The GTA 6 leaks and a cryptocurrency: how the CYBERLEEK scheme works

Since August 16, an anonymous project calling itself CYBERLEEK has been publishing materials it presents as GTA 6 leaks: a clip showing basketball outside a house, fragments of the world map, and scenes involving car theft and gunfights. Its organizers frame the campaign as a defense of gamers' rights and claim to be protesting digital game pre-orders. At the same time, they are promoting a token called $CYBERLEEK. We have already examined what the clips actually show. This article focuses on the financial side of the project.

CYBERLEEK distributes the alleged GTA 6 materials through its website and associated accounts. Its organizers have not identified themselves or explained how they obtained the files. The $CYBERLEEK token was issued on the Solana blockchain and has no official connection to Rockstar Games, Take-Two, or GTA 6. It is an independent crypto asset that can be bought and sold through decentralized exchanges.

That is the connection we set out to examine: did the token merely appear alongside the leaks, or were the GTA 6 materials used from the outset to promote it and create a potential source of profit?

Transactions on Solana are public: anyone can see wallet addresses, transfer amounts, and timestamps. No names are attached, but the sequence of transactions makes it possible to establish how the CYBERLEEK website, the token launch, and the wallet used to distribute the materials are connected.

Our analysis breaks that sequence into three stages, and their order is crucial.

First, a single wallet funded three connected parts of the project: the website's domain registration, the token launch, and the wallet later used to distribute the leaks. More than seven hours before the first material appeared, the token was created and its initial liquidity was added. Only then was the first alleged leak published — an image of the map. The videos that followed already contained embedded advertising for $CYBERLEEK.

That advertising is not a note in the description. A "BUY $CYBERLEEK ON SOLANA" banner rides on top of the picture in every clip: it drifts around the frame so it can't be cropped out, and it's baked into the files themselves — before publication, all four videos were processed with the same software, which is when the banner went in.

The sections below examine this sequence in detail. We rely only on public blockchain transactions and data contained in the published files. The records establish a financial connection between the different parts of CYBERLEEK, but they do not reveal who runs the project, where the GTA 6 materials came from, or whether the organizers have made any profit.

Alongside the list of leaks, the project's site hosts a manifesto its authors call the Edict. It makes three demands, and on their own they read like a tired gamer's wishlist. First: no digital pre-orders — you should only pay for a game after release and independent reviews (the group allows physical pre-orders). Second: no fake single-player DLC — the kind where the content already sits in the files you bought, and what you're sold is merely the key that unlocks it. Third: if a game has a single-player mode, the publisher must ship a final patch when servers shut down so the game keeps working offline.

Violators, the group promises, will be punished with leaks until they publicly apologize and make amends. The wording is militant: "If CYBERLEEK can reach Rockstar, no one is safe."

Right there on the site, the second half of the story begins. The group is raising money for a "secret project": the details, it says, can't be revealed — the corporations would have time to prepare. It stresses that this is "not a cash grab": the funds will supposedly go toward infrastructure and protection from corporate counterattacks. The fundraising runs through the $CYBERLEEK token — the site has buy buttons built right in. It also hosts a vote on the next clip, and a "vote" isn't a click: it's a transfer of coins to the project's account. The money stays with the project; you can vote with coins you already own.

The "secret project" can't be verified. The money can: every cryptocurrency transfer is visible to anyone and stays in an open ledger forever.

On August 15 at 17:20 — by its confirmation time — the $CYBERLEEK coin was created. Three minutes later, exactly one billion of them were minted. Seven minutes after that, 27% of the total supply — 270 million coins — moved in a single transfer to a separate reserve account. That evening the creators gave up their ability to mint any more coins — something the site brandishes as proof of honesty.

Overnight, on August 16 at 00:07, the shared pool went live — the place where the coin is bought and sold. Into it went 730 million coins and 330 SOL: about $27,000 at the August 19 exchange rate. At 00:19 the creators locked themselves out of taking that money back (trading through the pool still works) — the standard "we won't run off with your cash" gesture.

And only at 01:08 did the first item appear on the site — an image of the map.

From the coin's creation (17:20:54) to the first leak (01:08:08), 7 hours and 47 minutes passed. The whole structure — from minting to storefront — came together in less than a day. The coin came first; the "activism" followed.

The "defenders of gamers' rights" and the token aren't two projects that happened to collide. The bills came out of the same pocket.

An account that starts with 3YLNDXnV and ends in vuNA4 paid for all three parts of the scheme. On August 14 it sent 1.0 SOL — about $80 — for the site's address. On August 15 it sent 39.69 SOL, roughly $3,000, in eight transfers to the account that went on to create the coin and fill the pool. And the same day, at 20:14, it sent 4.61 SOL — under $400 — to the account from which all the leaks are published.

Ten transfers over two days — one payer, three destinations: the site, the coin, the publications. Anyone can check: open that account and every operation is right there, with amounts and timestamps. We could not establish, however, where that account's money originally came from.

The figures surrounding the token look impressive, but most represent notional market value rather than money the organizers have actually received.

The most concrete figure is the initial deposit: those 330 SOL, about $27,000 at the August 19 rate. By August 20 the market valued everything in the pool at roughly $360,000 — the assets' value at a specific moment, not earnings for the token's creators. In the vote on the next clip, about 69,700 coins — roughly $88 — had been transferred to the leading option's account by the morning of August 20; the other three accounts were empty. The vote closed the same day at 12:26 Moscow time; whether the creators will actually release the clip is unknown.

The set-aside reserve — 270 million coins — would have been worth about $342,000 at the August 20 price. But it can't be sold for that: dump the whole reserve into the pool and the price slides while the sale is still going, leaving noticeably less in hand. The words "earned" and "cashed out" don't apply here.

And most importantly — here's what has not happened in this story. There are no sales from the key accounts. The reserve hadn't moved by a single coin as of August 20. We found no trace of any exchange into ordinary money. Who owns the reserve account is unknown: the way the supply was split points toward the organizers, but proves nothing (current figures on the coin are on Dexscreener).

The people behind CYBERLEEK have also threatened to publish GTA 6's ending, claiming they have access to a full build of the game. Those claims have not been independently verified.

The central finding of our analysis concerns not the origin of the files, but their connection to the token. A single wallet funded the CYBERLEEK website, the creation of $CYBERLEEK, and the wallet used to distribute the materials. The token was launched before the first leak appeared, while subsequent videos contained embedded advertising for it. This does not prove fraud, but it does show that the leaks and the crypto project were parts of the same promotional campaign from the outset.

We found no evidence that the CYBERLEEK organizers have made a confirmed profit. The wallet holding 270 million tokens remains untouched, and there are no signs that the reserve has been sold or that funds have been cashed out from the key addresses. If the tokens begin to move, the public transaction history will make it possible to trace their destination. A transfer alone, however, would not prove a sale or a profit.

Rockstar's official GTA 6 gameplay showcase will premiere on Netflix later this month. It should provide more material to compare with CYBERLEEK's releases. We collect all confirmed information about the game in our GTA 6 hub, and we will update this article if new transactions appear on wallets associated with the project.

How do you feel about leaks that also serve as advertising for a crypto token? Share your thoughts in the comments.

All wallet addresses and transactions mentioned in this article are publicly available. The listed times indicate when each transaction was recorded on the blockchain. Dollar estimates are tied to the dates specified in the text and may change with cryptocurrency exchange rates.