What We Know About the Guy Behind the GTA 6 Leak: CyberLeek

Grand Theft Auto VI has already survived one of the biggest leaks in gaming history, but what is happening now feels very different. In 2022, dozens of early development videos suddenly appeared online after Rockstar's internal systems were compromised. This time, the person or group behind the footage is actively turning the leak into an ongoing event. New clips are being released gradually, each one carrying CyberLeek branding, links to a dedicated website and promotion for a cryptocurrency connected to the same name. There is even a voting system that has allowed people to spend the token to influence what footage gets leaked next.

The identity behind CyberLeek is still unknown. We do not even know for certain whether CyberLeek is one person or several people working together. What we do know is that whoever controls the operation appears to have access to GTA 6 material that Rockstar never intended the public to see, and increasingly strong evidence suggests that this goes beyond somebody simply finding a folder full of prerecorded development videos. New footage has continued to appear while copyright claims remove older uploads, creating a strange game of cat and mouse where a video can spread across X, Reddit, Telegram and YouTube before disappearing hours later.

CyberLeek has also deliberately made itself part of the story. The leaked footage is not presented anonymously. Videos have included CyberLeek watermarks, QR codes and references to its $CYBERLEEK cryptocurrency. The website contains downloads, information about the token and previously a system for voting on upcoming leaks. In other words, this is no longer just a GTA 6 leak. It has become an entire online operation built around unreleased footage from what is arguably the most anticipated video game in the world.

The CyberLeek Website Is at the Center of Everything

One of the most important parts of understanding CyberLeek is its website. The main site being circulated with the footage is:

CyberLeek website

The website acts as a central hub for the entire operation. Rather than simply posting a video to social media and hoping it stays online, CyberLeek has used its own site to publish information, distribute material, promote the crypto $CYBERLEEK and explain what it claims to be fighting for. The address has also appeared directly in material associated with the leaks, which makes it considerably more useful when trying to separate genuine CyberLeek material from the growing number of fake accounts trying to take advantage of the attention. Reports have documented several mirrors and alternate domains connected to the same material, likely because individual links can disappear or become overloaded as thousands of people try to access them.

The site does not look like something Rockstar would ever want associated with one of its games. Instead of polished video hosting, the ecosystem around CyberLeek has involved mirrors, decentralized storage, Telegram and third party download services. A German report examining the operation noted that CyberLeek's site included several sharehoster links for downloading recordings, while community tracking of the mirrors has identified links to services such as Transfiles.ru. We are deliberately not linking directly to those file downloads here. They contain leaked copyrighted material, and fake GTA 6 downloads are also beginning to circulate with malware, making random mirrors particularly risky.

That messy distribution system is partly a response to how quickly the footage disappears from mainstream platforms. Videos uploaded to major social networks have repeatedly been hit with copyright claims, and reports from The Verge, GamesRadar and others describe clips being removed soon after they spread. Take Two has now gone considerably further than simply requesting removals. On August 20, the company filed subpoenas seeking information from Microsoft and Discord that could help identify people connected to the alleged copyright infringement. The companies were asked to provide information by September 4.

This is why finding the original footage can feel surprisingly difficult even when a new leak is trending everywhere. One person posts it, thousands of people copy it, copyright claims begin removing those copies, and the community starts moving toward mirrors, Telegram channels or obscure file hosts. CyberLeek appears to have anticipated that problem. One Telegram channel attributed to the operation even posted that it was creating a drive that would be updated daily and claimed that Rockstar could not take down everything. Whether every channel currently using the CyberLeek name is authentic is another question, but the overall strategy is clear: make the material difficult to erase completely once it has been released.

The Leaks Are Also Advertising a Cryptocurrency

The strangest part of the entire situation may not be the GTA 6 footage. It may be what CyberLeek has attached to it.

CyberLeek has launched a cryptocurrency called $CYBERLEEK, built on Solana. The token began trading shortly before the GTA 6 footage exploded across the internet, and the connection between the two has been anything but subtle. The leaked videos have reportedly contained CyberLeek branding, QR codes and promotional messages for the token. Some footage has carried messaging along the lines of a higher market capitalization resulting in more leaks, directly connecting interest in the cryptocurrency with the promise of additional GTA 6 material.

The token has already attracted significant trading activity. Because cryptocurrency prices can move dramatically within minutes, putting one exact value into an article and leaving it there would quickly make the article outdated. At the time of research on August 21, independent Solana tracking put $CYBERLEEK around a $1.6 million market capitalization, with millions of dollars in daily trading volume. Those numbers should be treated only as a snapshot. By the time you read this, the price could be considerably higher or lower.

Readers who want to view the market data themselves can find the token here:

CYBERLEEK on CoinGecko

There is also an obvious contradiction at the center of all this. CyberLeek presents itself as fighting anti consumer practices in the games industry, yet it is simultaneously using access to highly anticipated stolen game footage to draw attention toward a speculative cryptocurrency from which people connected with the token may be able to profit. CyberLeek itself insists that the project is not simply a cash grab and says the money is intended to fund security, infrastructure and a larger secret project. There is currently no independent way to verify those motivations.

Blockchain researchers in the GTA community have since started examining wallets associated with the project. One widely shared investigation claims the infrastructure and token were prepared before the public GTA 6 leak campaign began, with the token minted and liquidity established around the same period that CyberLeek related web infrastructure appeared. Other researchers have tried to estimate how much could have been earned through trading fees and token holdings. Those calculations are interesting, but they are still community investigations rather than confirmed financial records belonging to an identified person, so they should not be treated as proven income.

What is much easier to verify is that the cryptocurrency is not sitting separately from the GTA 6 operation. The token is woven directly into it.

WorthTheCart does not recommend purchasing $CYBERLEEK. Cryptocurrency prices are highly volatile, and the token's connection to an anonymous leak operation creates additional risk.

You Could Pay With $CYBERLEEK to Vote on the Next GTA 6 Leak

CyberLeek took the cryptocurrency idea even further by creating a voting system for upcoming leaks. Instead of simply deciding privately which video would be released next, a poll appeared on the website offering several different types of footage. Users could vote by sending $CYBERLEEK tokens to the wallet associated with the option they wanted. The website stated that only $CYBERLEEK was accepted for voting and that the tokens sent were effectively donations to the project. The winning option would then be uploaded after the poll ended.

One of those polls included an option centered on flying. That option won, and footage showing Jason flying over Vice City subsequently appeared. The interesting part is not simply that people correctly predicted the next leak. The system created an incentive for anyone desperate to see more GTA 6 footage to acquire CyberLeek's cryptocurrency first. Instead of the token being advertised next to the leak, the token became part of the mechanism used to decide what would be leaked.

It is difficult to ignore what that does economically. Every new GTA 6 video brings attention to CyberLeek. Attention can bring new people to the token. The promise of another leak gives people a reason to keep checking the website, discussing the project and potentially buying the cryptocurrency. Then another video arrives carrying the same branding and the cycle begins again. This does not prove that making money is CyberLeek's only motive, but it gives whoever controls the project a clear financial reason to release footage gradually rather than dumping everything at once.

That point became even harder to miss when the newest footage continued to include promotional language linking future leaks to the value of $CYBERLEEK. It means that two very different stories have effectively merged into one. On one side there is an anonymous source apparently holding unreleased material from Rockstar Games. On the other there is a newly created speculative crypto asset whose visibility depends heavily on people continuing to care about that material.

The Video That Changed Everything

When the first footage appeared, there was still a simple explanation for how CyberLeek might have obtained it. Somebody could have stolen a collection of development recordings. An employee or contractor could have copied videos. The footage could have been sold between people before eventually reaching CyberLeek. The enormous 2022 Rockstar breach had already shown that development videos could escape without the person publishing them having a working copy of GTA 6 on their own machine.

Then CyberLeek released the plane footage.

The video shows Jason flying over Vice City, giving viewers one of the clearest unofficial looks yet at the scale of the city from above. The important moment, however, comes later. Jason is on the ground with a firearm and begins shooting at a wall. The bullet holes are deliberately arranged into four letters: LEEK.

That tiny moment changes the situation considerably. A random prerecorded Rockstar development video would have no reason to contain a player carefully shooting CyberLeek's name into a wall. It suggests that whoever created the footage was able to control the character and perform a specific action for the leak. Both GamesRadar and PC Gamer have pointed to this as strong evidence that CyberLeek either has direct access to a playable GTA 6 build or is in close contact with someone who does.

Some reports have taken this one step further and described CyberLeek as having the entire game. Tom's Hardware, for example, characterized the material as evidence of a full working build. That possibility cannot be dismissed, but it also cannot currently be proven from the public footage alone. We do not know how much of GTA 6 is contained in whatever build is being accessed. We do not know whether the full story is playable, whether Lucia's entire portion of the game is available, whether every region is accessible, or whether the build is limited to specific development areas and missions.

So the most accurate conclusion right now is slightly less dramatic, but still extraordinary: CyberLeek appears to have access to a playable version of GTA 6, or to someone who can directly control one.

For Rockstar, that could potentially be much more serious than a folder containing a fixed number of stolen videos. Prerecorded footage eventually runs out. Access to a playable build could allow somebody to deliberately search for things that Rockstar most wants to keep secret, including locations, mechanics, characters and potentially story information. That is why the question of exactly how much access CyberLeek has may be more important than anything revealed in the videos so far.

CyberLeek Claims This Is About Gamers' Rights

If CyberLeek were simply selling access to unreleased videos, this story would already be strange enough. Instead, the person or group behind it has published what it calls the CYBERLEEK Edict, a manifesto arguing that large game publishers have become increasingly hostile toward the people buying their games.

The manifesto focuses on three main demands. The first targets digital preorders. CyberLeek argues that preordering originally made sense for physical products because stores could run out of copies, while there is no equivalent scarcity for a digital download. According to that argument, publishers are asking customers to give them money before release without offering the practical reason that once existed for physical preorders. CyberLeek has therefore taken a much more favorable position toward physical copies while criticizing companies for pushing customers toward digital purchases before independent reviews exist.

The second demand concerns single player DLC, particularly content that is already included in the files customers purchased but remains inaccessible until more money is paid. The third concerns preservation. CyberLeek argues that a game with a single player component should include a way to continue using that content offline even if official online services eventually disappear. Ubisoft's shutdown of The Crew has been used as an example of the wider problem CyberLeek claims to be fighting.

CyberLeek says the leaks will continue until publishers make meaningful commitments to change these practices. Rockstar and Take Two are the current target, but the language of the manifesto is directed more broadly at the games industry. That is also why CyberLeek's branding repeatedly frames the operation as a fight for gaming rights rather than simply a GTA 6 leak.

Whether anyone believes that explanation is another matter. Consumer rights groups have not universally welcomed CyberLeek's approach, and the simultaneous promotion of a cryptocurrency makes the supposed activist motive much harder to take at face value. It is entirely possible for somebody to genuinely dislike modern game industry practices while also seeing an opportunity to profit from the enormous attention surrounding GTA 6. At this point, there is not enough evidence to know which motive matters more.

Is CyberLeek From Germany?

Finding out who is actually behind CyberLeek has now become almost as interesting as the leaked footage itself.

One theory receiving considerably more attention than others is that the person behind the name may be from Germany or another German speaking country. PC Gamer reported that investigators found an older account using the Cyberleek name on the German language cybersecurity forum SzeneBox, with posts dating back years before the current GTA 6 incident. Other clues surrounding hosting and the person's apparent online history have led to speculation that CyberLeek could be German or Swiss and possibly in their 30s.

That is interesting, but it is not proof.

A username can be copied. Someone trying to hide their identity could intentionally plant misleading information. A German language account does not automatically mean its owner lives in Germany, and infrastructure hosted in a particular country tells us very little about where the person controlling it is physically located. There are also numerous fake accounts currently impersonating CyberLeek, making it even more important not to connect random profiles to the real person without evidence.

The responsible conclusion for now is that there are clues pointing toward German speaking Europe, particularly Germany or Switzerland, but CyberLeek's nationality has not been confirmed. There is currently no publicly verified real name behind the operation.

If that changes, it will probably not be because somebody on social media recognizes a profile picture. Take Two has already begun using the legal system to obtain information from platforms connected to the leak investigation. The subpoenas sent to Microsoft and Discord show that the company is actively trying to move from internet speculation toward records that could identify whoever is responsible.

What About the Rockstar India Rumor?

There is another claim spreading rapidly alongside the CyberLeek story: that the build may have been obtained through Rockstar India.

This theory needs to be handled carefully because it combines information surrounding two different GTA 6 incidents. The first is the huge 2022 Rockstar breach. Later reporting claimed that Lapsus$ member Arion Kurtaj may have initially gained access by phishing a Rockstar India developer, eventually reaching Rockstar's internal systems and Slack channels. Rockstar confirmed that the 2022 leak itself was genuine, but it never publicly confirmed the exact phishing method or officially stated that a Rockstar India employee was responsible for providing that access.

Now that new footage has appeared in 2026, that old Rockstar India story has resurfaced and is being combined with new claims that an employee was compromised again or that CyberLeek's current build came from the Indian studio. At the moment, there is no reliable public evidence establishing that connection. Reporting specifically examining the new rumor concluded that the claim linking Rockstar India to the August 2026 CyberLeek material remains unverified.

That does not mean it is impossible. Rockstar is a global developer with multiple studios contributing to GTA 6, and internal development builds have to exist somewhere. It simply means we do not currently know how CyberLeek obtained access. Saying that "Rockstar India leaked GTA 6" would go much further than the available evidence allows.

The origin of the build is therefore still one of the biggest unanswered questions in this entire story.

CyberLeek Has Turned a GTA 6 Leak Into Something Much Bigger

Three days after the first major CyberLeek material began spreading, the story is no longer simply about a few seconds of unreleased GTA 6 gameplay. There is an anonymous identity, a dedicated website, multiple mirrors, rapidly disappearing uploads, a manifesto, a cryptocurrency, paid voting for future leaks and increasingly convincing evidence that somebody connected with CyberLeek can interact directly with an unreleased build of the game.

At the same time, almost every important question is still unanswered. We do not know who CyberLeek really is. We do not know whether it is one person or a group. We do not know how the build was obtained. We do not know whether the Rockstar India rumors have any connection to the current incident. We do not know whether the German clues point toward the actual person or simply another layer of misdirection. Most importantly, we still do not know how much of GTA 6 CyberLeek can actually access.

What we do know is that Take Two is taking the situation seriously. Videos are being removed rapidly, legal requests have already been sent to major technology companies, and CyberLeek continues using every new piece of GTA 6 footage to bring attention back to its own website and cryptocurrency. The longer the person behind it remains unidentified, the bigger the possibility that more unreleased material will appear.

And judging by the way CyberLeek has structured the project, keeping people waiting for the next leak may be exactly the point.

The strangest thing about the CyberLeek footage is how normal most of it is.

There are no carefully edited explosions, major story reveals or cinematic sequences designed to make GTA 6 look impressive. Instead, much of what has appeared so far consists of Jason driving around, playing basketball, fighting random NPCs, stealing vehicles and moving through parts of Leonida that Rockstar has already shown in trailers. That might sound less exciting than a huge mission leak, but it is exactly what makes the footage so interesting. These clips provide a look at the systems Rockstar normally hides behind its trailers, including how police identify the player, how cars might work, what Jason can carry, how NPC interactions have changed and how much of Leonida appears to exist outside Vice City.

There is also an important warning before looking at any of these details. Rockstar has not publicly confirmed each individual mechanic shown in the CyberLeek footage, and some of the material may come from development builds that are different from the version releasing on November 19. Interfaces can change, mechanics can be removed and unfinished systems can look very different by launch. At the same time, Take Two's repeated copyright removals and its legal action seeking information from Microsoft and Discord make it increasingly difficult to dismiss the entire leak as an elaborate fake.

What follows is therefore not a list of confirmed launch features. It is a look at what CyberLeek's footage appears to show, and what those details could tell us about the GTA 6 Rockstar is building.

It Started With Jason Shooting Hoops

The first CyberLeek video that really exploded online on August 18 was also one of the least dramatic. Jason walks outside the waterfront property Rockstar has previously shown in official material, jumps down toward the driveway, picks up a basketball and begins shooting at a hoop. There are no police chases or story spoilers. For more than a decade, basketball has been one of those small activities GTA fans have repeatedly wondered whether Rockstar would bring back, and this footage appears to show it functioning as a proper minigame rather than background decoration. The player times a shot using an interface where rings move toward one another, and successfully scoring causes a small message to appear showing Focus +2%.

That single notification may tell us considerably more about GTA 6 than the basketball itself. Rockstar used character statistics extensively in Red Dead Redemption 2, where normal activities gradually improved Arthur Morgan's abilities, and the leaked footage suggests GTA 6 may expand on the same philosophy. We still do not know exactly what Focus does. It could affect aiming, a special ability or something completely different, but the important part is that an optional everyday activity appears capable of improving one of Jason's attributes. That would give activities such as basketball a reason to exist beyond simply being something fun to do once.

There are smaller details around the edges of the footage as well. Two separate money values appear on the interface, which has led to theories that GTA 6 separates money Jason physically carries from money stored elsewhere. A stamina bar is visible, and the waterfront property itself appears designed for more than simply serving as a place where missions begin. The surrounding area includes access to the water and spaces where vehicles, boats and activities could potentially be used. PC Gamer described the footage as looking more like something a tester would record during normal play than a scene created for marketing, which is a good description of why it feels so revealing.

The First Driving Leak Revealed Much More Than Expected

Another video arrived shortly after the basketball footage and initially looks like ordinary GTA gameplay. Jason drives through traffic in an older car, gets into a collision with a delivery vehicle and ends up fighting the driver. The action itself is hardly revolutionary, but the interface surrounding it contains several details Rockstar has never officially explained.

The vehicle appears to have separate indicators for fuel and mechanical condition. If those indicators survive into the finished game, GTA 6 could be the first modern single player GTA to make fuel something players actually need to consider during ordinary driving. It is worth being cautious here because an icon on an unfinished HUD does not guarantee that gas stations will function as a mandatory refueling mechanic. It could be a development system, a mission specific mechanic or something Rockstar eventually decided was more annoying than fun. But multiple CyberLeek clips show the same type of vehicle information, making it much harder to dismiss as a one off element.

Vehicle storage may be even more important. A prompt shown near a vehicle includes Loadout and Storage 0/4, suggesting that cars can hold equipment separately from what Jason is carrying. That would fit closely with the direction Rockstar took in Red Dead Redemption 2. Arthur did not permanently carry every weapon he owned, because much of his equipment remained on his horse. GTA 6 could use the player's personal vehicle in a similar way, turning the trunk into part of the inventory system instead of allowing Jason and Lucia to somehow hide an entire gun collection in their clothing.

Then the crash happens. The delivery driver does not simply panic and run away. He confronts Jason, and the encounter escalates into a fight. Other leaked footage appears to show ordinary NPCs carrying usable objects and responding to situations in more varied ways than the relatively simple reactions seen in GTA 5. None of this means every pedestrian has a complex simulated life, but it supports something Rockstar has repeatedly emphasized in its official promotion of GTA 6: Leonida is intended to feel densely populated and reactive rather than simply large.

GTA 6 May Finally Bring Back Six Wanted Stars

One of the easiest details to miss appears when Jason gets into trouble with the police. GTA 5 reduced the maximum wanted level from the traditional six stars to five, but CyberLeek's footage appears to show six positions in the wanted interface once again. Two stars become active in the leaked sequence while another four remain empty, strongly suggesting the old six star maximum has returned.

The more interesting part sits underneath those stars.

Several small icons appear to represent different things the police know about the suspect, including what viewers have interpreted as Jason's appearance, clothing and vehicle. If that interpretation is correct, GTA 6's wanted system may be much less binary than GTA 5's. Instead of police somehow knowing exactly which random vehicle the player entered after escaping their line of sight, losing the cops could involve removing individual pieces of identifying information. Changing clothes could matter. Abandoning a recognized vehicle could matter. Covering Jason's face before committing a crime could matter.

The actual footage is not detailed enough to confirm exactly how each icon works, so claims that the police definitely "remember your face, clothes and car" should still be treated carefully. What can be said is that multiple identification icons appear beneath the wanted level, and that Rockstar has clearly experimented with a more layered law enforcement interface than the one used in GTA 5. There is also 6 stars and not 5 stars wanted level in gta 6 and its now confirmed by cyberleek.

There is also an unexplained devil shaped symbol that appears after violent actions in one of the earlier videos. Some viewers immediately described this as GTA 6's version of Red Dead Redemption 2's Honor system, but there is not enough evidence yet to call it that. It could represent morality, reputation, aggression, witness behavior or something that existed only for development purposes. The fact that Rockstar seems to have experimented with some form of consequence indicator is interesting. Calling it a confirmed "karma system" is not.

Then the Leaks Became Much More Detailed

On August 19, CyberLeek released two more substantial clips known as Taser and Junkies. These were the videos that made the leak feel less like two isolated files and more like an ongoing stream of playable GTA 6 footage. Both once again feature Jason, but they expose far more of the combat, inventory and NPC systems surrounding him.

The Taser footage takes place at night around what appears to be the Allied Crystal industrial site in Ambrosia. Jason gets into confrontations with security, uses a taser and eventually leaves in a vehicle. At different points the interface reportedly offers contextual actions including Clone Key and Smash Window when approaching a vehicle. That detail is particularly interesting because it suggests stealing a car may no longer be one universal animation. A less sophisticated vehicle could be broken into, while another may require some form of electronic key cloning if the player wants a quieter approach.

Other contextual prompts appear around NPCs. Greet and Taunt are visible in the broader leaked material, immediately drawing comparisons with Red Dead Redemption 2, where Arthur could greet, antagonize or otherwise respond to almost anyone he encountered. There is also a surrender option in the Taser footage, suggesting encounters with police or security may contain more states than simply shooting or escaping. Jason can pick up a hat that has fallen to the ground and wear it, and looting appears faster and more direct than Red Dead Redemption 2's deliberately slow animations.

It is a collection of tiny interactions rather than one huge new feature, but that is exactly where Rockstar's games usually become convincing. Breaking into a vehicle in more than one way, stealing a hat from the ground, responding verbally to a stranger and deciding whether to surrender are individually small systems. When all of them exist in the same world, they create more opportunities for situations that feel slightly different each time.

The Cal Cutscene Is More Important Than It Looks

The Taser footage also contains something the first leaks did not: part of an actual GTA 6 cutscene.

Jason is shown with Cal Hampton, a character Rockstar has already officially introduced. During the conversation, Cal jokes about using a VPN and avoiding being caught. The timing immediately caught people's attention because a hacker leaking footage of a character talking about avoiding detection with a VPN sounds almost too perfect. There is no evidence that Rockstar wrote the scene specifically in relation to CyberLeek. The much simpler explanation is that CyberLeek deliberately selected a preexisting scene because the dialogue was funny in the context of someone being hunted by Take Two.

That distinction actually makes the video more concerning for Rockstar, not less. CyberLeek appears able to search through whatever material is available and deliberately choose footage that fits the message being sent. The plane video later takes this a step further by showing a custom action performed specifically for the CyberLeek identity.

The existence of a story scene also introduces a different kind of risk. So far, CyberLeek has largely avoided releasing major plot information. If the accessible build contains missions and cutscenes beyond what we have already seen, future releases could reveal events that players have waited more than a decade to experience for themselves. This is one area where even many people following the leaks have begun drawing a line. Seeing an unfinished fuel gauge is one thing. Having the ending of GTA 6 posted online months before launch would be something completely different.

"Junkies" Gives Us Our Best Look at GTA 6's Inventory

The other August 19 video, commonly referred to as Junkies, shows Jason taking a police motorcycle, ending up around an encampment beneath a roadway and getting into another violent encounter. Again, the value of the clip is not really the violence. It is what happens when the player opens the inventory.

The weapon wheel appears to contain a limited number of slots rather than the enormous selection GTA 5 eventually allowed the player to carry. A separate item interface can also be seen, and one of the objects Jason obtains is a healing drug called Zombix. Using it produces a message warning that repeated use will temporarily reduce its effect on health. That suggests healing in GTA 6 may involve more thought than endlessly consuming the same item whenever the player is injured.

Jason can also pick up knives and other objects dropped by NPCs, while the footage again shows Greet and Taunt interactions. Taken together with the vehicle storage system seen earlier, the leaks point toward an inventory philosophy much closer to Red Dead Redemption 2 than GTA 5. Jason may have to choose what he physically carries, keep additional equipment in a vehicle and use different categories of consumables depending on the situation.

That would be a significant change in how GTA feels moment to moment. GTA 5 was intentionally convenient. Once the characters accumulated weapons, switching from a pistol to a shotgun, assault rifle, sniper rifle, grenade launcher and rocket launcher could happen within seconds. GTA 6 appears to have at least experimented with something more grounded, where preparation before a robbery or mission could matter.

The Plane Leak Shows Just How Big Vice City Really Is

The fifth major gameplay video is probably the most visually impressive footage CyberLeek has released so far.

Jason pilots a small blue and yellow biplane high above the city in daylight. For the first time, viewers get a long, uninterrupted view across Vice City and surrounding areas from the air rather than carefully selected camera angles in a Rockstar trailer. Even through the compression of the leaked recording, the city appears extraordinarily dense. Large sections of urban development stretch toward the horizon while highways, suburban neighborhoods, industrial zones and greener regions remain visible outside the downtown core.

This footage is useful because GTA maps can be misleading when viewed only as flat images. A huge map filled with empty land can feel smaller than a more compact world packed with buildings, roads and activity. From above, Vice City appears less like GTA 5's Los Santos surrounded by a vast amount of countryside and more like one major section of a wider developed state. We still cannot determine the actual playable area simply by looking toward the horizon, but the density is difficult to ignore.

The video then ends with the moment that made it much more significant than a scenic flight. Jason lands, takes out a gun and deliberately shoots the letters LEEK into a wall. As discussed in Part 1, that does not prove CyberLeek owns a complete retail copy of GTA 6, but it is strong evidence that somebody connected to the leaks can control the game directly. A prerecorded developer video would have to coincidentally contain exactly the personalized action CyberLeek needed, which is extremely unlikely.

The plane video was also connected directly to CyberLeek's cryptocurrency based voting system. CyberLeek's website offered several options for what footage should be released, including Car (DAY), Car (NIGHT), Motorcycle (NIGHT) and Plane (DAY). Voting required sending $CYBERLEEK, and Plane (DAY) won with roughly 64 percent of the recorded vote. The website said the winning choice would be placed in its content section within 24 hours, and the plane footage subsequently appeared.

That makes the video more than another GTA 6 leak. It is evidence that CyberLeek has enough material, or enough control over a playable build, to offer viewers a choice about what they want to see next.

CyberLeek Also Released What It Claims Is the Full GTA 6 Map

Alongside the videos, CyberLeek distributed two map sneak peeks and an image labeled FULL MAP. Its Telegram channel lists all three files, while CyberLeek's website has hosted mirror links for the map material alongside the basketball footage.

The alleged full map divides Leonida into five counties: Lummox, Kelly, Leonard, Vice Dale and Mariana. Vice City sits toward the southeastern side, while large rural and wetland regions extend north and west. A long series of islands occupies the south, closely reflecting the geography of the real Florida Keys. The map also contains areas corresponding with locations Rockstar has officially revealed, including Vice City, the Leonida Keys, Grassrivers, Port Gellhorn, Ambrosia and Mount Kalaga.

Some of the smaller images reveal names such as Dalton Island, Gloriana Key, Catalan Key and Tequesta Retreat. Other details spotted by people examining the map include race tracks, airports and a marker associated with Jason's home. There also appears to be a separate character marker while the player is elsewhere, raising the possibility that GTA 6 lets you see the location of the protagonist you are not currently controlling.

This is also the part of the leak I would treat most carefully. A gameplay video can be compared directly with Rockstar's trailers, animations and interface. A flat development map is easier to misunderstand, and geographic boundaries or names may have changed significantly during development. CyberLeek itself distributed it as a full map, and several elements line up with places Rockstar has officially revealed, but that does not guarantee every road, county or island appears exactly this way in the final release.

Hypercar Part 1 Is the Newest Leak

For roughly a day after the plane footage, CyberLeek went quiet. With Take Two issuing subpoenas and trying to identify people involved in distributing the material, speculation quickly spread that the leaker had been caught or had decided to disappear.

Then, on August 21, another video appeared.

The newest release is titled Hypercar Part 1 and runs for roughly two minutes and 25 seconds. It begins with Jason stealing a black and white Truffade Thrax, GTA's Bugatti inspired hypercar. The driver resists, forcing Jason to physically pull them from the vehicle before he can take control. Jason then spends most of the video simply driving through Leonida while music plays on the radio.

That lack of action is what makes Hypercar interesting. The footage gives viewers time to look at the roads, traffic, lighting and vehicle behavior without gunfire constantly distracting from what is happening. The Thrax appears heavier and more planted than many of GTA 5's fastest vehicles, while road width and vehicle scale make the environment feel less exaggerated. The clip also takes place around wet roads and softer late afternoon lighting, giving reflections and surfaces a very different appearance from the earlier daytime footage.

Community analysis has identified several smaller details that are worth watching but should not yet be treated as confirmed mechanics. Viewers have pointed to a tracker style icon attached to the stolen car, active aerodynamic behavior on the Thrax and additional icons on the minimap. The video also appears to show more police vehicles naturally mixed into ordinary traffic. Some viewers believe the tracker could allow police or vehicle owners to locate a stolen high value car, but the footage does not explain the system, so that remains interpretation rather than confirmation.

One of the most interesting things about the clip is actually its name. CyberLeek called it Hypercar Part 1, immediately implying that more footage connected to the same sequence exists. A C marker can also be seen on the map, leading fans to speculate that Jason may be driving toward Cal Hampton. That would fit with the Cal footage already shown in an earlier leak, but there is currently no evidence proving that Hypercar Part 2 contains a mission or cutscene. It is exactly the kind of theory that can become "confirmed GTA 6 information" after being repeated enough times online, so for now it should remain speculation.

The video carries another familiar CyberLeek message promoting its cryptocurrency, reportedly including the phrase HIGHER MARKETCAP = MORE LEEKS. It is yet another reminder that even the apparently mundane gameplay footage is being used to keep attention focused on $CYBERLEEK.

The Biggest GTA 6 Reveal Might Be Hidden in the Small Details

After six gameplay videos and several map images, CyberLeek still has not revealed one giant feature that completely changes what we thought GTA 6 would be. There has been no confirmed second city secretly hidden across the ocean, no revolutionary destruction system and thankfully no major story ending posted online.

Instead, the leaks paint a picture through dozens of smaller systems.

Basketball appears to improve a character attribute. Cars appear to have fuel, mechanical condition and storage. Vehicle theft may involve different methods depending on the target. Jason appears to carry a more limited inventory, with additional equipment stored elsewhere. Healing items can have diminishing effects. NPCs can be greeted or taunted. Clothes can seemingly be picked up from the world. The wanted system appears to contain six stars and potentially tracks multiple forms of identification. Cars may have electronic trackers. The world includes ordinary activities that affect progression, and huge parts of Leonida appear to remain populated far outside the center of Vice City.

None of those ideas on their own sound impossible for another open world game. Together, however, they point toward what Rockstar seems to be trying to do with GTA 6. The goal may not be to completely reinvent what Grand Theft Auto is. It may be to make every familiar GTA action significantly deeper. Stealing a car is still stealing a car, except now the vehicle could be locked, tracked, damaged, low on fuel and carrying part of your loadout. Escaping the police is still escaping the police, except now the game may care about what you are wearing and what vehicle witnesses saw. Playing basketball is still a side activity, except it might also improve Jason.

That approach would be very similar to what Rockstar accomplished with Red Dead Redemption 2. Riding across the map, carrying weapons, interacting with strangers, taking care of a horse and eating food were not revolutionary concepts individually. The achievement was making hundreds of those systems overlap convincingly enough that the world felt unusually physical and reactive.

The CyberLeek footage suggests GTA 6 may be attempting the same thing on a much larger and more chaotic scale.

And there is still one major problem for Rockstar: based on what we have seen so far, CyberLeek does not appear to be running out of footage.

After several days of leaked GTA 6 gameplay, one question has become more important than anything actually shown in the videos: how did CyberLeek get this material in the first place?

There is still no confirmed answer. CyberLeek has not publicly provided a believable explanation for where the footage came from, Rockstar has not explained whether its own systems were compromised, and there is currently no evidence proving that the anonymous person or group directly hacked Rockstar at all. It is possible the material came from an employee, a contractor, a testing environment, a compromised account or another person who obtained access before passing the material to CyberLeek. The clips themselves only tell us that somebody appears to have been able to control an unreleased version of GTA 6. They do not tell us how that access was obtained.

This distinction has become even more important now that Take Two is using the legal system to trace people and accounts connected with the leaks. On August 20, Take Two filed requests in the Southern District of New York seeking records from Microsoft and Discord that could help identify whoever is behind the CyberLeek persona and other accounts connected with the distribution of copyrighted GTA 6 material. Microsoft and Discord have reportedly been given until September 4 to provide the requested information.

That means the situation has moved beyond Rockstar simply trying to make leaked videos disappear from X and YouTube. The company is now trying to follow the digital trail back toward its source.

Take Two Is Trying to Find the Person Behind CyberLeek

The legal requests are particularly interesting because of how specific they reportedly are. According to The Verge, Take Two is seeking Microsoft's internal business and investigative records connected with the CyberLeek persona, with the stated purpose of identifying the user, person or entity behind it. Reporting on the filings also indicates that Take Two is looking for identifying information associated with accounts and digital activity connected with the investigation, rather than simply asking Microsoft to remove a video.

Discord has also been pulled into the investigation. That makes sense because Discord servers have become one of the places where leak communities gather, mirror links are shared and people attempt to investigate CyberLeek themselves. The requests reportedly cover accounts and servers associated with the GTA 6 material and seek information capable of identifying the people using them. It is important to be clear about what this means. Microsoft and Discord are not being accused of leaking GTA 6. They are platforms that may hold records capable of helping Take Two identify whoever did.

There is another interesting detail here. Microsoft being involved has led some people online to immediately conclude that CyberLeek must be playing GTA 6 on an Xbox development kit. That is currently speculation. Microsoft's services extend far beyond Xbox hardware, and the information requested from the company reportedly includes account records, cloud data and other digital information. The fact that Microsoft received a subpoena is therefore not proof that the leaked build itself is running on an Xbox.

The leaked footage has also created endless debates about whether CyberLeek is using a PC development build, an Xbox development kit or simply receiving prerecorded footage from another person. Viewers have attempted to analyze controller movement, video resolution, color information and compression to determine the platform, but none of those observations provides enough evidence to reliably identify what machine is running the game.

For now, the platform is another unanswered question.

We Still Do Not Know Whether CyberLeek Actually Hacked Rockstar

It is tempting to call CyberLeek "the GTA 6 hacker," and plenty of social media posts already do. The problem is that leaking something and hacking the company that created it are not necessarily the same thing.

CyberLeek could have compromised Rockstar directly. It could also have compromised an employee or contractor. Somebody working on the game could have copied the material themselves. A third party could have obtained it months ago and eventually sold or transferred the footage. CyberLeek could even be the public face of an operation where another person actually has access to GTA 6.

The footage does not answer this.

What it does appear to show is that the source of the material had more freedom than somebody who found a handful of random video files. The strongest evidence remains the plane footage discussed in Part 1 and Part 2. After flying over Vice City, the player lands and deliberately shoots the letters LEEK into a wall. It is difficult to explain that as a completely unrelated development recording that happened to contain CyberLeek's name. PC Gamer and GamesRadar have both pointed to this moment as strong evidence that CyberLeek either had access to a playable build or was receiving footage from somebody who could directly control one.

There is still an important difference between having access to a playable build and possessing the complete GTA 6 game. Some reports have described CyberLeek as having a full working build, but publicly available evidence does not tell us how much content is actually accessible. A development version could contain large sections of the map and numerous mechanics while still excluding major missions, cutscenes, Lucia content or the ending. It is also possible the footage was recorded earlier and CyberLeek is releasing a prepared library of clips gradually.

That last possibility deserves more attention than it has received.

CyberLeek does not necessarily need to be sitting at a computer playing GTA 6 every time a new video appears. Someone could have recorded hours of gameplay in advance, including the personalized LEEK message, and CyberLeek could now be releasing those recordings one at a time. The voting system discussed earlier would still work if several categories of footage had already been prepared. Nothing currently proves that CyberLeek maintains live access to Rockstar's systems today.

In other words, we have convincing evidence of direct control at the time the footage was created. We do not have proof of continuous access.

How Old Is the GTA 6 Build?

Determining when the footage was recorded could help answer some of these questions, but that is proving difficult as well.

The videos are clearly more advanced than the extremely rough development footage that escaped during the 2022 breach, yet they still contain unfinished animations, interface elements and other signs that this is not the final November 2026 version of GTA 6. Several reports and community analyses have attempted to date the build using visual differences, metadata and content heard or seen inside the game, but there is currently no independently confirmed build date.

One particularly useful clue comes from the game's radio. PC Gamer reported that one of the leaked clips includes Tate McRae's Sports Car, a song released in January 2025. Assuming the music was captured directly from the game rather than added to the recording later, the version being played would therefore have to contain content added no earlier than 2025. That makes it harder to argue that everything CyberLeek has is simply material left over from the 2022 breach.

Even this does not give us a precise date. Development builds are not created in one simple sequence where every employee automatically receives the latest version. Different departments may work with specialized branches containing different assets. QA testers can use builds created for specific purposes. Promotional teams can receive controlled versions. Outside studios and contractors may only access the sections they need.

That is why describing the footage as "the current GTA 6 build" would be misleading.

What we are seeing is a snapshot of GTA 6 development from some point before release, and potentially from multiple snapshots if CyberLeek's videos did not all originate at the same time.

The Rockstar India Theory Is Still Only a Theory

Rockstar India has become one of the biggest names attached to theories surrounding the leak, mostly because an older story about the 2022 breach has resurfaced at exactly the same time.

Rockstar India is not some tiny support office that happens to share Rockstar's name. The studio contributes directly to Rockstar's games and is part of the company's global development structure. Reports surrounding the earlier GTA 6 breach have claimed that the 2022 attacker initially compromised an employee connected with Rockstar India, with later online claims suggesting phishing was involved. Some Indian industry reporting has said those claims were consistent with information heard from sources at the time. However, Rockstar never publicly confirmed that exact version of events.

That history has now been pulled into the CyberLeek story. Rumors circulating this week claim that another Rockstar India employee may have been compromised and that the footage eventually reached CyberLeek through intermediaries. Some versions of the rumor even claim the material was passed or sold through Russian speaking groups before reaching the person now releasing it.

There is currently no reliable evidence proving that chain of events.

It is possible that future information from Take Two's investigation will connect the build to a particular studio or employee. Until that happens, blaming Rockstar India would be unfair and inaccurate. Thousands of people can be involved in the development and testing of a game this large, spread across Rockstar's own studios and external companies. The geographic location of one development team does not tell us where a security failure occurred.

For the moment, Rockstar India belongs in the "possible lead" category, not the "confirmed source" category.

The 2022 GTA 6 Hack Shows How Serious This Can Become

There is one reason Take Two's response should not be dismissed as ordinary copyright enforcement. Rockstar has already been through a major GTA 6 security breach, and that case ended in court.

In September 2022, an unauthorized party accessed Rockstar's systems and downloaded confidential information including early development footage of the next Grand Theft Auto. Take Two later formally disclosed the intrusion to investors through a filing with the US Securities and Exchange Commission, confirming that confidential information and early GTA footage had been taken.

The person responsible, Lapsus$ member Arion Kurtaj, was 17 when the breach occurred. Prosecutors said Kurtaj accessed Rockstar's systems and threatened in the company's own Slack environment to release GTA source code. He was later found responsible for a series of cybercrime offenses involving Rockstar, Uber and Revolut. In December 2023, a British court imposed an indefinite hospital order after considering psychiatric evidence and the risk of further offending.

That does not mean CyberLeek would receive the same outcome. The circumstances are completely different, we do not know which country CyberLeek is in, and we do not even know what actions were used to obtain the current material. A person who merely receives leaked footage faces a different factual situation from someone who unlawfully accesses corporate systems, and criminal laws vary substantially between countries.

The lesson from 2022 is simpler. Rockstar and Take Two have already demonstrated that they are willing to cooperate with investigators and pursue a GTA 6 breach far beyond sending copyright notices to social media platforms.

The subpoenas to Microsoft and Discord suggest the same process may now be starting again.

Why Rockstar Cannot Simply Delete the Leaks

Rockstar has been remarkably quick at removing many of the videos from major platforms. The original clips and numerous reposts have disappeared following copyright complaints, sometimes only hours after being uploaded. The Verge reported that videos carrying the CyberLeek branding were already being removed while the story was still spreading, and TechSpot described the takedowns as rapid but ultimately unable to prevent copies from circulating.

The problem is that copyright enforcement works much better at removing a particular upload than erasing information that has already spread across the internet.

By the time a video disappears from one account, other users may have downloaded it, screen recorded it, cut it into shorter clips, uploaded still frames, mirrored the file elsewhere or reposted it into private communities. CyberLeek has taken advantage of this by using its own website and less familiar hosting services alongside mainstream social platforms. Some of the material has been mirrored through obscure file hosts, including Russian based sharing services, while CyberLeek branding and cryptocurrency promotion remains embedded in the videos themselves.

This creates a frustrating situation for Rockstar. Removing a popular X upload containing two minutes of gameplay may stop millions of additional people from seeing that particular post, but it cannot make the copies already saved on thousands of devices disappear.

The most effective way to stop the leak is therefore not necessarily to delete every video.

It is to stop the source from producing new ones.

That is why the investigation into CyberLeek's identity matters so much more than an individual DMCA claim. If Take Two can identify where the material originated, it could potentially close whatever access point was used, determine what information was exposed and understand whether CyberLeek has anything more dangerous than what has already appeared.

Do Not Download a "Leaked GTA 6 Build"

There is also a completely separate problem growing around the leak.

As soon as people began believing CyberLeek might possess a playable version of GTA 6, fake downloads started appearing. Websites, social media accounts and Discord users have begun claiming that they can provide the leaked GTA 6 build, often requiring people to download files, complete surveys, pay money or join private groups.

There is currently no publicly available CyberLeek GTA 6 build that ordinary players can download and play.

TechSpot and GTA focused security warnings have already highlighted malware and scams attempting to exploit the attention surrounding the leaks. GTA 6 does not currently have an officially released PC version either, making claims of a convenient "GTA 6 PC leak" particularly suspicious.

Even if CyberLeek genuinely possesses game files, that does not mean those files have been published.

The distinction is extremely important. Watching a mirrored video and downloading an unknown executable advertised as "GTA6.exe" are completely different risks. Fake game downloads have been used for years to distribute credential stealers, remote access malware and other malicious software, and few game releases provide scammers with an audience as enormous as GTA 6.

For readers following this story out of curiosity, screenshots and reporting are more than enough. There is no reason to install anything claiming to be the leaked game.

The Real Nightmare for Rockstar Is Not Another Car Video

So far, despite the scale of the situation, CyberLeek has shown surprising restraint in one specific area.

The footage has revealed gameplay mechanics, the map, vehicles, Jason, portions of conversations and small pieces of the world, but it has not publicly destroyed GTA 6's main story. We do not know whether that is because CyberLeek does not have the story, does not want to spoil it, or is intentionally saving more damaging material for later.

This is where the possibility of access to a substantial playable build becomes genuinely concerning.

Rockstar has spent years controlling exactly when players meet characters, discover locations and learn what happens to Jason and Lucia. GTA 6 launches on November 19, 2026, and Take Two only opened preorders in June. The company has an enormous marketing campaign planned around revealing pieces of the game gradually before release.

A two minute driving video disrupts that marketing plan, but it does not destroy the experience for somebody buying the game in November.

A video showing the final mission could.

If CyberLeek has access to story missions or late game cutscenes, even a single major spoiler could spread through TikTok, YouTube thumbnails, Reddit posts and X before players have a chance to avoid it. Once the information becomes a meme or a screenshot, copyright takedowns would do little to help someone who has already read the spoiler.

This is why the next few days may matter more than the footage we have already seen.

CyberLeek has repeatedly demonstrated that it wants attention around each individual release. The leaks carry its branding. Its cryptocurrency is promoted inside the footage. Its website previously allowed users to vote on what they wanted to see next. A slow release schedule keeps people returning and keeps $CYBERLEEK in the conversation for longer than one massive file dump ever could.

That creates an uncomfortable incentive to keep escalating.

At the same time, releasing major story spoilers could turn much of the GTA community against the person responsible. There is a substantial difference between fans being curious about how the wanted system works and those same fans having a story they waited more than a decade to play ruined before launch.

Whether CyberLeek understands that distinction may determine where this story goes next.

Can Take Two Actually Find CyberLeek?

An anonymous username can make someone feel invisible online, but the investigation does not depend on discovering a name hidden inside a GTA 6 video.

Online activity leaves records across many different services. Accounts can have registration information. Platforms can store login information and other records. Payments and cryptocurrency transactions create their own public and private trails. Domain registrations, hosting services, communication platforms and cloud services can all become relevant depending on what investigators are legally able to obtain.

That does not mean CyberLeek will automatically be identified. People can deliberately separate identities, use compromised accounts, operate through intermediaries or build an entire public persona around information intended to point investigators in the wrong direction. The older German Cyberleek username discussed in Part 1 could eventually prove incredibly important, or it could have nothing to do with the current person at all.

What has changed is that Take Two is no longer relying only on what internet investigators can discover through Google searches and archived forums.

Microsoft and Discord may possess records unavailable to the public.

If those records connect CyberLeek activity to another account, device or identifiable person, investigators gain a new lead. If that lead points toward another platform, company or country, more requests could follow. The process could take weeks or months rather than days, especially if the person responsible is outside the United States.

There is also the possibility that the person posting as CyberLeek is not the original source. Identifying the public leaker may simply reveal another person further up the chain who actually obtained the GTA 6 material.

That is what makes the current investigation more interesting than attempting to guess somebody's nationality from posting times.

Take Two is starting to follow records rather than rumors.

What Happens Now?

As of August 21, Rockstar has not published a detailed public statement explaining the CyberLeek incident. The company has instead continued removing copyrighted footage while Take Two pursues information through legal channels. CyberLeek, meanwhile, has continued releasing material despite those takedowns, most recently returning with Hypercar Part 1 after a period of silence that caused some people to incorrectly assume the leaks had ended.

The timing could hardly be worse for Rockstar. GTA 6 is only months from its November 19 release, and an official extended look at the game is scheduled for August 27. Instead of controlling the conversation leading into that presentation, Rockstar now has fans comparing every official screenshot with unauthorized gameplay, analyzing a supposed development map and waiting to see whether an anonymous leaker releases something even larger.

Still, there is a strange irony to the entire situation. CyberLeek claims to be fighting for consumers, physical media, game preservation and better treatment of players. Some of those concerns are real debates that existed long before CyberLeek appeared. At the same time, the operation is promoting a speculative cryptocurrency using stolen GTA 6 footage, asking supporters to financially participate in votes for additional leaks and creating the possibility that the biggest game release in years could have major parts of its story spoiled before players ever touch it.

Those two sides of CyberLeek are increasingly difficult to separate.

Maybe the person behind the name genuinely believes the manifesto. Maybe the leaks are primarily being used to promote $CYBERLEEK. Maybe both are true at the same time.

For now, we simply do not know.

What began with Jason casually shooting basketballs outside his house has turned into something much larger. We now have multiple gameplay videos, an alleged map, a mysterious website, mirrors scattered across the internet, a Solana cryptocurrency, a paid voting system for future footage and a legal effort involving Microsoft and Discord to identify whoever is behind it.

And we still do not know the most basic fact of all.

Who is CyberLeek?

Until that question is answered, every new upload could reveal another small GTA 6 mechanic, another part of Leonida or something Rockstar has spent years trying to keep secret.

For a company famous for controlling almost every detail surrounding its games, that uncertainty may be the most damaging leak of all.