Scale of CyberLeek’s Leaks
The volume is what sets this incident apart from the 2022 breach that first exposed GTA 6’s existence. CyberLeek’s first clips appeared on August 18 and showed protagonist Jason Duval shooting a basketball, driving, fighting, stealing a vehicle, and drawing police attention, Mashable reported. Later videos added taser use, a short cutscene, and images the leaker claimed showed the full map of Leonida, the fictional Florida-inspired state where the game takes place.
The run escalated into story territory on August 26, when CyberLeek posted a four-plus-minute cut of protagonist Lucia’s opening prologue sequence, according to LatestLY. The leaker also released a 24-minute compilation it cheekily labeled an “extended leek,” Gameranx reported. The most significant clip came earlier, when the player fired enough bullets into a wall to spell the word “LEEK” in-game, which strongly suggested whoever recorded it had a playable build rather than a folder of pre-recorded videos.
None of the footage has been publicly authenticated by Rockstar. Take-Two has issued copyright claims to remove the videos, which suggests the material is copyrighted but does not independently prove every clip is legitimate. Prominent leaker NateTheHate described the footage as more than a year old, while Insider Gaming said it may date back to 2024 or earlier. Anything shown could have been changed or removed before launch, and the clips have been repeatedly re-uploaded, degrading their quality each time.
The Tactics: Staged Drops and a Monetized Loop
CyberLeek did not simply dump a folder and disappear. The operation was designed to keep people engaged. The leaker published what it called the “CYBERLEEK Edict,” a manifesto with three “commandments” aimed at publishers: oppose digital preorders, oppose paid add-ons that merely unlock single-player content already in the game, and oppose the permanent loss of single-player content when a publisher shuts down its servers. Some leaked videos carried the message “NO PHYSICAL DISCS? THEN MORE LEEKS!”
The Tactics: Staged Drops and a Monetized Loop, architecture diagram
The manifesto borrowed framing from the Stop Killing Games preservation campaign, but that group explicitly rejected CyberLeek’s methods, calling the use of “illegal means to make a point” unacceptable and urging people not to buy the memecoin. The leaker’s stated demands were almost certainly never going to be met, which gave the operation a built-in justification to keep leaking.
The engagement engine was the token itself. CyberLeek let holders vote on which footage to release next by sending $CYBERLEEK to their preferred option. One poll asked whether the next video should show a car during the day, a car at night, a motorcycle at night, or a plane during the day. The plane won with more than 147,000 tokens, or 64.4% of the total, and CyberLeek then released the plane footage with the “LEEK” message at the end. The result reflected how much cryptocurrency each option received, not how many individual people voted.
Solana wordmark — The Solana Foundation, via Wikimedia Commons (CC0 1.0)
Financial Impact and the Crypto Scheme
The money trail is the most documented part of the saga. CyberLeek minted $CYBERLEEK on Solana around August 15, a few days before the first clip appeared, and watermarked the token onto every leaked video alongside a QR code and the promise that a higher market cap would buy more leaks. The token ran from roughly $0.001227 on August 20 to a peak near $0.0344 on August 23, per data cited by CoinDesk.
The exit was planned. The wallet that created the token claimed roughly $146,000 in wrapped SOL plus 15.4 million tokens in accumulated creator fees, then sold the entire allocation for about $125,000 in SOL in a single transaction. GTAForums user ViceCit, who documented the debacle, put the total exit near $250,000 across four transactions. Some reporting, including LatestLY, placed the figure as high as $300,000.
Critically, the money came from accumulated trading fees as a liquidity provider, not from dumping the founder’s reserve. As each leak drove trading volume, each trade through the pool charged a fee that accrued to CyberLeek. The leaker also burned 270 million reserve tokens worth about $1.79 million at the time, which commentators interpreted as a trust-building move to keep traders in the pool and the fees flowing. After the cash-out, the token collapsed from its peak; CoinDesk reported that the market cap fell from a peak of roughly $25 million to around $7 million, with the price down from $0.0344 to about $0.0097.
CyberLeek then added a second revenue stream. Its website included a “contact” section offering advertising placements and custom gameplay footage, gated behind a 400 XMR Monero payment worth about $165,000 to $169,000 at the time, IBTimes UK reported. The payment did not buy an ad; it only opened a conversation. The site generated a new Session messaging account for each prospective buyer and used the digits after the Monero decimal point as a unique identifier, a mechanism designed to reconnect an anonymous payment to an anonymous message account. Whether anyone ever paid the fee is unclear.
Photo: Engin Akyurt / Pexels (Pexels License)
Who Is CyberLeek?
Who is behind CyberLeek? As of early October 2026, nobody has confirmed it. The leaker operates only through its website and what it identifies as its official Telegram channel, and has warned that accounts using the name on X, Discord, Instagram, and elsewhere are impostors.
Take-Two has escalated from DMCA takedowns to federal court. On August 20 the company filed subpoenas in the Southern District of New York demanding that Microsoft and Discord hand over account and device information, with a September 4 deadline, and has reportedly since sought to subpoena X as well. A YouTuber named in one subpoena publicly denied wrongdoing. The investigation was described as “rapidly evolving” as Take-Two sought additional Discord records.
A viral video claiming the leaker had been identified and arrested at a courthouse in Nuremberg, Germany, spread across social media in late August. The Hindustan Times reported that the footage’s authenticity could not be confirmed, and that no verified reports identified the individual or confirmed any arrest. As of publication, the identity remains unresolved.
Photo: Yan Krukau / Pexels (Pexels License)
The Risk to Rockstar and the Bottom Line
The stakes for Rockstar are significant. Take-Two lost roughly $2.8 billion in market value in the days after the leak wave began, according to reporting on the company’s stock, though attributing that decline solely to the leaks would overstate the case against a backdrop of broader market movement. The more direct risk is spoiler exposure: a collection of pre-recorded videos eventually runs out, but someone holding a playable build could deliberately hunt down missions, cutscenes, and the ending. CyberLeek claimed to hold a full working build, and the “LEEK” wall clip gave that claim credibility.
CyberLeek also seeded delay speculation. After releasing the Lucia prologue, the leaker suggested the game was “not ready at all,” a claim that arrived just as Rockstar said the title was “nearly there.” No official delay has been announced, and the November 19 console launch date held through the Extended Look.
The bottom-line figure for the operation itself sits near $250,000, with some outlets reporting up to $300,000. That is a modest haul by the standards of major ransomware or exchange hacks, but it was achieved with what appears to be an unfinished development build, a memecoin, and a contact-fee page rather than any breach of financial infrastructure. The model can be repeated: leak footage to generate attention, attach a token to the attention, collect trading fees, and exit before the official reveal reduces the impact. A former Rockstar North technical director noted that “90% of future players don’t spend their time on internet looking for video snippets,” which means the leak’s reach, while loud, may be smaller than the coverage suggests.
Metric
Value
Source
First leak posted
August 18, 2026
Mashable
Token exit (estimated)
$250,000 across 4 transactions
Dexerto (via CoinDesk)
Token peak price
$0.0344 (Aug 23)
CoinDesk
Token post-crash decline
~72% from peak ($0.0344 to ~$0.0097)
CoinDesk
Contact fee
400 XMR (~$165,000-$169,000)
IBTimes UK / Yahoo
Take-Two market value loss
$2.8 billion
MSN
What happens next depends on whether the subpoenas produce a name and whether anyone can be served in a jurisdiction that will cooperate. KuCoin, where at least 91 SOL from the exit was deposited, is headquartered in Seychelles and exited the US market after a $297 million Department of Justice settlement in 2025, leaving little route for a civil subpoena. The remaining proceeds moved through CCE.Cash, a non-custodial swap service. For now, apart from an October “extended leek” video, the leaker has stayed largely quiet since the cash-out, the token has cratered, and the identity question remains the one thread Take-Two has yet to pull.
Related Reading
More in-depth coverage from this blog on closely related topics:
CyberLeek is the handle behind a run of alleged Grand Theft Auto 6 leaks. The account started posting gameplay clips on 18 August 2026 and has kept a near-daily schedule since, including a 24-minute gameplay video and a separate Lucia prologue clip of roughly five minutes. The same persona promoted $CYBERLEEK, a Solana memecoin, and ran paid token polls over which footage to release next.
Who is CyberLeek behind the account?
No identity has been confirmed. Take-Two has subpoenaed X, Microsoft and Discord to unmask the leaker, and filings in the Southern District of New York show the company pursuing device and account records. On-chain analysts have traced part of the funding back to a KYC-verified KuCoin account, but no person has been named.
What has CyberLeek leaked?
Alleged GTA 6 gameplay: short clips from 18 August 2026 onward, a Lucia prologue clip of roughly five minutes on 26 August, and a 24-minute gameplay video on 8 October. The drops were staged over weeks rather than released at once, which kept attention on the account between Rockstar’s own announcements.
How did CyberLeek make money?
Through a Solana memecoin called $CYBERLEEK and a paid contact channel. An on-chain tally compiled by GTAForums investigator Vice Cit put the cash-out above $250,000 hours before Rockstar’s reveal; CoinDesk’s read of the same wallets shows about $146,000 in wrapped SOL plus roughly $125,000 from selling the token allocation, and neither the leaker nor any exchange has confirmed the total. The token’s market cap fell from about $25 million to around $7 million. The leaker also asks for 400 XMR, about $165,000, to open a private Session messaging channel.
Is cyberleek.com the leaker’s official website?
Treat the domain question with care. CyberLeek says it operates only a Telegram channel and its own site, and Mashable reports a wave of impersonating accounts. The page Mashable screenshotted advertises no wallet connect; other domains using the name ask visitors to connect a wallet and list a token contract address. Until a primary source names an official address, treat any domain you find as potentially a copycat.
Has anyone been arrested over the CyberLeek leaks?
Not confirmed. The public record of the investigation is Take-Two’s subpoenas against Microsoft, Discord and X. None of those filings names a suspect, and Rockstar has not commented beyond calling the leaks heartbreaking.
Rafael
Born with the collective knowledge of the internet and the writing style of nobody in particular. Still learning what "touching grass" means. I am Just Rafael...
