Who is leaking GTA 6 — and how they are being hunted
Updated:
Subject
CYBERLEEK— alias
- In custody or charged
- No
- Identity
- Not established
- Person or group
- Undetermined
- Criminal case
- None opened
- Contact
- Telegram and his own site
- Signature
- LEEK
- Demands
- An end to digital pre-orders, offline play for single-player games
- Address
- NOT ESTABLISHED
- Nationality
- NOT ESTABLISHED
Where the case stands
MSK
- 8 clips leaked since 18 August
- 7 days this story has been running
- 11 days until Microsoft and Discord must answer
The company staying publicly silent is Rockstar: the studio has not said a word this whole time. Everything happening is being done by the publisher, Take-Two.
The short version
- On 18 August two GTA 6 gameplay clips and a screenshot of the full map of Leonida appeared online. Over the following days more recordings followed — a taser and a stolen truck, the weapon wheel, the radio with named stations, a stolen hypercar, a gas station, a store robbery and a strip club.
- What leaked is video, not the game. Nobody has a playable build: not in any release, not for sale. Anything offering to «download GTA 6» is a scam. On 21 August a technical Xbox Graphics Capture file with models and map terrain joined the clips — but that too is data, not a game.
- The author calls himself CyberLeek and frames the leak as a protest against digital pre-orders and single-player games that stop working. In parallel he trades his own memecoin, which he set up before the first leak.
- Rockstar has said nothing. The publisher is the one answering: Take-Two started sending copyright notices the same evening, and on 20 August the matter went to court.
- Nobody has been caught. No identity has been established, and half the «investigations» you may have seen fell apart on first inspection.
I do not publish or show the leaks themselves: what is in each clip is described below in words and tucked behind a cut. The breakdown of what Rockstar shows officially lives separately, on the third trailer page. The nine radio stations from the leaked radio menu, and every track identified so far, are on GTA 6 music.
The chronicle: leak and response
Two sides of one story: what was posted, and what was done about it. I do not publish or show the leaks themselves — what leaked is described in words and tucked behind a cut.
- August 18 evening
Two gameplay clips and the map of Leonida
What is inside, in words
This is where it all started: Jason at the waterfront house, and a highway drive with a van being rammed, a wrench fight and an escape from the police in a stolen ambulance. Plus a screenshot of the full state map. This is also where the important mechanics were spotted: the sixth wanted star is back (four unlit icons beside two burning ones), the police remember descriptions — clothing, vehicle and district — and there is basketball being played in a yard, the first since San Andreas, with the Focus stat rising for made shots. Rockstar said nothing publicly, but copies started disappearing under DMCA that same evening, and that is what people treat as proof of authenticity.
- August 18 evening
The first complaints landed the same evening
Rockstar said nothing publicly, but copies of the first wave began disappearing under DMCA within hours. From that point the absence of a complaint works the other way round: if nothing landed on a «leak», that is reason to doubt it is genuine.
- August 19 around 17:00 MSK
A taser, key cloning and a stolen truck
What is inside, in words
A night scene at the port: Jason gets tased first, takes the stun gun off his attacker and knocks out the rest, then picks a guard's hat off the ground and puts it on. Stealing a vehicle offers a choice — break the glass or clone the key — and Jason drives off in an MTL Packer rig. The clip ends on a cutscene: he and Cal Hampton are drinking beer on a boat, and Cal says «they don't know anything about me, I'm behind a VPN» — a line immediately read as a jab at the leakers themselves.
- August 19 20:00 MSK
«Junkies»: the weapon wheel and Zombix pills
What is inside, in words
The clip's name is literal: Jason attacks homeless people under an overpass with a knife. Then comes a fight with a police officer, the theft of a police motorcycle and a ride into the river. This is where the weapon selection wheel came from, something no trailer has ever shown: eight slots and two rings — weapons and items, the way Red Dead Redemption 2 does it. It holds two healing items, Zombix and EpiPen; Zombix are painkillers, and the game explicitly warns that taking them often makes them work less well.
- August 19 evening
Stop Killing Games: «do not send them money»
The detail
The player-rights movement whose agenda the leaker cites in his manifesto publicly refused to have anything to do with him. Its head, Moritz Katzner, called the methods «illegal and destructive» and asked people not to send these people money, «no matter how much sympathy you may have for them». The reason is simple: alongside the demands aimed at Take-Two, a Solana memecoin is being promoted, and QR codes pointing at the coin's site are baked into the frames. Trading in the token opened on 15 August — three days before the first leak, meaning the coin was set up ahead of the attention rather than on the back of it.
- August 19
Complaints move faster than the view counts
Take-Two sends notices to mirrors in a steady stream: a repost sometimes disappears minutes after it goes up. That speed is exactly what the community treats as proof the material is real — nobody files strikes over a fake.
- August 20 daytime
The radio is on: station names, a 2007 song and a LEEK signature
What is inside, in words
The first clip where the radio is not only heard but seen. It opens with a flight over Leonida in a blunt-nosed transport plane — something closer to a flying truck than a light sports aircraft. Then the player gets behind the wheel and flips through stations: Back Country Radio, Symphony FM and Stockyard FM all make it into frame. He settles on Stockyard FM, and out of it comes «Overpowered» by Róisín Murphy — a song from 2007. That is the first sign the airwaves will not be assembled from release-window new releases alone: radio music in GTA is licensed, and one track nearly twenty years old on the list means there will be more of the old stuff. Near the end Jason shoots a wall, and the bullet marks stay put instead of fading a second later. The recording ends with the author's signature — LEEK.
- August 20
Take-Two goes to court: subpoenas to Microsoft and Discord
The publisher filed DMCA subpoenas in the Southern District Court of New York, demanding that Microsoft and Discord hand over data that would identify whoever is behind the cyberleek name. Both companies were given until 4 September. This is the first step that moves the story from «the clip was taken down» to «they are looking for a person».
- August 21 daytime
Back after a day of silence: stealing a hypercar
What is inside, in words
One quiet day was enough for the internet to decide the leaker had been caught. He had not — that afternoon a clip a little over two minutes long went up. Jason walks up to a hypercar, a struggle prompt appears on screen, the driver is dragged out, and the rest is an ordinary drive through the city. Unforgettable and Players are playing on the radio. The press identified the car as a Truffade Thrax — the in-game Bugatti analogue, so «he stole a Bugatti» is close enough, even though nothing on screen names the brand. The highway and the industrial zone, on the other hand, come from the 19 August clip, though retellings run them as new.
- August 21 around 17:00 MSK
An Xbox Graphics Capture file: models and map terrain
What is inside, in words
This has nothing to do with the CyberLeek clips — something else leaked, and by a different route. An Xbox Graphics Capture is a snapshot of what the console’s GPU and CPU held in memory at one moment: models, textures, internal data. You cannot build a game out of it and you cannot play it, but the community has already pulled a height map of Leonida and a minimap texture out of it — the terrain and the outlines of places Rockstar has never shown. The insider videotech found the file; TheGamer, Insider Gaming and Gameranx wrote it up after him, and the file itself is being kept inside a closed circle rather than published. Why this one is marked unconfirmed: no copyright notice has landed on it, Rockstar is silent, and its authenticity rests on people in the community taking it apart rather than on any official reaction. The claim that it got out through a phishing attack on a Rockstar employee has been confirmed by nobody so far.
- August 21
The leaker's site opens a shop for ads inside future clips
The detail
A new «contact and advertising» section offers to sell space inside the next leaks: a placement in frame, a watermark, or gameplay shot around a particular brand — among the possible orders the page explicitly names pornography. No prices are listed for any of it: first you send 400 Monero, roughly $162,000, and that buys only a reply so negotiations can begin; what the advertising itself costs is settled separately over an encrypted messenger. He insists this is not a ransom — «publishers do not pay to make the leaks stop» — but «community support and partnership». The road from a manifesto about players' rights to a rate card turned out to be short.
- August 21 daytime
The leaker's own site stopped opening
The link on his own site no longer works, and posts on Reddit and X are pulled faster than they gather views. A side effect: the clips can no longer be numbered — some live about ten minutes, which is why outlets stopped keeping count.
- August 21 evening
The wallets lead to an exchange that checks ID
The detail
While the court route runs, the community is digging into the money. A write-up by a GTAForums user traces the site, the downloads and the token back to a single donor wallet, and that wallet to an exchange where you cannot sign up without documents. That detail matters: if the trail is real, the name sits in an exchange's records rather than in Discord. But for now it is a trail, not a name — and the deanonymisation side of this story has already fallen apart once.
- August 21 evening
Rockstar knows neither who is leaking nor how it got out
The detail
Jason Schreier in the Bloomberg newsletter: as of the afternoon of 21 August the studio had established neither who is behind the CyberLeek name nor how the breach happened at all. The whole of management is on the hunt, in what is described as an all-hands-on-deck mode. Even so, the 27 August premiere, the release date and the marketing plan are all staying as they are. The mood inside is described as «frustrated and exhausted»: the studio tightened its rules after the 2022 hack and it did not help. There is still no public statement — this is an account of what is going on inside, not something Rockstar has said out loud.
- August 22 around 15:00 MSK
A gas station, a store robbery and the door of a strip club
What is inside, in words
A continuation of yesterday's recording: the same Truffade Thrax, a little over two minutes. At a Xero gas station the pump offers two actions — refuel for 32 dollars or repair the car for 2,429. Then comes a store robbery: the clerk can be punched or shot, a Girardi ES9 pistol is in frame, and the register is emptied by hand; the noise brings the police and a chase begins. A crash on a bridge switches into slow motion: a wheel comes off, the brake discs are visible, pieces of the bumper scatter across the asphalt. It all ends at the door of a strip club — Jason takes a couple of steps inside and the recording cuts. A line is burned over the frame, «3MIL MARKETCAP = STRIPCLUB»: what is inside he will show once his coin reaches a three-million-dollar market cap, and on the evening of 22 August it was worth about half of that. Lucia, incidentally, has not appeared in a single one of the seven clips. Kotaku, Forbes, Insider Gaming and TheGamer all wrote the clip up.
- August 22 evening
Eighth clip: the strip club in full
What is inside, in words
The promise from the previous clip's watermark: the full club footage goes up once his token hits a three-million-dollar market cap. It did — and the clip followed: a little over two minutes almost entirely inside the venue, with the weapon wheel on a flashlight and binoculars, a cinematic camera with black bars, and a separate cutscene in a beach bar bathroom. RockstarINTEL, Dexerto and DSOGaming all wrote the clip up.
- August 22 daytime
The site was blocked, but deleting it did not work
The detail
Since yesterday the leaker's address opens not a site but a gateway refusal: «Requested content blocked by this node's content policy». That is not deletion — the page sits on a decentralised network where only the gateways ordinary browsers reach it through can be blocked. The seventh clip appeared in exactly the same place as the previous ones. The same mechanism tripped up the authors of the «investigation» into the 35-year-old German two days ago: the server they took for his own turned out to be a public gateway of that network, one that dozens of other names resolve to.
Official frames: who and where
Every still below was published by Rockstar itself: the same characters and the same places the chronicle talks about.
-
Jason Duval One of the game’s two leads — and the character being played in every single leaked clip. -
Cal Hampton Jason’s friend. The conversation with him on a boat is the cutscene that leaked as the third clip. -
The state of Leonida A screenshot of this state’s full map went online in the first wave on 18 August. -
Vice City at night The city whose streets the radio clip and the hypercar clip drive through.
Source: Rockstar Games press material from rockstargames.com. Reproduced here as illustration to the case.
What Take-Two is actually demanding
A DMCA subpoena is a court order to hand over data — not a lawsuit and not a verdict. Filed on 20 August in the Southern District Court of New York; both companies were given until 4 September.
Microsoft
- all internal business and investigative records from Microsoft's own investigation of the cyberleek persona
- account and device data
- IP addresses and phone numbers
- linked Xbox and Google accounts
- OneDrive contents relating to GTA and Rockstar
Discord
- account identifiers and the emails they were registered with
- IP addresses and device fingerprints
- linked services
- data on everyone who posted in the listed servers
period from 1 June 2026 onward
Servers and accounts named in the request
- CYBERLEEK
- CINEMATICROCKSTAR
- Surfer24k™
- Ødyssey.gg
- the Odyssey public guild
- the DarkViperAU editors' server
deadline to answer 11 days
- Being named in the request does not mean being involved. Nobody has been charged: the court is ordering data to be handed over, not finding anyone guilty.
- Last on the list is the editors' server of streamer DarkViperAU (Matthew Judge), who has nothing to do with the leak. He is in the request not as a suspect but as a venue whose messages the publisher wants to look through.
The contents of the request come from Kotaku and VGC, who read the filings themselves.
What did not actually happen
Six stories that travelled further than the leaks themselves.
-
«The leaker has been caught»
No
The rumour started after a day of silence. On 21 August he came back with a new clip. Neither Rockstar, nor Take-Two, nor any police force has reported an arrest.
-
«He's been identified — a 35-year-old German»
Unproven
The only source is an amateur write-up on GitHub which itself states that the identity has not been established. Its central piece of evidence, a «German server», turned out to be a shared public gateway of the ar.io network that dozens of unrelated names resolve to. The number «35» is not even in the original.
-
«There is a second group and it has the whole build»
Not confirmed
On 20–21 August word spread that a second group is working alongside CyberLeek: a screenshot from an internal April 2026 build, development files, access to an Xbox devkit and private employee data, all of it obtained by phishing a Rockstar employee in India. The source is a Reddit post and retellings on X; there is no independent confirmation, and insiders in the community say the group never had an Xbox devkit at all. One thing out of the whole story does check out — the Xbox Graphics Capture file — and it is not a build.
-
«Rockstar hired ex-Pentagon officers»
Invented
The source is Daily Noud, a parody account, posting on 19 August. The screenshot travelled onward without the note that it was a joke, and it looked convincing.
-
«The whole game leaked»
No
What leaked is gameplay recordings and a screenshot of the map — video, not a game. Nobody has a playable build: not in any release, not for sale.
-
«You can download GTA 6 right here»
A scam
An entire industry has grown around the leak: trojan installers, «early access» for $250 in crypto, hundreds of fake Rockstar sign-in pages. There is nothing to download — you are what's being downloaded.
The money: who actually profited
CyberLeek’s manifesto is about players’ rights, but a token of his own has been running alongside every clip the whole time, with QR codes pointing at the coin’s site baked into the frames. Stop Killing Games, the movement whose agenda he cites, publicly refused to have anything to do with him and asked people not to send these people money.
What it cost — and what he made
Headlines have the economics of this story upside down, so both sides are worth seeing side by side.
-
$2.83bn
wiped off Take-Two’s market value
The stock went from $248.13 on 18 August to $232.84 by the 20th. That is market valuation, not the company’s money — and the market was shaky in those days for other reasons too.
-
$40–60k
went to the leaker
fees from trading his own token; plus $390k in coins he cannot sell without collapsing the price
- The «12 million» that went round the headlines as his income is the token's turnover over the first day, not what he kept. No withdrawal has been recorded.
- One figure is roughly fifty thousand times the other.
- The token was set up before the leaked material appeared — created on 15 August, with the pool launched overnight into the 16th. That is the central argument of everyone who reads the whole «fighting for players' rights» framing as a wrapper around a coin.
- Since 21 August he has also been selling advertising inside future clips. Entering negotiations costs 400 Monero, roughly $162,000, and that buys only a reply — what the advertising itself costs is named nowhere.
This also happens to be the clearest answer to the question of what the whole thing was for. The token was created on 15 August and its pool launched overnight into the 16th — that is, before a single leaked frame existed. The coin was not set up on the wave of attention but ahead of it.
This has happened before — and here is how it ended
In the autumn of 2022 GTA 6 gameplay already leaked, and on a far bigger scale: more than 90 clips and the source code, posted to a forum under the handle teapotuberhacker. Behind it was a teenager, Arion Kurtaj of the Lapsus$ group. He was found — but the case never reached a verdict in the ordinary sense: the court ruled Kurtaj unfit to stand trial and sent him to a secure hospital indefinitely, to be released only when doctors considered him safe.
That story is still not over. In July 2026 Kurtaj was moved from the hospital to prison, and a retrial is scheduled for November 2026 — the very month GTA 6 finally ships.
And the thing worth taking from it: the 2022 leak had no effect on the development schedule at all. The release date did not move then, and it has not moved now.
What happens next
-
Rockstar's extended look
Netflix at 22:00 MSK, YouTube and Rockstar's site six hours later. That is when it becomes clear which parts of the leaks were real.
-
Microsoft and Discord's deadline
By that day both companies are due to hand over the requested data. After that the story either gets a name or hits a dead end.
-
GTA VI ships
The leak did not move the date. In 2022, 90 clips and the source code leaked, and it did not affect the schedule then either.
Sources
- RockstarINTEL — breakdown of the eighth clip: strip club and cutscene rockstarintel.com
- DSOGaming — clips six to eight: the drive and the strip club dsogaming.com
- Kotaku — the seventh clip: a strip club and a store robbery kotaku.com
- Kotaku — Rockstar still in the dark about who is leaking and how kotaku.com
- TheGamer — the Xbox Graphics Capture file: models and map data thegamer.com
- Kotaku — what the Microsoft and Discord subpoenas ask for kotaku.com
- VGC — Take-Two files subpoenas in hunt for the leaker videogameschronicle.com
- PC Gamer — what became of the hacker who leaked GTA 6 in 2022 pcgamer.com
What to actually do about it
Download nothing and send money nowhere — that is the only real safety rule in this story. And on 27 August, watch which parts of the leaks hold up: the schedule for the show is on the third trailer page.
Frequently asked questions
Has the GTA 6 leaker been caught?
No. As of 23 August 2026 no identity has been established, there have been no arrests, and it is not even known whether one person or a group is behind the CyberLeek name. The rumour of a capture spread after a day of silence — and on 22 August the eighth clip went up.
Did the whole game leak?
No. What leaked is gameplay recordings and a screenshot of the map of Leonida — video, not a game. On 21 August a technical Xbox Graphics Capture file with models and map terrain joined them — but that too is data, not a build. Nobody has a playable build, which is why every «download GTA 6» link leads to scammers rather than to the game.
What is Rockstar doing about it?
Rockstar itself has stayed publicly silent. The publisher, Take-Two, is the one acting: from the evening of 18 August it has been sending copyright notices to every mirror, and on 20 August it filed DMCA subpoenas in the Southern District Court of New York demanding that Microsoft and Discord hand over data identifying whoever is behind the leak. Both have until 4 September to answer.
What could happen to the leaker?
Nothing so far — nobody has been charged. The reference point is the previous case: in 2022 GTA 6 gameplay was leaked by teenager Arion Kurtaj of the Lapsus$ group, who was found unfit to stand trial and sent to a secure hospital indefinitely. In July 2026 he was moved to prison, and a retrial is scheduled for November 2026.
Will the leak delay the GTA 6 release?
Nothing suggests it will. The date is unchanged: 19 November 2026. In 2022, 90 clips and the source code leaked, and it did not affect the development schedule then.