.jpg)
CYBERLEEK wallets collected trading fees
Grogan said on September 1 that the funds passed through several over-the-counter providers. He attributed the wallets to the person or group responsible for the GTA VI leaks, but the controller's identity has not been confirmed publicly. The analyst described the proceeds as coming entirely from liquidity fees rather than the operator selling a large CYBERLEEK allocation directly into the market.
CYBERLEEK launched on Solana on August 15, according to publicly reported blockchain data. The project gained attention as an online account using the CyberLeek name released previously unseen footage from GTA VI. A liquidity provider supplies token pairs to a decentralized exchange pool, and traders pay fees distributed to liquidity providers. Each release of unauthorized GTA VI material attracted attention, while the resulting token trades produced additional fees for the wallet supplying liquidity.
The process did not require the operator to sell the bulk of the original liquidity position. Instead, the wallet could collect fees while traders continued exchanging CYBERLEEK through the pool. Grogan described the arrangement as the first instance he had observed in which a suspected hacker made money solely through liquidity provision rather than dumping a token.
Wallet movements do not identify the leaker
The individual or group behind CyberLeek remains unknown. No court filing, police statement, or Rockstar announcement has publicly connected a named person to the wallets examined by Grogan. The available record shows that the CyberLeek alias distributed unauthorized footage and promoted a token carrying the same name. Grogan said the $350,000 passed through several OTC providers, which can facilitate direct asset trades between counterparties without routing through a public exchange.
Using an OTC provider does not automatically prove money laundering. Grogan used the term washed to describe the transfers, but no regulator or court has ruled that the funds constituted criminal proceeds or that the service providers knowingly processed illegal transactions. Blockchain attribution often relies on transaction patterns, address labels, and links between wallets. Such methods can establish probable relationships, but they may not reveal the ultimate beneficial owner.
Take-Two pursues Microsoft and Discord records
Take-Two Interactive, the parent company of GTA VI developer Rockstar Games, filed Digital Millennium Copyright Act subpoena requests in the U.S. District Court for the Southern District of New York on August 20. One proceeding sought information from Microsoft, with the court docket identifying GitHub as the Microsoft service that allegedly hosted copyrighted GTA VI material. Take-Two said the disputed material included proprietary software, audiovisual content, artwork, images, and dialogue from GTA VI.
Related requests directed at Microsoft and Discord sought account identifiers, registration information, IP addresses, phone numbers, and some device data connected to accounts that may have distributed or discussed the leaked footage. The orders directed the companies to produce the requested records by September 4. Microsoft said it was working with Take-Two and Rockstar to protect their intellectual property. Discord said it would evaluate the validity and scope of any subpoena before responding.
Rockstar calls leaks heartbreaking
Rockstar publicly addressed the leaks on August 26, describing the unauthorized release as heartbreaking for developers who had worked on the game. The company said the footage was not how it intended the public to see GTA VI after years of development. Rockstar continued with its planned extended presentation on August 27 rather than changing its marketing schedule.
CyberLeek had released clips showing driving, combat, and interactions involving GTA VI character Jason. The material appeared to come from an unfinished version of the game, although Take-Two has not publicly explained how the files were obtained. The leaks differed from Rockstar's 2022 security breach, when development footage from a different Rockstar title appeared online after a hack. Obtaining identifying information through the subpoenas does not establish that an account holder committed hacking, copyright infringement, or another offense. The records could help Take-Two determine who operated an account, but further evidence would be needed to prove who acquired the footage.
