Introduction
In August 2026, the gaming world experienced perhaps the most bizarre security incident in its history. An individual or group calling itself CyberLeek spent nine consecutive days leaking unreleased gameplay footage of Grand Theft Auto VI (GTA 6), while simultaneously promoting its own Solana‑based meme coin, $CYBERLEEK. Mere hours before Rockstar Games officially unveiled the first public gameplay footage in a Netflix special, CyberLeek cashed out, netting approximately $250,000.
But this is not where the story begins. To understand what CyberLeek did, we have to go back to 2022 – the year a 17‑year‑old teenager shook the entire gaming industry with an Amazon Fire TV Stick.
Chapter 1: 2022 – The First Breach
In September 2022, one of the most severe leaks in gaming history occurred. More than 90 videos and screenshots of an early development build of GTA 6 were posted online. The material came from an intrusion into Rockstar Games’ internal systems – a hacker had gained access to a Rockstar employee’s credentials via a SIM‑swap attack and then infiltrated the company’s internal Slack workspace.
That hacker was Arion Kurtaj, then 17, a member of the notorious Lapsus$ hacking group. Incredibly, Kurtaj carried out the attack on Rockstar from a hotel room using only an Amazon Fire TV Stick, a TV, and a mobile phone. It was a stark reminder that successful cyberattacks do not always require elaborate setups or expensive equipment.
In December 2023, Kurtaj was sentenced to an indefinite hospital order. Rockstar seemed to have weathered the worst – or so it appeared at the time.
Chapter 2: 2026 – CyberLeek Emerges
Fast‑forward to August 2026. With just three months to go until the official release of GTA 6 (scheduled for 19 November 2026), Rockstar was preparing to publicly showcase the first gameplay footage in a Netflix special. At this critical juncture, a mysterious figure or group named CyberLeek appeared.
Around 18 August 2026, CyberLeek began posting GTA 6 gameplay footage on platforms like Reddit. The videos showed one of the game’s protagonists, Jason Duval, engaged in various activities – driving, shooting, exploring the map. In one clip, the character fires at a wall, spelling out “LEEK” – both a signature for the hacker and a public taunt at Rockstar.
Initially, speculation suggested that CyberLeek might be connected to the 2022 Lapsus$ attack. However, later reports indicated that this was likely an entirely separate operation.
Chapter 3: The Source of the Leak
Several theories emerged about how CyberLeek obtained the material. According to consolidated reports, the leak originated from Rockstar India. The Russian hacking group 808 Mafia first compromised the account of a technical director at Rockstar’s India office through a phishing attack, then used that compromised work account to penetrate and bypass the studio’s internal security, gaining access to an Xbox development build (devkit) of GTA 6.
Subsequently, 808 Mafia allegedly sold the build to CyberLeek for approximately $50 million, paid in cryptocurrency. CyberLeek then used this devkit to produce numerous gameplay videos and promoted its own cryptocurrency for profit.
However, other reports claimed that 808 Mafia later publicly denied any involvement in CyberLeek’s actual operation, saying their earlier statements were merely an attempt to attract subscribers. CyberLeek’s true identity remains a mystery – whether it is a single person or a group is still unknown.
Chapter 4: The Birth of the Cryptocurrency
CyberLeek’s strategy soon revealed its true nature – this was not just a leak, but a meticulously orchestrated financial operation.
The hacker created its own meme coin on the Solana blockchain, named $CYBERLEEK. Every leaked video was watermarked with the token’s contract address and a QR code, inviting viewers to buy the cryptocurrency. Overlaid text read: “The higher the market cap = the more leaks.”
According to a deep investigation by GTAForums researcher “Vice Cit,” CyberLeek invested approximately $29,000 to create the token, build a website, and upload the files. But the hacker did not profit primarily by selling the tokens directly – instead, the money came from the creator fees (transaction taxes) embedded in every trade. Each time someone bought $CYBERLEEK, a portion of the fee flowed directly into the creator’s pocket.
To allay fears of a “rug pull” scam, CyberLeek burned 270 million $CYBERLEEK tokens on 22 August – roughly 27% of the initial supply. A subsequent leak video carried the message: “To prove you wrong, all dev tokens have been burned. Now only transaction fees are taken.”
CyberLeek also set up a website where fans could use the meme coin to vote on what GTA 6 content would be leaked next – from ordinary gameplay to more spoilery moments. This created a disturbing feedback loop: the higher the token’s market cap, the more leaks occurred; the more leaks occurred, the more attention the project received, and the higher the token’s price rose.
Chapter 5: The Meteoric Rise in Market Cap
From 18 August to 27 August 2026, CyberLeek continued to release GTA 6 leak videos. This nine‑day leak frenzy produced astonishing results.
$CYBERLEEK’s market cap peaked at approximately $25 million on 23 August. For a meme coin with virtually no practical use, this was a staggering figure. The token price briefly touched $0.0344. Between 68,000 and 78,000 wallets held the token, with daily trading volumes ranging from $13 million to $18 million.
CyberLeek framed the leak campaign as a “social movement,” claiming to be fighting for players’ rights against Rockstar’s digital‑only distribution strategy and its refusal to release physical discs. However, as Vice Cit pointed out: “The player‑rights message was merely moral signalling to gain public support … the people behind this leak are making a lot of money, and the plan was carefully designed and executed to maximise their gains.”
Chapter 6: The Cash‑Out – $250,000 Exit
On 27 August 2026, just hours before Rockstar Games officially revealed GTA 6 gameplay in a Netflix special, CyberLeek executed its long‑planned cash‑out.
On‑chain data shows that the contract owner withdrew approximately $146,000 worth of Wrapped SOL (Solana’s wrapped version) plus 15.4 million $CYBERLEEK tokens in creator fees. The hacker then dumped all 15.4 million tokens in a single transaction, swapping them for about $125,000 worth of SOL.
The funds were split across four new wallets, with at least 91 SOL flowing to the KYC‑compliant exchange KuCoin. Independent blockchain analysts estimate the total cash‑out exceeded $250,000. Eurogamer reported that CyberLeek extracted roughly $270,000 (nearly £200,000) from its crypto scheme.
Subtracting the initial investment of about $29,000, CyberLeek’s net profit came to approximately $241,000.
After the cash‑out, the price of $CYBERLEEK plummeted from its peak of $0.0344 to around $0.0097 – a 46% drop in 24 hours. The market cap collapsed from $25 million to about $7 million. Yet approximately 730 million tokens remained in circulation.
Chapter 7: The Investors Left Holding the Bag
CyberLeek’s exit left thousands of investors in a difficult position.
After the price crash, those who held $CYBERLEEK faced massive losses. Investors who bought at the $25 million peak saw their holdings shrink by more than 70% within hours. CoinMarketCap data showed the token’s market cap had fallen to roughly $7 million.
As Vice Cit observed: “Since the first leak video was released yesterday, the token has lost about 75% of its market cap … I expect the market cap to continue shrinking as news of CyberLeek’s cash‑out spreads.”
The incident was widely condemned as a “rug pull” scam. Although CyberLeek had burned tokens earlier in an attempt to build trust, the ultimate operational pattern – using leaked content to inflate prices, then cashing out just before the official reveal – was classic crypto fraud.
Chapter 8: The Legal Pursuit
CyberLeek’s cash‑out immediately triggered a strong response from Rockstar Games and its parent company, Take‑Two Interactive.
Rockstar said the leaks were “heartbreaking” for the development team. Take‑Two moved swiftly, sending subpoenas to X (formerly Twitter), Microsoft, and Discord, demanding account information and online activity records related to the leak.
More critically, on‑chain analysis showed that funds had flowed to a KuCoin account that had completed KYC verification. This meant that law enforcement could potentially trace the hacker’s real identity through the exchange’s user records. The FBI was also reported to have officially joined the investigation into the CyberLeak case. If convicted, the leaker could face up to 50 years in prison.
Private investigators also joined the manhunt. One investigator, codenamed KINGJulien, reportedly completed a full investigation into CyberLeak and forwarded all evidence to Rockstar’s legal team. The investigation relied on open‑source intelligence (OSINT) and insider leads from Telegram communities, and reportedly pinpointed a European bank account believed to belong to the leaker.
However, CyberLeek’s true identity has still not been officially confirmed. Rumours circulating on social media that CyberLeak had been arrested by the FBI have not been substantiated. As of late August 2026, no law enforcement agency or Rockstar had issued an official statement about any arrest.
Chapter 9: Questioning the Motive
Why did CyberLeak do it? The answer seems more complicated than it first appears.
On the surface, CyberLeak framed the operation as a “social movement” – protesting Rockstar’s digital‑only distribution, opposing the lack of physical discs, and demanding an end to pre‑orders. But this moral veneer was quickly stripped away.
As Vice Cit bluntly put it: “The player‑rights message was merely moral signalling to gain public support … this person is making a lot of money.” IGN News Director Wesley Yin‑PooLe also noted that “there is huge scepticism” about the operation and that “most people think this is about money, not principles.”
Every leak video carried cryptocurrency promotions; every leak was accompanied by calls to buy the token; the entire rhythm of the campaign – nine days of leaks, a soaring market cap, and a perfectly timed cash‑out before the official reveal – all pointed to one conclusion: this was a meticulously planned financial operation, not a social movement.
CyberLeek even threatened to release more content unless Rockstar responded to its demands. This combination of extortion and cryptocurrency speculation represented a new form of cybercrime.
Chapter 10: Comparison with the 2022 Leak
The 2022 Lapsus$ attack and the 2026 CyberLeak incident were fundamentally different.
The 2022 attacker, Arion Kurtaj, was a teenage hacker whose motivation appeared to be showing off his technical skills rather than making money. Although he stole a large amount of data, he did not attempt to profit directly from it.
CyberLeak’s operation, by contrast, was entirely different – it was a financially driven, carefully orchestrated scheme. As Vice Cit stressed: “This is not the 2022 leak – this was carefully planned and executed to maximise their earnings.”
Another key difference lay in the nature of the data. The 2022 leak primarily involved early‑development videos; CyberLeak appeared to possess a playable GTA 6 development build, meaning the scale and potential damage of the leak were far greater.
Chapter 11: Impact on Rockstar
For Rockstar Games and Take‑Two Interactive, this leak could not have come at a worse time.
GTA 6 is scheduled for release on 19 November 2026 and is expected to be one of the biggest entertainment launches in history. Take‑Two projects net bookings of $8 billion to $8.2 billion for fiscal year 2027. Analysts forecast first‑week sales of 45 million copies – by comparison, GTA V has sold approximately 230 million copies over its lifetime.
In this context, any leak could damage marketing plans and brand image. Rockstar is famous for its secrecy – former technical director Obbe Vermeij said, “We always wanted to keep things under wraps – it made release day more exciting.”
Although experts believe the leaks are unlikely to seriously affect game sales, for a development team that has poured a decade of work and thousands of man‑hours into the project, having the game exposed in this manner before launch “will be devastating for many of those involved.”
Chapter 12: Lessons from the Blockchain
The CyberLeak affair provides a cautionary tale about blockchain technology and cryptocurrency regulation.
First, blockchain’s transparency is both a strength and a weakness. Although CyberLeak tried to remain anonymous, the public nature of on‑chain data enabled investigators to trace the flow of funds. From creator fees to wallet addresses, from trading records to KuCoin’s KYC accounts – every step was recorded on an immutable blockchain.
Second, the speculative nature of meme coins provides fertile ground for new forms of cybercrime. $CYBERLEEK went from zero to a $25 million market cap in just days – such extreme volatility attracts speculators and creates opportunities for market manipulation. CyberLeak used the leaked content as a marketing tool, converting the gaming community’s attention into demand for its cryptocurrency.
Third, the anonymity of cryptocurrency is eroding. As law enforcement becomes more adept at on‑chain analysis and cooperation with compliant exchanges grows, cybercriminals are finding that “anonymity” is becoming increasingly difficult to maintain.
Chapter 13: The Aftermath
As of late August 2026, the CyberLeak saga continues to unfold.
After the cash‑out, CyberLeak’s Telegram channel was shut down for copyright infringement, and its website mirrors were taken offline. But speculation about whether the hacker has been caught persists. A video filmed outside a courthouse in Nuremberg went viral on social media, purporting to show the arrest of CyberLeak, but the claim remains unverified.
Meanwhile, $CYBERLEEK tokens are still trading on exchanges, albeit far below their peak. Around 730 million tokens remain distributed across 68,000 to 78,000 wallets – for these investors, the value of their holdings has been drastically reduced.
Rockstar’s and Take‑Two’s legal actions are ongoing. Subpoenas have been issued, and investigations continue. As Vice Cit asked: “Was it really worth risking your freedom for this?” For CyberLeak, the answer may soon become clear.
Conclusion
The story of CyberLeak is a modern fable about technology, greed, and deception. It began with the 2022 legend of a teenage hacker who broke into Rockstar using a Fire TV Stick, and ended with a 2026 anonymous hacker cashing out $250,000 through a meme‑coin scheme.
The incident reveals several troubling trends: cybercrime is becoming increasingly sophisticated and financialised; the speculative nature of cryptocurrency provides fertile ground for new types of fraud; and even the world’s largest entertainment companies struggle to fully protect their intellectual property.
But this story also demonstrates the double‑edged nature of blockchain technology – the same transparency that allowed CyberLeak to manipulate the market also enabled investigators to trace its steps. In the digital age, anonymity may be little more than an illusion.
For Rockstar Games, GTA 6 is set to release on 19 November 2026. Regardless of whether CyberLeak is ultimately caught, this leak will stand as one of the strangest footnotes in gaming history – a tale of hackers, meme coins, and $250,000 that has left an indelible mark on the industry.