Who Is CyberLeek? Everything We Know About the GTA 6 Leaker

Six clips in eight days, a crypto token deciding what leaks next, and federal subpoenas that provide some of the strongest public evidence that the footage is genuine. What is actually known, and what is still guesswork?

Nobody knows who CyberLeek is. Eight days of leaks, six gameplay clips and two federal subpoenas have not changed that.

What is known is what CyberLeek has done. Between 18 and 25 August, the pseudonymous entity published six clips of unreleased Grand Theft Auto VI footage, ran a token-funded poll letting buyers choose the release order, and priced direct contact at 400 XMR, roughly $165,000. Take-Two Interactive has now gone to federal court seeking information that could help identify those behind the distribution.

What CyberLeek actually is

CyberLeek is a persona. Not a confirmed individual, not a named group, and not, despite a lot of confident posting, anyone who has been publicly identified.

The groundwork was laid around 14 August 2026: a dedicated domain, a voting platform and a liquidity pool for a token called $CYBERLEEK all went live. The monetisation infrastructure existed before the first frame of leaked footage was published, suggesting the operation was planned rather than purely opportunistic.

The first clip began circulating on 17 August. By the early hours of 18 August, it had migrated to the blockchain and public forums, alongside a Discord user called "stayonthegrindd" discussing the incoming material in a server.

Every CyberLeek leak so far

Six releases appeared between 18 and 25 August 2026.

PHONEOCEAN does not host or distribute the leaked footage. The material is unauthorized and is the subject of ongoing legal proceedings.

Why the footage appears to be genuine

The available evidence strongly suggests that the clips are genuine GTA 6 gameplay rather than AI-generated material or recycled footage from the 2022 breach.

First, Take-Two's federal filings describe the material as unauthorized leaked gameplay from the unreleased Grand Theft Auto VI. The filings are not an independent forensic authentication of every clip, but they are among the strongest public evidence that Take-Two considers the footage genuine.

Second, the hypercar clip contains Tate McRae's "Sports Car" on the in-game radio. The track was released in January 2025, making a 2021 or 2022 build highly unlikely.

Third, the August 25 footage shows the player shooting the word "LEEK" into environmental geometry using bullet decals that appear in real time. That is consistent with playable game footage rather than a fixed marketing video.

Fourth, Rockstar Games addressed the leaks on August 26, warning that the intended game experience may now be affected by spoilers. Rockstar's response further supports the conclusion that the material being circulated is genuine GTA 6 content.

There is still no public technical forensic report establishing exactly which development build the footage came from.

One unusual detail is that every publicly circulated clip so far features Jason rather than Lucia. That could suggest access to a specific development or testing environment, although there is no public evidence showing how Rockstar's internal builds are divided.

The manifesto and the India price tag

CyberLeek has published a manifesto framing the leaks as a consumer-rights campaign.

Its stated grievances include the use of download codes instead of discs for physical copies, complaints about premium-edition content and demands for offline functionality so single-player experiences remain playable after online services eventually shut down.

These are CyberLeek's claims and should not be treated as established facts about Rockstar's business practices.

For Indian buyers, the pricing argument has a specific figure attached. Rockstar lists the Standard Edition at ₹5,999 and the Ultimate Edition at ₹7,499, a ₹1,500 difference covering exclusive vehicles, weapons, clothing and in-game services.

Whether that represents withheld content or ordinary deluxe-edition packaging is part of the argument CyberLeek is making.

Stop Killing Games, a leading game-preservation campaign, has also condemned the operation as destructive and urged people not to fund it.

The part that undercuts the whole argument

Alongside the manifesto sits a token.

Buying $CYBERLEEK grants voting rights on CyberLeek's own platform, with those votes determining which piece of leaked material is released next.

The operation has also advertised direct communication or "ad space" for 400 XMR, or roughly $165,000.

The token reportedly reached a peak market capitalisation of around $1.1 million. That figure should be attributed to the relevant market data rather than described as independently verified unless the underlying source is available.

It is difficult to argue that a publisher is over-monetising a video game while simultaneously using leaked game content to attract attention and financial activity around a token.

Take-Two's federal hunt

Two DMCA subpoena petitions were filed on 20 August 2026 in the Southern District of New York. The requested compliance deadline is 4 September 2026.

The Microsoft and GitHub request seeks internal business and investigative records concerning the "cyberleek" persona and a research repository tracking the leaks.

The Discord request is considerably broader. It seeks information including user IDs, email addresses, IP addresses, phone numbers, linked Xbox accounts and MachineGuid hardware identifiers associated with users who communicated in three named servers during the specified period.

The requested MachineGuid and Xbox-linked records could potentially help investigators connect online activity to specific devices.

Discord has said it will review and comply with valid subpoenas. Any claim about Microsoft's cooperation should be attributed to Microsoft's own statement or the relevant court material.

The investigation has also caught bystanders. One named server belongs to creator Matthew "DarkViperAU" Judge, who publicly expressed confusion about why it had been referenced.

A subpoena is a demand for information, not an accusation. Being associated with a named server does not establish involvement in the leaks.

Who CyberLeek is not

CyberLeek is also being confused with Arion Kurtaj, the Lapsus$ affiliate behind the major GTA 6 breach in 2022.

Kurtaj used the alias "teapotuberhacker" during that incident, which exposed around 90 early development videos.

The 2022 material was early, debug-heavy footage containing development information. The 2026 material circulating under the CyberLeek name appears considerably more polished and playable.

There is no public evidence establishing that Kurtaj is behind CyberLeek.

Another name circulating in the investigation is the Discord handle "stayonthegrindd." Community researchers have attempted to connect the account to the distribution of the leaked material by comparing message timestamps with blockchain upload activity.

That may make the account a credible lead in the distribution chain, but it does not identify the person behind CyberLeek and should not be reported as an identification.

The leek ultimatum

CyberLeek claims to possess the GTA 6 prologue, the game's opening narrative sequence, including material involving Lucia.

The operation has reportedly threatened to release it unless at least ten people gather outside Rockstar or Take-Two offices during working hours, dressed as leeks and carrying physical game discs.

At least one person appears to have participated in the stunt, filming themselves eating a leek outside Rockstar North in Scotland.

However, the existence of the Lucia prologue in CyberLeek's possession has not been independently confirmed. The fact that other GTA 6 gameplay has been genuinely leaked does not prove that the prologue is also in its hands.

What is still unknown

Three questions matter most.

Can Take-Two's legal requests identify the person or people operating CyberLeek?

Does CyberLeek genuinely possess the claimed GTA 6 prologue, or is the threat being used to maintain attention around the operation?

And, most importantly, who is actually behind the name?

For now, the evidence remains a mixture of confirmed legal action, leaked material, public statements, online research and unverified claims.

One thing is already clear: the leaks have forced Rockstar and Take-Two to respond publicly and legally before GTA 6's official launch.

Rockstar has kept GTA 6's November 19, 2026 release date intact and will have its own turn in the spotlight on August 27, when the "Extended Look" presentation is scheduled to premiere at 3 PM ET, or 12:30 AM IST on August 28 in India.

It will be the first major opportunity since the leaks began for Rockstar to control the frame again.

For anyone searching for GTA 6 APKs, mobile versions or unofficial PC builds, Rockstar's official release platforms are PS5 and Xbox Series X|S. Files claiming to be playable versions for other platforms should be treated as potentially malicious rather than legitimate GTA 6 releases.

CyberLeek has bought attention, votes and a reported $1.1 million market cap.

The one thing the token cannot buy is the September 4 deadline.