Cyberleek’s GTA 6 Protest Was a Solana Token Launch

GTA 6 leaks from a campaign calling itself Cyberleek have stopped, after a Solana token tied to the clips was cashed out. The first trades printed on August 15, three days before any footage landed, and Rockstar still has not named a source.

The group said it would keep dropping files until publishers apologized for digital pre-orders, paid unlocks, and games that die when servers close. The apology that arrived was for how long the official reveal took. The token did the rest of the work.

The Edict Borrowed a Real Fight

On August 18 the clips arrived with QR codes, a site, and a document styled as the CYBERLEEK Edict. It told readers, “Let it be absolutely clear: this is not a cash grab,” then asked them to fund a secret project and to buy the coin. Identity is still a brand, not a person. At least two X profiles pushed the name, and mapping accounts later flagged those handles as likely fakes after deleted AI images. Later videos even carried a watermark that read “CYBERLEEK DOES NOT HAVE TWITTER.”

The grievances were not invented in a vacuum. Pre-orders opened on June 25 for a single-player launch on PlayStation 5 and Xbox Series X|S. Rockstar’s own support page says the boxed SKU holds a download code so players can preload, and that a disc will not be included. That is the trigger the edict named. Digital stock cannot sell out, the text argued, so money should not move before reviews exist unless a factory is pressing real copies.

The third demand, an offline fallback when servers close, tracks a fight players already know. Ubisoft shut The Crew on March 31, 2024, and even boxed copies went dead. Stop Killing Games, started by Ross Scott after that shutdown, put 1,294,188 verified signatures in front of the European Commission, which declined a binding law on June 16, 2026. Overlap is why that campaign had to answer Cyberleek in public. “The reason he is leaking GTA 6 is his meme coin, this is all but helpful,” Stop Killing Games said on August 19. Director general Moritz Katzner added a second line for anyone tempted to ape the ticker: “Do not send these people your money.”

What the Three Commandments Ask

The edict boiled its floor, not its ceiling, into three rules it wanted every large publisher to follow, with GTA 6 used as the loudest hostage. The wording below is the campaign’s, not a studio policy paper.

THE CYBERLEEK EDICT

• Digital pre-orders: No one should pay on a storefront before release and independent reviews; physical pre-orders for actual media would still be allowed.
• Paid unlocks: “When someone pays USD 70+ for a game, they bought the data. All of it,” the text said, objecting to flags that lock single-player files already on the disc or in the download.
• Offline fallback: When support ends, ship a last patch so single-player content still runs locally, with The Crew cited as the warning case.

There is no public file dump showing that Grand Theft Auto VI’s paid extras are already sitting in the base build waiting for a flag. Rockstar’s Ultimate Edition is sold as extra vehicles, weapons, apparel, and story-threaded items, which is ordinary deluxe padding unless someone proves the lock-and-key trick. The campaign never produced that proof. It still warned, “If CYBERLEEK can reach Rockstar, no one is safe. This is a message to all big corpo: behave, or be the next target.”

A Four-Day Head Start on Solana

Read the chain in order and the leak stops looking like a protest that grew a coin. Divyasshree’s on-chain timeline of the token at Bitquery puts the domain live on August 14 at 18:30 UTC, paid with 13,878 ARIO, four days before a single GTA 6 frame. The mint ApZuxdpzMrbEYTGEzeY9afh5pj9d6qPRJCTgQYiipbKg printed its first Raydium trade the next evening at 21:07, at a fully diluted value near $55,000. Then came about 68 quiet hours, with hourly volume stuck between $4 and $2,500, until the clips hit around 17:00 UTC on August 18 with site and coin QR codes burned into the picture.

WHAT THE POOL DID

Those five wallets all bought inside six minutes while the 13x candle was still forming, then sold into the next hour. Bitquery could not link any of them to the creator. The leak still did what a listing event does. Holders were later asked to spend the token to vote on which clip came next, so the footage fed the ticker and the ticker picked the footage. Watermarks on the files Take-Two logged as UNAUTH_2026AUG_VIDEO2 included “BUY $CYBERLEEK ON SOLANA.”

By early September the original campaign had gone silent after a drop that looked like the prologue, and on-chain watchers put the operator’s take at over $270,000. The coin then fell apart. Impersonator accounts still paste old driving clips as fresh leaks. That noise is not the same operation that bought a domain on August 14.

Take-Two’s Paper Trail Outran the Site

Parent company Take-Two Interactive did not answer the edict. It went to the U.S. District Court for the Southern District of New York under DMCA Section 512(h), a tool that lets a rights holder unmask an alleged infringer without filing a full lawsuit. Kirkland & Ellis aimed the first wave at Microsoft and Discord on August 20. Ruttenberg IP Law followed with narrower asks at X Corp. and Google, naming @cyberleek_ar_io, @cyberleekario, and @MrCyberLeek, plus YouTube personas CyberLeeks, Surfer24k, and Cyberleek_ar_io. A judge later pushed back on the YouTube request, and Take-Two dropped it.

The Discord net was the wide one. Filings sought identifying data for every account that had been in three named servers since June 1, not only people who posted clips. Microsoft was asked for device IDs, IP logs, OneDrive contents, and its own internal notes on the “cyberleek” persona, including a GitHub path. Take-Two told the court the first Discord subpoena issued on August 21 and was “promptly served.” A Discord marketing director said around August 24 that the company had not been served. Both Microsoft and Discord had until September 4 to produce records.

WHAT WE KNOW

• Copyright signal: Takedowns and a Content ID hit on UNAUTH_2026AUG_VIDEO2 show Rockstar treats the pictures as its work; that is not the same as naming who first stole them.
• Second Discord pass: A late-August second Discord subpoena filing says the inquiry is “rapidly evolving and ongoing,” with one extra user identified and older targets narrowed, and with names redacted so nobody deletes logs.
• Xbox cooperation: Xbox CTO Scott Van Vliet said Microsoft was working with Take-Two and Rockstar “to support efforts to protect creative works and intellectual property.”

WHAT IS UNCONFIRMED

• The thief: No public arrest, and Rockstar has not tied Cyberleek to the 2022 network intrusion.
• The Discord lead: Sleuths have pointed at a user, stayinthegrindd!!, who seemed to hold some clips before the brand went viral; that is a lead, not a charging document.
• The build: Jason shooting “LEEK” into a wall implies someone had a playable copy, while other metadata still argues parts of the set are old.

Discord told a reporter it produces only what the law requires and pushes back when a request looks overbroad. The public site and Telegram still went dark in late August, the channel reading as unavailable for copyright infringement, and fresh clips kept appearing anyway until the prologue dump. Xbox CTO cooperation and a clerk’s stamp did not stop the last drops. They did outlast the manifesto page.

Rockstar Said Sorry for the Wait

On August 26, eight days after the first basketball clip, Rockstar spoke, and not to the edict. The studio did not discuss pre-orders, deluxe unlocks, or offline patches. It did not confirm Cyberleek as the thief. It talked about the team, the calendar, and a Netflix extended look set for August 27.

It would be an understatement to say that having videos of Grand Theft Auto VI gameplay leak in this way has been heartbreaking for our team, and this is obviously not how we intended for you to see the game after all this time.

Rockstar Games, statement on X, August 26, 2026

The same note said the studio was very sorry everything had taken as long as it had, from finishing the game to sharing official play. It asked people to wait for November 19 rather than learn the story from stolen files. That is an apology for delay and for a spoiled first look. It is not restitution, and it is not a policy change on storefront money. Take-Two CEO Strauss Zelnick had already told analysts on an August 7 earnings call that pre-orders had an “exceptional start” after only five days on sale in the quarter.

The threat that opened the week sat on X the same day the map and basketball clips landed. The named account promised more files if the companies stayed quiet.

https://x.com/cyberleek_ar_io/status/2089817883765358974

Daily dumps followed through late August, past the two-to-four count in that post, including a Leonida map, a plane pass, and a wall tagged in bullet holes. Then the original feed stopped. The November 19, 2026 release date did not move. Preload is still listed for November 12. The boxed code-in-box SKU is still a box with no disc.

The 2022 Hack Already Set This Pattern

This is not Rockstar’s first public wound on the same game. On September 18, 2022, a GTAForums user, teapotuberhacker, posted about 90 development videos after a network intrusion. Rockstar confirmed the breach the next day, said an unauthorized party had taken early Grand Theft Auto footage, and promised work would continue as planned. Take-Two filed takedowns. The person later tied to that wave, Arion Kurtaj of the Lapsus$ group, had asked to negotiate. Trailer 1, months later, still had to introduce Lucia, Jason, and Vice City to people who had already seen placeholder interiors.

Cyberleek is a different shape. There is no confirmed Slack path, no studio admission of a fresh intrusion, and no named defendant. The 2026 files look closer to a recent, playable build than those 2022 debug reels, which is why a prologue dump scared people more than a basketball minigame. The legal reply grew too, from takedown notices to 512(h) subpoenas that reach into Discord servers full of spectators. What did not grow is a public briefing on how another set of GTA 6 files walked out of the building, or a contractor laptop, four years after the last one did.

After the Prologue, the Feed Went Dark

Jason at a beach house, a wanted meter, a taser, a night flight, a nudist strip of Port Gellhorn: the August set was already more game than most players get before a review embargo. People who wanted Leonida cold now have to unsee it. People who agreed with the edict’s preservation line watched that argument get spent on a ticker Stop Killing Games had already rejected. Copycat channels still harvest the name. The original campaign has not used it on a new file since the prologue.

Take-Two still wants a person behind the alias. Rockstar still wants November 19. The boxed copy will still be a code. The coin that went live on August 15 is no longer the story the manifesto promised, and the clips it advertised are already out of the bag.

Disclaimer: This article is news reporting and analysis of a leak campaign, court filings, and a Solana token. It is informational only and is not investment advice, legal advice, or a recommendation to buy, sell, or hold any cryptocurrency, game pre-order, or other product. Readers who are considering a token, a pre-order, or any response to a leak should consult a qualified financial adviser or an attorney licensed in their jurisdiction before acting. Figures and case statuses reflect the primary pages and filings cited here and can change as Take-Two’s inquiry and the token’s market move.