GTA VI leaker allegedly cashed in $350,000 in cryptocurrency

Wallets related to CYBERLEEK meme-coins make approximately US$350,000 from liquidity provider fees

On-chain analyst Conor Grogan said that wallets related to CYBERLEEK meme-coins transferred approximately US$350,000 through liquidity provider fees after unauthorized GTA VI fragments attracted attention.

Summary

On-chain analyst Conor Grogan tracked approximately $350,000 in withdrawals that flowed into wallets linked to CYBERLEEK activity. Grogan said the gains come from liquidity fees rather than simply large-scale direct token sales. CyberLeek's controller has not yet been disclosed, and wallet analysis cannot prove the legal identity of the operator. Take-Two Interactive has obtained a federal subpoena requiring Microsoft and Discord to provide records related to unauthorized leaked footage of the game. Court documents show that Microsoft and Discord have until September 4 to file the required records.

Grogan said on September 1 that the funds flowed through multiple OTC providers. He attributed the wallets to the person or group responsible for leaking the GTA VI footage, but the identity of the person in charge has not yet been publicly confirmed. The analyst's post stated that these gains came entirely from liquidity charges, rather than the operator's direct sales of large quantities of CYBERLEEK tokens to the market.

Take-Two Interactive, the parent company of "GTA VI" developer Rockstar Games, is using federal court subpoenas to identify accounts involved in publishing and disseminating leaked material.

CYBERLEEK Wallet collects transaction fees

According to public blockchain data, CYBERLEEK was launched on the Solana chain on August 15. The project attracted attention because an online account using the CyberLeek name posted previously undisclosed clips of GTA VI. Liquidity providers deposit token pairs into the liquidity pool of a decentralized exchange. Traders use the pool to buy and sell assets and pay fees in accordance with platform rules, which are allocated to liquidity providers.

Grogan said that CYBERLEEK's operators benefit from this structure. Every time unauthorized GTA VI material is released, it attracts attention, and the ensuing token transactions create additional fees for wallets that provide liquidity.

This process does not require the operator to sell most of the original liquidity positions. Instead, wallets can charge fees while traders continue to exchange CYBERLEEK through the liquidity pool. Grogan described the arrangement as the first case he observed, where suspected hackers made profits simply by providing liquidity rather than dumping tokens. His statement reflects his analysis of wallet activity and is not the result of a court or law enforcement investigation.

On-chain data can show transfers, liquidity positions, and expense withdrawals, but cannot independently prove who controls the wallet, or whether the same person obtained and published Rockstar's copyright documents.

Wallet movement cannot determine the identity of the "GTA VI" leak

The individual or group behind CyberLeek remains unknown. No court documents, police statements or Rockstar announcements publicly linked a named person to the wallet Grogan analyzed. Therefore, calling the controller a "GTA VI hacker" is beyond the scope of the available evidence. Existing records show that the pseudonym CyberLeek posted unauthorized fragments and promoted tokens with the same name.

Grogan said the $350,000 flowed through multiple OTC providers. These services can facilitate direct asset trading between counterparties without having to route complete orders to a public exchange. Using an OTC provider does not automatically prove money laundering. Grogan uses the word "laundering" to describe these transfers, but no regulatory agency or court has ruled that the funds constitute proceeds of crime or that the service provider knowingly handled illegal transactions.

This distinction is important because blockchain attribution often relies on the association between transaction patterns, address tags, and wallets. Such methods can establish possible relationships, but may not necessarily reveal the ultimate beneficial owner. The case is similar to other memecoin structures in which locked or retained liquidity continues to generate revenue for its creators.

Take-Two traces Microsoft and Discord records

Take-Two filed a Digital Millennium Copyright Act (DMCA) subpoena request in the U.S. District Court for the Southern District of New York on August 20. One of the lawsuits is In re Take-Two Interactive Software, Inc., 1:26-mc-00421, requesting information from Microsoft. Court files state that GitHub is a Microsoft service that allegedly hosted copyrighted GTA VI material. Take-Two said the disputed material includes proprietary software, audio-visual content, works of art, pictures and dialogues from GTA VI. The company asked for information that could identify the suspected infringers.

The request is directed at Microsoft and Discord, requesting account identifiers, registration information, IP addresses, phone numbers, and some device data for accounts that may distribute or discuss leaked footage. The orders require both companies to submit the required records by September 4. Microsoft said it is working with Take-Two and Rockstar to protect its intellectual property. Discord said it will evaluate the effectiveness and scope of any subpoenas before responding. The company also said on August 25 that it had not received a subpoena as of then.

Obtaining identity information does not prove that the account holder has committed hacking, copyright infringement or other illegal activities. These records may help Take-Two determine who operated an account, but further evidence is needed to prove who obtained the clips.

Rockstar calls GTA VI leak "heartbreaking"

Rockstar publicly responded to the leak on August 26, saying the unauthorized release was "heartbreaking" for employees involved in game development. The company said that after years of development, this is not the way they want the public to see GTA VI. Rockstar went ahead with an expanded presentation on August 27 as planned, rather than changing its marketing schedule.

CyberLeek has released clips showing the driving, fighting and interaction of the GTA VI character Jason. The material appears to come from an unfinished version of the game, although Take-Two has not publicly explained how the documents were obtained. The leak is different from the security breach Rockstar encountered in 2022, when a development clip of an early version of GTA VI appeared online. Those convicted in connection with the incident have not been publicly linked to the current CyberLeek operation.

Rockstar did not say that the recent leaks had changed the development schedule of GTA VI. Its official information lists extended demos released after unauthorized fragments appeared.

CYBERLEEK fee model puts traders at risk

Grogan's findings suggest that the attention surrounding leaked materials can be translated into transaction revenue without the need for creators to conduct traditional token sales. When online events attract traders, memein prices can rise rapidly. Liquidity providers benefit from higher transaction volumes because fees can be incurred for each redemption, whether the buyer ends up making a profit or losing money.

This model could also bring token operators 'revenue in line with ongoing controversy. More clips may bring more attention, and more attention may increase trading volume and liquidity fees. Locking in liquidity does not eliminate this incentive. A liquidity pool may remain tradable while its creator continues to charge cumulative fees. Direct token sales are not the only way for insiders to make money.

Grogan has not released evidence that the entire US$350,000 has been converted into legal tender. His analysis showed money flowing through multiple providers and described the activity as cashing. The next step in confirmation may occur after the September 4 deadline for subpoena. Records from Microsoft or Discord may help Take-Two identify people associated with the account, although these disclosures may remain confidential during the company's investigation.

Prior to this, blockchain evidence supported the finding that wallets associated with CYBERLEEK collected and transferred large amounts of liquidity fees. However, this did not determine the legal identity of the controller, nor did it prove who obtained the GTA VI fragment.