GTA VI: A Leaker Turned Stolen Footage Into a $25M Memecoin

On the evening of 18 August 2026, a short video appeared on X showing Jason Duval, one of the two lead characters in Grand Theft Auto VI, shooting hoops outside his house. Grand Theft Auto VI, made by Rockstar Games, was three months from release and is the most anticipated video game in years. Nobody outside Rockstar was supposed to have seen it played. The account that posted the clip, called CyberLeek, stamped it with the name of a cryptocurrency: $CYBERLEEK.

The token had existed for three days and was worth about $40,000. Within hours of the first footage it was worth more than $2 million, according to the crypto news site Protos. By 23 August, after a run of near-daily leaks, its market value peaked at about $25 million on figures from GeckoTerminal, a site that records every trade. Protos later put the high at almost $40 million. On 10 October it stood at about $4.3 million, roughly 83% below the top.

A memecoin with a cause

$CYBERLEEK is a memecoin: a digital token with no company, no earnings and no assets behind it, priced purely on attention, closer to a collectible trading card than a share. It runs on Solana, a blockchain network popular for this kind of token. The market value quoted for it is the last trade price multiplied by every token in existence, the same sum that gives a company's market capitalisation, though with no business underneath.

CyberLeek presented the token as a war chest. Its website said the money would fund a "secret project" and the "security and protection required to withstand the inevitable corporate counterattacks", and insisted "this is not a cash grab", Protos reported on 19 August. The stated grievance was consumer rights. Grand Theft Auto VI ships on 19 November for the PlayStation 5 and Xbox Series X/S, and its boxed "physical" edition contains a download code, not a disc. Strauss Zelnick, Take-Two's chief executive, has said the company would not rule out a true disc version later, IBTimes UK reported. CyberLeek said it would target any games company that sells digital pre-orders, locks single-player content behind paywalls or fails to keep games playable offline. It told Rockstar and its parent company, Take-Two Interactive, that the leaks would stop when they issued "a public statement and apology with a concrete commitment to do better", according to IBTimes UK.

Not every campaigner wanted the help. Stop Killing Games, a consumer group that lobbies for the preservation of games, said the leaks risked "tarnishing the reputation of our communities", Protos reported.

Leaks on demand

The clips came every day or two. Jason driving, fighting and stealing a security guard's Taser. A nightclub. A police chase through Vice City, the game's version of Miami, in the fictional state of Leonida. On 21 August a clip showed Jason flying a plane, then firing a gun into a wall until the bullet holes spelled "LEEK", proof that someone was playing a live copy rather than replaying old footage. "Yes I have [a] playable build of the game," CyberLeek wrote, according to IBTimes UK.

Then the token became a remote control. CyberLeek ran polls on its website in which holders of $CYBERLEEK voted on the next leak, PC Gamer and Protos reported. One poll offered a beach, a second strip club or a "Nudist Town". The nudists won, and on 24 August a two-and-a-half-minute clip of naked characters around a pool followed. The website also offered advertising space to companies willing to pay $162,000 in Monero, a cryptocurrency designed to be hard to trace, according to Protos. CyberLeek also asked ten fans to gather outside Rockstar North, the studio in Edinburgh that leads development. Dexerto reported that one turned up.

On 26 August CyberLeek posted around five minutes from the opening of the story of Lucia Caminos, the game's other lead, which Forbes games writer Paul Tassi called the "first true spoiler". Rockstar responded the same day. The team was "heartbroken", it said, adding: "While it is unfortunate that the intended game experience may now be impacted by some spoilers, we hope that everyone will wait a bit longer to experience the game for themselves on November 19." The following day Rockstar aired its official 20-minute "Extended Look" in a partnership with Netflix.

Following the fees

©CMZ chart. Data: GeckoTerminal

The leaker did not need the token to rise in order to earn from it. CyberLeek's wallet created $CYBERLEEK on 15 August and placed it in a trading pool on Raydium, a Solana exchange that works without a broker: buyers and sellers trade against a pot of tokens and cash, and every trade pays a small fee. The wallet that set up the pot collects those fees, a little like a market maker keeping the spread on every share that changes hands. In the nine days from 18 to 26 August, about $114 million of the token traded through the main pool, GeckoTerminal data shows.

On 27 August, hours before the Netflix broadcast, the fees came out. CoinDesk reported that the wallet claimed about $146,000 in Solana's currency plus 15.4 million $CYBERLEEK tokens in fees, then sold the tokens for about $125,000. A member of the GTA Forums fan site, ViceCit, who had followed the wallet since the first leak, traced roughly $268,000 in withdrawals across four transactions, as reported by GosuGamers and Dexerto. The money went through several wallets to KuCoin, a large crypto exchange, to CCE.Cash, a swap service that does not ask for registration, and to other wallets where some of it had not yet moved. "The KuCoin and CCE.Cash transactions seem to suggest at least two people are involved," ViceCit wrote. None of this has been confirmed by any authority, and the wallet's owner has not been publicly named.

The token fell hard. On 26 August it dropped almost 40% in a day, Protos reported, and by the end of 27 August it was worth about $3.2 million on GeckoTerminal's figures. By mid-September it had slipped below $500,000.

Take-Two goes to court

Take-Two did not wait. On 20 August its lawyers filed two requests in the US District Court for the Southern District of New York for subpoenas against Microsoft and Discord, court records show. They used section 512(h) of the Digital Millennium Copyright Act, a US law that lets a copyright owner make a platform reveal who posted infringing material without first suing anyone. Requests naming YouTube followed on 21 August, and Protos and Notebookcheck reported that X was also targeted.

The Discord request sought account IDs, email addresses, IP addresses, phone numbers, linked Google and Xbox accounts and message logs for everyone active in three named Discord servers since 1 June. The Microsoft request covered GitHub, Microsoft's code-sharing site, where Take-Two said leaked material had appeared in a repository, plus any OneDrive or Xbox records tied to "cyberleek". Discord users complained that the request swept in more than 100,000 members, Dexerto reported. By 1 September Take-Two had asked the court for a second, sealed subpoena to Discord, saying it had identified one additional Discord user and gathered more on one already identified. Its investigation was "evolving rapidly", the filing said, and public disclosure could let "the infringers" destroy evidence. It withdrew the YouTube request. No one has been charged or named in public.

Back for an encore

CyberLeek went quiet after the Netflix broadcast. On 5 October a new poll appeared on its website, and on 8 October it returned with "An Extended Leek", about 25 minutes of footage showing what appears to be a first-person camera mode, missions, cutscenes and both leads, Jason fully naked and Lucia in only bikini bottoms, Dexerto and Protos reported. The upload was not independently verified, and Rockstar had not commented on it by 10 October.

The token moved again. Its market value rose about 200% over two days around the new footage, Protos reported. On 10 October it nearly tripled again with no announced reason, briefly touching a market value of about $6 million before settling near $4.3 million. That day at least ten new tokens using the CYBERLEEK name were created on Solana, GeckoTerminal listings show, and two of them were paired with tokens named TTWO, Take-Two's stock ticker.