The GTA 6 CyberLeek Leaks: A Dated Timeline

For nine days in August 2026, an account calling itself CyberLeek put out unreleased GTA 6 footage and the game's map, attached it to a cryptocurrency token, and published a list of demands. Take-Two answered in federal court. Rockstar answered on Instagram. Then Netflix aired the official footage and the token collapsed.

This is the dated record, with every item attributed. We don't describe or link the leaked material. If you're trying to stay clean before November 19, our spoiler-avoidance guide is the more useful page.

LEGAL STATUS IN ONE LINE

As of November 10, 2026, we found no reporting of an arrest, a criminal charge or a lawsuit naming CyberLeek. Take-Two's court filings are DMCA subpoenas, requests for identifying information from platforms, which are not lawsuits, according to TorrentFreak's reading of the docket.

The timeline

Tuesday, August 18, 2026: footage, map and a manifesto

REPORTED CyberLeek published gameplay footage and the full in-game map, with a manifesto hosted on its own website (iPhone in Canada; Engadget gives August 18 as the leak date). Some creators suggested the build could be more than a year old. Rockstar issued DMCA takedown requests against posts sharing it.

REPORTED The stated demands, as reported: a public apology from Rockstar for not shipping physical discs (Gfinity quotes the account saying it won't stop until Rockstar "apologizes for the lack of actual physical copies"); an end to digital pre-sales industry-wide; no selling single-player content separately when it's already in the base game; and single-player content staying playable after servers shut down (iPhone in Canada). Journalists compared the framing to the Stop Killing Games consumer campaign.

Context Rockstar had already given: GTA 6's physical editions contain a download code, not a disc. That was announced in June 2026.

From August 18: the token

REPORTED The leaked video carried a watermark promoting a token, $CYBERLEEK. Token holders could vote on what leaked next (IGN, per Wikipedia; GosuGamers). CyberLeek said token money would fund a "secret project," and Kotaku reported a final message telling viewers that "Trading volume/price is how CL measures your support." Several outlets raised the obvious worry that the demands were cover for a crypto scheme.

REPORTED At some point before the withdrawals described below, CyberLeek burned tokens. Kotaku put it at about 270 million tokens of unsold reserve; Wikipedia, citing TheGamer, describes burned coins worth more than $1 million. Those are different measures of the same event, and neither outlet gave an exact date.

Thursday, August 20: Take-Two goes to court

REPORTED Take-Two petitioned the U.S. District Court for the Southern District of New York for subpoenas to Microsoft and Discord. Kotaku reported it first; Engadget followed on August 21. Per Engadget, Take-Two wanted records tied to a GitHub repository that allegedly hosted its material, plus Discord account information for named accounts and servers. TorrentFreak reports Judge Andrew L. Carter Jr. signed the order directing the clerk to issue the subpoenas, and that Take-Two's counsel said the information was sought "to obtain the identity of an alleged infringer or infringers."

REPORTED Microsoft CTO Scott Van Vliet said on X that the company was helping Take-Two "to protect creative works and intellectual property" (Notebookcheck).

Around August 21: X Corp and YouTube

REPORTED TorrentFreak reports two more DMCA subpoena requests, filed a day after the first pair: one to X Corp naming three accounts (which were suspended, and which fans had flagged as impostors), and one to Google covering a YouTube video and three channels. All four requests, TorrentFreak says, are DMCA Section 512(h) subpoenas. None is a lawsuit.

Saturday, August 22: offline

REPORTED CyberLeek's last working website mirror went down and its Telegram channel was removed for copyright infringement (Notebookcheck). Microsoft and Discord were given until September 4 to comply.

Wednesday, August 26: Rockstar speaks

OFFICIAL Rockstar posted a statement on Instagram. Per Engadget: "having videos of Grand Theft Auto VI gameplay leak in this way has been heartbreaking for our team," and "this is obviously not how we intended for you to see the game after all this time." Rockstar apologised for the slow pace of information, said the game was "nearly there," and asked fans to "wait a bit longer to experience the game for themselves on November 19."

REPORTED By this date at least 16 videos had leaked over nine days, per Wikipedia's sourcing. Kotaku counted 15 clips the next day. Counts differ depending on what you treat as one video.

Thursday, August 27, early hours: the cash-out

REPORTED Roughly $250,000 (Kotaku) or $268,000 (GosuGamers, GameRiv) in token transaction fees was withdrawn in four transactions, hours before the Netflix premiere. The tracing came from a GTAForums user, Vice Cit, who had been following the wallets since August 20; GameRiv notes it hadn't been independently confirmed. Kotaku reported the token's price fell from a peak of $0.034 to under $0.005, about 86 percent.

Thursday, August 27, 3 PM ET: the official version

OFFICIAL Netflix premiered Grand Theft Auto VI: An Extended Look, 27 minutes of in-game PS5 footage, six hours ahead of Rockstar's YouTube upload.

September 1: "evolving rapidly"

REPORTED Take-Two asked for a second, sealed Discord subpoena, saying it "has identified one additional Discord user" and that its investigation "has been (and is) evolving rapidly" (Gfinity and Notebookcheck, citing TorrentFreak). Notebookcheck reports Take-Two also withdrew its YouTube subpoena request, saying it no longer needed the information. The identities, if Take-Two has them, have not been made public.

October 8: a second wave, unverified

UNCONFIRMED A roughly 25-minute archive labelled "Extended Leek" surfaced after a poll on CyberLeek's site ran October 5 to 8 (Dexerto). Dexerto noted the footage hadn't been verified and that it was unclear whether the same people were behind it. Rockstar did not comment publicly.

The 2022 leak, for context

This is the second time GTA 6 has leaked on this scale, and the first case is still in court.

September 18, 2022. A user called "teapotuberhacker" posted 90 videos, about 50 minutes of work-in-progress footage, to GTAForums, taken from Rockstar's internal Slack (Wikipedia, citing The Guardian, IGN and The Verge).
September 22, 2022. City of London Police arrested a 17-year-old from Oxfordshire, later named in UK reporting as Arion Kurtaj, a member of the Lapsus$ group.
2023. He was found unfit to stand trial; a jury found he had committed the acts in question, which is not a criminal conviction. In December 2023 a judge imposed an indefinite hospital order (BBC and The Guardian, per Wikipedia). Rockstar said in court the hack cost it $5 million and thousands of staff hours (BBC, per Wikipedia).
July 2026. BBC reported he had been moved to prison "awaiting retrial in November" (via TechSpot).
November 9, 2026. The retrial was scheduled to begin at Woolwich Crown Court, per reports cited by GamingHQ, which says his defence chambers confirmed the date. We have not seen reporting on the proceedings yet.

What this means if you're buying the game

The leaks changed nothing official. The release date, editions and code-in-box physical copies all stayed as announced. Rockstar's response was a statement and a date, not a policy change. See our editions page.
"Leak" files are a malware and scam vector. Archives, "early builds" and tokens attached to a famous game are exactly what scammers use. Our scams and fakes page covers the common patterns.
Old footage isn't the final game. Kotaku reported concerns about a graphical downgrade based on leaked clips; leaked material from an unknown build date doesn't tell you what ships.
Spoilers are the real risk this week. With review copies reportedly out and a staggered rollout reported, story spoilers are more likely in the next ten days than at any point in August.

The official record of how we got here is on our release date history and everything we know pages.

Frequently Asked Questions

Who is CyberLeek?

An anonymous account that leaked GTA 6 footage and the map in August 2026. Its identity has not been made public. Take-Two said in a September 1 filing that it had identified an additional Discord user, but no names have been released.

Did Take-Two sue CyberLeek?

Not as far as public reporting shows. Take-Two filed DMCA Section 512(h) subpoena requests in the Southern District of New York to get identifying information from Discord, Microsoft, X Corp and Google. Per TorrentFreak, those are subpoenas, not lawsuits.

What did Rockstar say about the GTA 6 leaks?

In an Instagram statement on August 26, 2026, Rockstar said the leaks had been "heartbreaking for our team," apologised for the pace of information, and asked fans to wait until November 19.

What happened to the 2022 GTA 6 hacker?

He was found unfit to stand trial in 2023 and given an indefinite hospital order, then moved to prison in July 2026 ahead of a retrial. The retrial was scheduled to begin on November 9, 2026, per reports.

How much did CyberLeek make from the meme coin?

Outlets reported roughly $250,000 (Kotaku) to $268,000 (GosuGamers, GameRiv) in token fees withdrawn on August 27, 2026. The figures come from a GTAForums user's tracing and were not independently confirmed.

Sources

HOW WE SOURCED THIS

Rockstar's statement and the Netflix premiere are first-party. Court details come from TorrentFreak, Engadget and Notebookcheck reporting on the SDNY docket; we did not read the filings ourselves. Crypto figures trace back to a GTAForums user's on-chain tracking and were not independently confirmed. CyberLeek's identity and any further legal action are unknown.

Drew Giordano · GTA6Gang Editorial Team

We separate what Rockstar has confirmed from what has only been reported, and link every source. How we verify →