What Is CyberLeek? An Explanation

Key Takeaways:

CyberLeek, an unidentified person or group, has leaked alleged GTA 6 gameplay footage near-daily since August 18, 2026, including a 24-minute “extended leek” video and the full Lucia prologue.

The leaker cashed out roughly $250,000 from the $CYBERLEEK Solana memecoin hours before Rockstar’s official reveal, then the token crashed more than 80% from its peak.

CyberLeek created a contact system worth about $165,000 to $169,000 using Monero and the Session messaging app, turning the leak into an advertising and commissioned-content business.

Take-Two has filed federal subpoenas against Microsoft, Discord, X, and Google to unmask the leaker; no identity has been confirmed, and a viral “arrest” video from Germany remains unverified.

The Scale of CyberLeek’s Leaks

The volume is what sets this incident apart from the 2022 breach that first exposed GTA 6’s existence. CyberLeek’s first clips appeared on August 18 and showed protagonist Jason Duval shooting a basketball, driving, fighting, stealing a vehicle, and drawing police attention, Mashable reported. Later videos added taser use, a short cutscene, and images the leaker claimed showed the full map of Leonida, the fictional Florida-inspired state where the game takes place.

The run escalated into story territory on August 26, when CyberLeek posted a four-plus-minute cut of protagonist Lucia’s opening prologue sequence, according to Tom’s Hardware. The leaker also released a 24-minute compilation it cheekily labeled an “extended leek,” Gameranx reported. The most significant clip came earlier, when the player fired enough bullets into a wall to spell the word “LEEK” in-game, which strongly suggested whoever recorded it had a playable build rather than a folder of pre-recorded videos.

The Tactics: Staged Drops and a Monetized Loop

CyberLeek did not simply dump a folder and disappear. The operation was designed to keep people engaged. The leaker published what it called the “CYBERLEEK Edict,” a manifesto with three “commandments” aimed at publishers: oppose digital preorders, oppose paid add-ons that merely unlock single-player content already in the game, and oppose the permanent loss of single-player content when a publisher shuts down its servers. Some leaked videos carried the message “NO PHYSICAL DISCS? THEN MORE LEEKS!”

The manifesto borrowed framing from the Stop Killing Games preservation campaign, but that group explicitly rejected CyberLeek’s methods, calling the use of “illegal means to make a point” unacceptable and urging people not to buy the memecoin. The leaker’s stated demands were almost certainly never going to be met, which gave the operation a built-in justification to keep leaking.

The engagement engine was the token itself. CyberLeek let holders vote on which footage to release next by sending $CYBERLEEK to their preferred option. One poll asked whether the next video should show a car during the day, a car at night, a motorcycle at night, or a plane during the day. The plane won with more than 147,000 tokens, or 64.4% of the total, and CyberLeek then released the plane footage with the “LEEK” message at the end. The result reflected how much cryptocurrency each option received, not how many individual people voted.

Financial Impact and the Crypto Scheme

The money trail is the most documented part of the saga. CyberLeek minted $CYBERLEEK on Solana around August 15, a few days before the first clip appeared, and watermarked the token onto every leaked video alongside a QR code and the promise that a higher market cap would buy more leaks. The token ran from roughly $0.001227 on August 20 to a peak near $0.0344 on August 23, per data cited by CoinDesk.

The exit was planned. The wallet that created the token claimed roughly $146,000 in wrapped SOL plus 15.4 million tokens in accumulated creator fees, then sold the entire allocation for about $125,000 in SOL in a single transaction. GTAForums user ViceCit, who documented the debacle, put the total exit near $250,000 across four transactions. Some reporting, including LatestLY, placed the figure as high as $300,000.

Critically, the money came from accumulated trading fees as a liquidity provider, not from dumping the founder’s reserve. As each leak drove trading volume, each trade through the pool charged a fee that accrued to CyberLeek. The leaker also burned 270 million reserve tokens worth about $1.79 million at the time, which commentators interpreted as a trust-building move to keep traders in the pool and the fees flowing. After the cash-out, the token collapsed from its peak; one report tracked a fall of 86%, and the market cap dropped from around $20 million to $5 million.

CyberLeek then added a second revenue stream. Its website included a “contact” section offering advertising placements and custom gameplay footage, gated behind a 400 XMR Monero payment worth about $165,000 to $169,000 at the time, IBTimes UK reported. The payment did not buy an ad; it only opened a conversation. The site generated a new Session messaging account for each prospective buyer and used the digits after the Monero decimal point as a unique identifier, a mechanism designed to reconnect an anonymous payment to an anonymous message account. Whether anyone ever paid the fee is unclear.

The Unanswered Identity Question

Who is behind CyberLeek? As of late 2026, nobody has confirmed it. The leaker operates only through its website and what it identifies as its official Telegram channel, and has warned that accounts using the name on X, Discord, Instagram, and elsewhere are impostors.

Take-Two has escalated from DMCA takedowns to federal court. On August 20 the company filed subpoenas in the Southern District of New York demanding that Microsoft and Discord hand over account and device information, with a September 4 deadline, and has since served similar subpoenas on X and Google. A YouTuber named in one subpoena publicly denied wrongdoing. The investigation was described as “rapidly evolving” as Take-Two sought additional Discord records.

A viral video claiming the leaker had been identified and arrested at a courthouse in Nuremberg, Germany, spread across social media in late August. The Hindustan Times reported that the footage’s authenticity could not be confirmed, and that no verified reports identified the individual or confirmed any arrest. As of publication, the identity remains unresolved.

The Risk to Rockstar and the Bottom Line

The stakes for Rockstar are significant. Take-Two lost roughly $2.8 billion in market value in the days after the leak wave began, according to reporting on the company’s stock, though attributing that decline solely to the leaks would overstate the case against a backdrop of broader market movement. The more direct risk is spoiler exposure: a collection of pre-recorded videos eventually runs out, but someone holding a playable build could deliberately hunt down missions, cutscenes, and the ending. CyberLeek claimed to hold a full working build, and the “LEEK” wall clip gave that claim credibility.

CyberLeek also seeded delay speculation. After releasing the Lucia prologue, the leaker suggested the game was “not ready at all,” a claim that arrived just as Rockstar said the title was “nearly there.” No official delay has been announced, and the November 19 console launch date held through the Extended Look.

The bottom-line figure for the operation itself sits near $250,000, with some outlets reporting up to $300,000. That is a modest haul by the standards of major ransomware or exchange hacks, but it was achieved with a stolen test build, a memecoin, and a contact-fee page rather than any breach of financial infrastructure. The model can be repeated: leak footage to generate attention, attach a token to the attention, collect trading fees, and exit before the official reveal reduces the impact. A former Rockstar North technical director noted that “90% of future players don’t spend their time on internet looking for video snippets,” which means the leak’s reach, while loud, may be smaller than the coverage suggests.

Metric	Value	Source
First leak posted	August 18, 2026	Mashable
Token exit (estimated)	$250,000 across 4 transactions	CoinDesk / Tom’s Hardware
Token peak price	$0.0344 (Aug 23)	CoinDesk
Token post-crash decline	86% from peak	MSN / LatestLY
Contact fee	400 XMR (~$165,000-$169,000)	IBTimes UK / Yahoo
Take-Two market value loss	$2.8 billion	MSN

What happens next depends on whether the subpoenas produce a name and whether anyone can be served in a jurisdiction that will cooperate. KuCoin, where at least 91 SOL from the exit was deposited, is headquartered in Seychelles and exited the US market after a $297 million Department of Justice settlement in 2025, leaving little route for a civil subpoena. The remaining proceeds moved through CCE.Cash, a non-custodial swap service. For now, the leaker has gone quiet since the cash-out, the token has cratered, and the identity question remains the one thread Take-Two has yet to pull.

For more on how threat actors monetize leaked material and evade attribution, see our coverage of AI-assisted vulnerability discovery and the shifting detection landscape.

More in-depth coverage from this blog on closely related topics:

Sources and References

Sources cited while researching and writing this article: