Where Is CYBERLEEK Now? The GTA 6 Leaker One Month On: A $250K Cash-Out, Four Court Cases, No Arrest

One month ago, an anonymous group calling itself CYBERLEEK began posting GTA 6 gameplay clips, a manifesto and a memecoin, and for nine days it was the only GTA 6 story anyone could talk about. Then Rockstar aired the Extended Look, the token was drained, and the group stopped. So where is CYBERLEEK now?

The short answer, as of September 19: nowhere anyone credible can see. No major outlet has reported a verified leak, post or statement from the group since the early hours of August 27, when whoever controlled the $CYBERLEEK token withdrew a sum on-chain analysts put between $200,000 and $270,000. Take-Two's pursuit has produced four court cases in New York and one sealed subpoena, but no lawsuit and no criminal case. Nobody has been arrested, charged or publicly identified. And this week a claim attributed to the group's website is circulating on smaller sites, unverified, that reads a lot like a threat that was exposed as a fabrication in August.

This piece is about the legal, platform and money trail. We are not describing, hosting or linking any leaked material, and we are not repeating any speculation about who is behind the account.

The short version

• Last verified leak: August 26, a clip carrying an on-screen message. Roughly 15 clips in total by Kotaku's count; other outlets say "more than a dozen."
• Last verified message: the on-screen text on that August 26 clip.
• The cash-out: August 27, hours before the Extended Look; $200,000 to $270,000 depending on which transactions are counted, per on-chain analysis relayed by Kotaku, PC Gamer, Dexerto and GamesRadar+.
• The token: down about 86% from its August 23 peak by August 27, per Kotaku. No credible September price update exists.
• Legal: four miscellaneous cases in the Southern District of New York; four DMCA subpoenas issued (Microsoft, Discord twice, X), one request to Google withdrawn. Nothing filed on the public docket after August 31.
• Arrest, charge, identification: none reported by any credible outlet.
• Rockstar: one formal statement, posted to Instagram on August 26. Nothing since.
• Since then: a Sept 17-18 archive dump that outlets attribute to the 2022 breach, not CYBERLEEK, and a Sept 19 "full build" claim that no major outlet has confirmed.

The last things CYBERLEEK said

The final week of the campaign was a slide from protest into pay-to-play. On August 21, PC Gamer reported that the group's website had added a "contact" tab offering "premium advertising space and exclusive content opportunities," reachable only after a "donation" of 400 Monero, roughly $165,000 at the time. No advertiser is reported to have taken it up. On August 24, per Kotaku, the group demanded that "at least 10 gamers" show up "dressed as leeks" outside Take-Two or Rockstar offices "holding game discs during working hours." Dexerto reported that one person turned up at Rockstar North in Edinburgh.

The August 26 clip carried the last message any credible outlet has attributed to the group. GamesRadar+ transcribed it: "This build is actually recent and the game is not ready at all," followed by "Trading volume price is how CL measures your support. CL will not continue without support. You decide." GamesRadar+ added the caveat that applies to all of it: "you shouldn't trust the claims of a person or group openly peddling a meme coin." The "secret project" the token was supposedly funding never materialised.

The group's stated cause had already been disowned by the people it claimed to speak for. Stop Killing Games, the consumer campaign against games being made unplayable, said on August 20, per Dexerto: "Do not send these people your money, no matter how much sympathy you may feel for their actions. This is illegal, and frankly, we feel for everyone at Rockstar having to go through this ordeal again." We covered the manifesto itself in Who is CYBERLEEK? and the memecoin in our cash-grab explainer.

The cash-out that ended it

The leaks stopped the day the money moved. On August 27, a GTAForums poster tracked a series of transactions from the token's minting wallet beginning, as PC Gamer relayed it, "at roughly 3:27 am EDT." Rather than a classic rug pull, the mechanism was subtler: the 270 million token reserve had been burned, so the money came from trading fees collected as the token's liquidity provider. Kotaku put the withdrawal at about $250,000, PC Gamer at "over $200,000" in fees and an estimated $270,000 for the trader involved, and Dexerto at "more than $265,000." The proceeds were swapped out of $CYBERLEEK and routed, in Kotaku's account, to "three different places, including CCE.Cash, a platform notorious for its 'privacy'"; blockchain analysis reported by CoinDesk had at least 91 SOL going to a KuCoin account. The GTAForums analyst's own inference, relayed by Dexerto, was that the different withdrawal methods "seem to suggest at least two people are involved." That is one poster's reading, not an established fact.

The token went with it. Kotaku's figures on August 27: a peak price of $0.034, then below $0.005, a fall of 86%; a market cap that had reached $23.39 million (CoinDesk's peak figure is roughly $25 million) and was down to $3.23 million "and falling fast." GamesRadar+ quoted the same analyst's verdict: "This isn't the 2022 leak, this has been planned out and executed very intentionally to maximize the money they'll make from this."

The timing is the tell. The withdrawal came hours before Rockstar's Extended Look, the moment the leaks would lose their scarcity value. No credible outlet has reported a CYBERLEEK clip since.

Take-Two's legal track: four cases, no lawsuit

Take-Two has not sued anyone. What it has done is use a specific tool, the DMCA subpoena under 17 U.S.C. 512(h), which lets a copyright holder ask a court clerk to order a platform to hand over identifying information about users accused of infringement. It is civil discovery, not an accusation in court, and it is filed without the other side present. Since we covered the first two petitions on August 22, the record on CourtListener has grown to four cases:

• Microsoft (No. 1:26-mc-00421). Filed August 20 by Kirkland & Ellis. Judge Jennifer L. Rochon ordered the clerk to issue the subpoena on August 21, with production due September 4. The request sought, among other things, Microsoft's internal investigative records on the "cyberleek" persona and identifying information on members of named Discord servers from June 1 onward. Nothing has been filed since.
• Discord, twice (No. 1:26-mc-00422). The first subpoena was granted August 21. On August 28, Take-Two came back with a second, narrower request and asked Judge Andrew L. Carter, Jr. to seal its contents. The public filing says the investigation "is rapidly evolving and ongoing," that Take-Two "has identified one additional Discord user and obtained additional identifying information for a previously identified Discord user," and that the second request "seeks different information than that sought from Take-Two's first subpoena." The sealing letter argued that disclosure could "tip off the alleged infringers as to the nature and progress of Take-Two's investigation," and used the plural "infringers" throughout. Judge Carter granted it on August 31, with production due September 14. That order is the last entry on any of the four dockets.
• Google / YouTube (No. 1:26-mc-00425). Filed August 21 by Ruttenberg IP Law, targeting one YouTube video and three online personas. On August 24, Judge John P. Cronan pushed back, writing that Take-Two "has not provided any information as to how it identified the online personas that it seeks to subpoena from Google." On August 28, Take-Two withdrew, saying it "no longer needs the particular information requested" but reserving the right to return. The case was closed August 31. This subpoena was never issued.
• X (No. 1:26-mc-00426). Filed August 21, granted by Judge Analisa Torres on August 24, covering three X accounts from June 1 onward and demanding account IDs, IP logs, email addresses, phone numbers and device identifiers, with production due September 8.

Two things the filings do not say. They do not say Take-Two has identified CYBERLEEK; the "identified" users are sealed, described as "believed to be involved in the same infringing activity," and this is discovery, not a charge. And they do not say whether Microsoft, Discord or X actually produced anything by the September 4, 8 and 14 deadlines. No compliance, objection or motion to quash has been reported, and as Dexerto put it on September 3, "no transfer of user data has been publicly confirmed." A CourtListener search for Take-Two dockets filed since mid-August returns only these four cases: no John Doe complaint, no criminal docket, no subpoena to Telegram or any crypto exchange. RECAP only mirrors what PACER users upload, so that is strong evidence rather than proof.

What the platforms said

Discord's official line, to Variety on August 21: "We review and comply with valid subpoenas when we receive them, as is standard and routine for companies like ours." Three days later its marketing director, Ryan K. Rigney, wrote on X that "Discord has not yet been served with a subpoena from Take Two," while Take-Two's August 28 filing says the first subpoena "was promptly served on Discord." Xbox CTO Scott Van Vliet posted that Microsoft is "working closely with Take-Two and Rockstar Games to support efforts to protect creative works and intellectual property," which GamesRadar+ read as cooperation "but again, that's not explicitly confirmed."

The breadth of the first Discord request became its own story. PC Gamer reported it covered a server with about 5,600 members and another, run by the GTA content creator DarkViperAU, with more than 100,000, seeking information on members from June 1 onward rather than only the accounts accused of sharing leaks. DarkViperAU said publicly that he knew nothing about the leaks and that no clips had been shared on his server, per Insider Gaming; he is a server owner named in a filing, nothing more. By September 3, Dexerto was reporting user backlash, with one summarising the mood as "Hope Discord appeals."

Arrested? Identified? No.

The "CYBERLEEK has been arrested" rumour we examined on August 20 is exactly where it was: unconfirmed. No arrest, charge, police or FBI involvement has been reported by any credible outlet through September 19. The viral "found" posts and "courthouse video" clips that circulated in late August were never corroborated. Dexerto's August 27 assessment still stands: Take-Two "don't appear any closer to unmasking Cyberleek at this point," at least publicly.

Community sleuths and some outlets have speculated about who is behind the account, working from posting times and on-chain timestamps. Nothing has been confirmed, no one has been charged, and we are not repeating the speculation. The only formal identification activity on the record is Take-Two's sealed civil subpoena, which is not the same thing.

For what it looks like when a Rockstar leaker is actually caught, the precedent is 2022: a teenager linked to the Lapsus$ group, whom a UK jury found in 2023 had carried out that hack, and who PC Gamer reported in August is awaiting a retrial. That case involved police, a trial and a name. This one, so far, involves none of those. Our complete history of the 2022 leak has the full story.

What Rockstar and Take-Two have said since

Rockstar's only formal public statement on the leaks was posted to its Instagram on August 26, the day before the Extended Look, calling them "heartbreaking for our team" and describing the game as "nearly there." It did not name CYBERLEEK, address the demands or mention legal action. We broke down the statement here. Nothing has followed it.

Two later items are easy to misread. On September 11, GamesRadar+ reported Rockstar testimony at an employment tribunal over the dismissal of 34 staff (a figure from that report; union statements earlier put it at 31 to 32) that "hacker groups have attempted to blackmail the company as recently as the last few weeks," and that the studio has put privacy film on windows after drones were flown to record work in progress. GamesRadar+ was explicit that it is "unknown if they're the same ones" as CYBERLEEK, and PC Gamer, relaying Bloomberg in August, said nothing connects the dismissed employees to the leaks. And at Take-Two's September 17 shareholder meeting, coverage records no remarks about the leaks at all; Strauss Zelnick fielded questions on delays and PC. Outside its court filings, Take-Two has said nothing about the leaker, as far as the outlets we checked show.

Has it leaked anything since?

Not as far as any credible outlet has reported. Two things this month have been mistaken for a CYBERLEEK return:

The September 17-18 archive. A roughly 190-192 GB dump of Rockstar material (Kotaku says 190 GB; Insider Gaming and GamesRadar+ say 192 GB) appeared online this week. Insider Gaming's reporting is that it "is not a new leak; it is actually data from the 2022 leak that has now resurfaced," passed between a few people since the original breach. Kotaku likewise treats it as separate from "the Cyberleak gameplay videos this summer." Neither attributes it to CYBERLEEK.

The September 19 "full build" claim. A message attributed to the group's website, saying it has been "setting up a Server to host the first GTA VI full build" and that a "dead man's switch" has been activated, is circulating on smaller sites and social video today. No major outlet has confirmed it, we have not verified it, and there is a direct precedent for caution: on August 23, Insider Gaming retracted its own report of a CYBERLEEK "release the build" threat after finding it "manufactured and circulated online by one of the many people copying or aping what CYBERLEEK is doing," adding that "there's no confirmation either way that CYBERLEEK does possess a full build of GTA 6." GamesRadar+ concluded in August that the group "increasingly appears to have limited access to a non-standard build." If a credible outlet verifies this week's message, we will update this article.

One more warning while we are here: TechRadar found that a "113GB GTA 6 ISO" circulating on torrent sites was "99.99% empty zeroes" with a small malicious payload that disables Windows security tools. There is no GTA 6 build to download. Anything claiming to be one is a scam or malware, as we covered in our download scam warning.

What to watch

The three production deadlines in the subpoena cases, September 4, 8 and 14, have passed without any public word on whether records changed hands. The things that would actually move this story are a new filing on any of the four SDNY dockets, a motion to quash from a platform, a John Doe complaint naming defendants, a law-enforcement action reported by a major outlet, or a Rockstar comment as November 19 approaches. Until one of those happens, the honest status is the one above: the money is gone, the accounts are quiet, the lawyers are working under seal, and nobody has been caught.

Sources

• CourtListener - In re Take-Two Interactive Software (Microsoft), 1:26-mc-00421, SDNY
• CourtListener - In re Take-Two Interactive Software (Discord), 1:26-mc-00422, SDNY
• CourtListener - Take-Two second Discord subpoena request, Dkt. 7 (PDF)
• CourtListener - Take-Two letter motion to seal, Dkt. 6 (PDF)
• CourtListener - Order granting second Discord subpoena, Dkt. 10 (PDF)
• CourtListener - In re Take-Two Interactive Software (Google), 1:26-mc-00425: withdrawal and closure (PDF)
• CourtListener - Take-Two Interactive Software (X Corp.), 1:26-mc-00426, SDNY
• PC Gamer - Court grants Take-Two's latest request for more user information from Discord as the GTA 6 leaker hunt intensifies
• GamesRadar+ - Take-Two's GTA 6 leak investigation is heating up as the publisher requests sealed subpoena
• Dexerto - Discord users outraged over GTA 6 leak subpoena seeking personal data from over 100k members
• Variety - Rockstar and Take-Two subpoena Microsoft and Discord over GTA 6 leaks
• Kotaku - Discord says it hasn't been served with a subpoena over GTA 6 leaks yet
• PC Gamer - As Take-Two seeks IP addresses and phone numbers of thousands, Discord says it's not been served
• GamesRadar+ - Xbox is "working closely" with Take-Two and Rockstar following leaks
• Insider Gaming - Take-Two's GTA 6 leaker subpoenas namedrop popular content creator
• Kotaku - GTA 6 leaks could be over as Cyberleek withdraws $250,000 and leaves memecoin to crash
• PC Gamer - Cyberleek may have just cashed out on their GTA 6 leak, earning over $200,000
• Dexerto - GTA 6 leaker Cyberleek cashing out over $250k from meme coin ahead of Netflix Extended Look
• GamesRadar+ - Cyberleek's GTA 6 leak flood looks to have ended in a $250,000 crypto grift
• CoinDesk - GTA 6 leaker cashes out of his own memecoin hours before Rockstar's gameplay reveal
• PC Gamer - The GTA 6 leaker is selling ads now
• Kotaku - GTA 6 leaker now encouraging people to antagonize Rockstar IRL
• GamesRadar+ - GTA 6 leaker uploads a clip hours after Rockstar calls the leaks heartbreaking
• Dexerto - Stop Killing Games condemns GTA 6 leaker
• Kotaku - Rockstar finally releases a statement on the GTA 6 leaks
• GamesRadar+ - Rockstar says hackers have attempted blackmail and drones have been used to spy on devs
• PC Gamer - Rockstar employees frustrated by GTA 6 leaks
• Kotaku - Take-Two boss answers an investor's question about frequent delays
• Insider Gaming - 192 GB of Grand Theft Auto 5 and GTA 6 content leaks online
• Kotaku - Another big leak: what was posted on September 17
• Insider Gaming - REDACTED: GTA 6 leaker report concerning 'releasing the build' has been removed
• TechRadar - Fake GTA VI ISO download is malware: 113GB download is 99.99% empty zeroes