The CyberLeek account behind the alleged GTA 6 leaks appears to have turned the hype into a revenue stream, with its Solana-based token estimated to have generated between $40,000 and $60,000 in trading fees.
An investigation into the operation's blockchain activity suggests around $29,000 was first spent setting up the token, website and infrastructure, before trading volumes surged into the millions.
CyberLeek has released several alleged Grand Theft Auto VI videos since 18 August, promoting the $CYBERLEEK token alongside the footage and using it for a paid voting system tied to future releases.
GTA 6 Leaks Turned Into a Token Play
The token was launched on the Solana blockchain as CyberLeek began releasing the alleged GTA 6 material. Users were directed to the cryptocurrency and could use it to vote on which leaked video would be released next.
Vice Cit, a GTAForums member who investigated the project's blockchain activity, estimated that about $29,000 was spent creating the token, website and related infrastructure. The investigation estimated that $CYBERLEEK generated between $40,000 and $60,000 in trading fees after the leaks began.
At one point, the token was trading about $2.1 million in volume a day, which the investigator calculated could produce roughly $4,400 in daily fees. Those figures are estimates based on blockchain activity and the token's trading structure. They do not establish the operator's total profits.
270 Million Tokens Sent to a Burn Address
CyberLeek later burned 270 million $CYBERLEEK tokens in a transaction on the Solana network.
The tokens represented a substantial portion of the supply and were worth about $1.4 million based on the market price when the transaction took place, according to blockchain analysis cited in reports about the project.
The wallet associated with the burn was left holding 200 $CYBERLEEK tokens after the transaction. The burn did not stop trading in the token.
KuCoin reported that $CYBERLEEK reached a market capitalisation of about $25 million on 23 August, while its 24-hour trading volume reached $36.1 million.
Blockchain Trail Points Towards KuCoin
The same investigation traced several wallets used to fund the CyberLeek operation. Vice Cit identified connections between the wallet funding the website, the wallet used to create the token and the Solana address associated with signing files uploaded to Arweave, the decentralised storage network used by the project.
The investigation then followed the funding through a series of intermediary wallets to an address associated with KuCoin. The reported chain was: KuCoin Exchange → FWbi → J4zo → 26sZ → EjsB → 2ZdU → the CyberLeek funding wallet.
That does not establish the identity of the CyberLeek operator. It shows that funds used by wallets connected to the project can be traced through a chain of blockchain transactions to an address associated with a centralised exchange.
KuCoin requires customers to complete identity verification under its current know-your-customer procedures. Access to customer records would require legal process and would still depend on investigators establishing control of the relevant account.
Money Flowed in Before the First Leaks
The blockchain investigation also identified transactions made before CyberLeek began releasing GTA 6 footage. One wallet reportedly sent 311.42 SOL to an address linked to the project's creator wallet on 15 August. Roughly 20 minutes later, that wallet supplied about 330 SOL, along with 730 million $CYBERLEEK tokens, to the project's liquidity pool.
The timing does not prove that the same coins were transferred from one transaction to the next. Solana's native token is fungible, meaning individual units cannot be uniquely identified after they move between wallets. It does show how the wallets connected to the token were funded and used before the public leak campaign began.
Take-Two Follows Separate Trail for Leakers
The cryptocurrency investigation is running alongside Take-Two Interactive's efforts to identify the people behind the GTA 6 leaks. Take-Two has sought information from Microsoft and Discord through federal subpoenas.
The requests seek account and other identifying information connected to the distribution of the leaked material. The companies have been asked to provide information by 4 September, according to court documents cited in reports on the case.
Rockstar Games and Take-Two have not publicly identified CyberLeek as the person or group responsible for the leaks. The alleged footage has appeared across several platforms, while CyberLeek has continued to use its website and cryptocurrency to draw attention to new releases.
The blockchain records provide a public financial trail around the token and its funding wallets. They do not, by themselves, establish who controls those wallets or who obtained the GTA 6 material. That distinction is important as investigators and Take-Two pursue separate routes to identify whoever is behind the leaks.
