GTA 6 ‘Cyberleek’ Leak Saga Explained: $250K Cash-Out, Four Court Cases, Zero Arrests

An anonymous group dumped GTA 6 gameplay clips online, launched a memecoin, then walked away with a quarter of a million dollars. Rockstar called the leaks “heartbreaking”, Take-Two went to court in New York, and nobody has been arrested. Here is the full GTA 6 Cyberleek story.

https://observer.co.uk/news/culture-1/article/why-is-grand-theft-auto-6-being-held-for-ransom

How the GTA 6 Cyberleek saga started: nine days of leaked clips

On 18 August 2026, an anonymous group calling itself CYBERLEEK began publishing GTA 6 gameplay clips on a custom website, alongside a manifesto and its own $CYBERLEEK memecoin. For nine days it was the only GTA 6 story anyone could talk about.

Roughly 14 to 15 gameplay videos leaked in total — Kotaku’s count sits at about 15 — plus a full image of the map, all drawn from what appears to be a 2025 development build. Insider NateTheHate noted the footage was “over a year old”, so the leaks were never a window into launch-week quality.

The group’s stated cause was protest: Cyberleek claimed it was punishing Rockstar’s “anti-consumer practices” of selling GTA 6 as a digital-only pre-order with no physical disc. But it also began asking for cryptocurrency funding “to keep the leeks coming”. Protest slid into pay-to-play.

Rockstar’s rare “heartbreaking” statement

After a week of silence, Rockstar broke cover on 26 August with a statement posted to its social channels: “It would be an understatement to say that having videos of GTA VI leak in this way has been heartbreaking for our team, and this is obviously not how we intended for you to see the game after all this time.”

The statement apologised to fans for the long wait — saying the team was “nearly there” — and asked players to avoid spoilers and experience the game for themselves on November 19. It was a remarkably candid admission from a studio that almost never comments on leaks, and it doubled as reassurance: the release date was not moving.

The next day, Rockstar aired the Extended Look — a 26-minute official showcase that premiered on Netflix and reached YouTube six hours later. It was a hit: the YouTube upload pulled 6.7 million views by Thursday morning.

The $250K cash-out that ended it

Here’s the twist the protest story never explained: the leaks stopped the day the money moved. In the early hours of 27 August — hours before the Extended Look — a GTAForums poster tracked withdrawals from the memecoin’s minting wallet. The mechanism was subtle: the 270 million token reserve had been burned, so the money came from trading fees collected as the token’s liquidity provider.

The reported figures: Kotaku put the withdrawal at about $250,000, PC Gamer reported “over $200,000” in fees, and Dexerto put it at more than $265,000.

The token went with it: the price fell 86%, from a peak of $0.034 to below $0.005, and the market cap collapsed from roughly $25 million to $3.23 million. As GamesRadar+’s analyst contact put it: “This isn’t the 2022 leak, this has been planned out and executed very intentionally to maximize the money they’ll make from this.”

The last verified CYBERLEEK message — on-screen text in the 26 August clip, transcribed by GamesRadar+ — read: “This build is actually recent and the game is not ready at all,” followed by “Trading volume price is how CL measures your support. CL will not continue without support. You decide.” The caveat from GamesRadar+ applies to all of it: “you shouldn’t trust the claims of a person or group openly peddling a meme coin.” And as of the most recent status check, no credible outlet has reported a verified CYBERLEEK leak since the early hours of 27 August.

Take-Two’s legal hunt: four court cases, zero arrests

Take-Two hasn’t sued anyone. Instead it has wielded the DMCA subpoena under 17 U.S.C. 512(h) in the Southern District of New York — civil discovery, not an accusation in court. The paper trail, as documented by GTA Intel from CourtListener records:

• Microsoft (filed 20 August; subpoena granted 21 August) — seeking internal investigative records on the “cyberleek” persona. Xbox CTO Scott Van Vliet posted that Microsoft was “working closely with Take-Two and Rockstar” on the matter.
• Discord, twice — the first granted 21 August; on 28 August Take-Two returned with a second, narrower, sealed request (granted 31 August), saying the investigation “is rapidly evolving and ongoing” and that it had “identified one additional Discord user”. The breadth of the first request became its own story: it covered a ~5,600-member server and creator DarkViperAU’s 100,000+ member server. DarkViperAU said publicly he knew nothing about the leaks.
• Google / YouTube — Judge Cronan pushed back, writing that Take-Two “has not provided any information as to how it identified the online personas” it was targeting. Take-Two withdrew on 28 August; the case closed 31 August, and the subpoena was never issued.
• X (granted 24 August) — covering three X accounts and demanding account IDs, IP logs, email addresses, phone numbers and device identifiers.

A sealed, narrower subpoena naming one further account followed on 1 September, and that order is the last entry on any of the four dockets. There is no John Doe complaint and no criminal docket. And critically: no arrest, charge or public identification has been reported by any credible outlet.

One more thread: on 11 September, GamesRadar+ reported Rockstar testimony at an employment tribunal over the dismissal of 34 staff, in which the studio said “hacker groups have attempted to blackmail the company as recently as the last few weeks”, and that privacy film had been put on windows after drones were flown to record work in progress. GamesRadar+ was explicit that it is “unknown if they’re the same ones” as CYBERLEEK — and Bloomberg’s August reporting said nothing connects the dismissed employees to the leaks.

What this means

For the November 19 launch: nothing has changed. Rockstar’s statement reaffirmed the date, the Extended Look aired as planned, and the leaks came from an old build — so treat every “the game looks rough” take with suspicion. At the 17 September Take-Two shareholder meeting, CEO Strauss Zelnick faced questions on delays and PC, not leaks.

For the saga itself: it increasingly looks like a cash-out wearing a protest’s clothes. The leaks stopped the moment the money moved, hours before the official reveal they were racing against. The token cratered 86%, the website went quiet, and Take-Two’s courtroom trail is the only part still moving.

For fans: avoid the clips if you want the game unspoiled — and trust only credible outlets. Between fabricated “full build” threats and malware-loaded fake “113GB GTA 6 ISO” torrents, the leak economy now feeds on hype as much as curiosity.

One month on, the CYBERLEEK story is a case study in the modern leak: part protest, part pump, and a reminder that in the run-up to the biggest launch in gaming history, the loudest voices in the room aren’t always on Rockstar’s side.

Sources

• GTA Intel — Where Is CYBERLEEK Now? The GTA 6 Leaker One Month On
• The Observer — Why is Grand Theft Auto 6 being held for ransom?
• The Games Wiki — August 2026 Leak (GTA VI)
• Tech Insider — GTA VI Leak: Rockstar Speaks Out, TTWO Drops 3.6%
• GTA Base — GTA 6 Leaks Timeline: Complete Recap of What Was Real or Fake
• GameCentral — Rockstar apologises for GTA 6 leaks in rare public statement to fans
• The Eastleigh Voice — Rockstar responds to GTA VI leaks as unreleased footage continues to spread