Cyberleek, the group tied in the report to recent Grand Theft Auto VI leak activity, appears to have prepared a meme-coin campaign before the leaked material began circulating. Based on the on-chain timeline cited by MarsBit, the group registered a related domain, created a token and deployed a website first, then released GTA 6 clips carrying watermarks and QR codes that directed viewers to the project’s website and token.
GTA 6 is scheduled for release in November this year. The report says players have waited 12 years through multiple delays, and that the game’s development cost has been rumored at $2 billion. It also cites Sensor Tower data showing more than 4.38 million pre-orders, with 89% of pre-order buyers choosing the Ultimate Edition. By the report’s rough calculation, pre-sales alone have already brought in more than $400 million.
Early leak clips were treated as isolated footage
The first batch of leaked videos did not immediately trigger panic among players. Attention instead went to the level of detail shown in the footage. The report points to a supercar driving clip in which brake discs glow red after heavy braking at high speed and then cool gradually. It also mentions reflections on water surfaces and vehicle doors automatically locking after a smash-and-grab car theft.
That changed when a more dramatic claim began to spread online: that Cyberleek would release a downloadable PC client for GTA 6, letting people play the title for free. That claim was later debunked. Gaming outlet Insider Gaming formally withdrew the report and apologized, saying it had relied on fake-account posts, fabricated images and discussion material that did not hold up under verification.
According to the report, the real Cyberleek operation has so far released only short video clips and map screenshots. It has not published a full downloadable PC client. Links circulating online that claim to offer a complete version are described as mostly malware and trojans.
On-chain timeline points to token first, leaks later
The sequence laid out in the report flips the usual script. Instead of a meme coin appearing after a headline event gains traction, Cyberleek is described as launching the token first and using the leak itself as distribution and marketing.
- Aug. 14: The group spent about 13,878 ARIO on Arweave to permanently secure a Cyberleek-related domain name. At that point, no GTA 6 leak had surfaced.
- Aug. 15: The $CYBERLEEK token was created with a one-time mint of 1 billion tokens. Of that amount, 27%, or about 270 million tokens, was transferred to a reserve wallet. A liquidity pool then went live on Raydium with an initial fully diluted valuation of about $55,000.
- Aug. 16: The project quietly announced the token launch on X, drawing little attention. Trading volume stayed muted over the next two days.
- Aug. 18: The first GTA 6 gameplay footage and map screenshots appeared. Each video carried uncroppable watermarks and QR codes that pointed directly to the website and token. Trading picked up the same day. The token rose about 13x within an hour, while hourly turnover exceeded $5 million.
The on-chain investigation cited in the report also found that the same originating wallet network funded the domain registration, token creation, website deployment and leak distribution. Starting Aug. 13, about 156 SOL was routed through roughly 20 temporary wallets. The report says that pattern suggests the domain, token, site and leak operation were planned by the same group in advance.
$CYBERLEEK briefly reached a $29 million market cap
By the time of the report, $CYBERLEEK had risen about 20x from a low near $0.0014. Its 24-hour gain at one point reached 17x, and market capitalization briefly touched $29 million.
On Aug. 22, Cyberleek publicly burned about 270 million developer-reserved tokens, equal to roughly 27% of total supply, presenting the move as proof that it would not dump holdings and disappear. Even so, the report says the group still held more than $500,000 worth of tokens and continued to earn from trading fees. Some estimates put those fee gains at $70,000.
The token also had a direct utility tied to future leak releases. Holders could vote on what content should be released next by sending tokens to designated addresses. One example cited in the report is a choice labeled “daytime plane.” The website’s slogan made the model explicit: “Higher market cap = more leaks.”
Source of the leak was pointed to Rockstar’s India division
The report says the source of the breach points to Rockstar’s India division. Cyberleek is described as having obtained an Xbox development build of GTA 6 by compromising that office.
It also links the case to another cyberattack in India earlier this year. In June 2026, Apple supplier Tata Electronics was hit in a breach that allegedly exposed 630 GB of data and more than 200,000 files on the dark web. The leaked material included supplier lists for the iPhone 18 Pro, component details and drop-test photos.
MarsBit uses the comparison to argue that as global technology companies move research, development and production functions to India, supply-chain security risks move with them. In that framing, third-party branches and contract manufacturers remain easier targets than corporate headquarters.
Netflix’s six-hour exclusive window was hit by the leak wave
The fallout also reached distribution plans. The report says Rockstar had decided to give Netflix an extended GTA 6 preview, with a first run on Aug. 27 that would begin on Netflix six hours before YouTube and other platforms. It describes the arrangement as an unprecedented paid streaming exclusive for a game trailer rollout.
The same report says that, according to other reporting, YouTube had offered exclusive deals worth several million dollars to keep top creators from publishing on Netflix, and that creators who declined could face reduced distribution.
Against that backdrop, Cyberleek’s leaked clips undercut part of the commercial value attached to Netflix’s six-hour head start. The report says Rockstar has not changed the plan, but the paid exclusivity package has already been weakened by the spread of free leaked footage.