📰 News 2026-08-30 · GTA VI News editorial team · GTA VI News 🔄 Updated 2026-10-14

GTA 6: Take-Two subpoenas X and Google in the hunt for Cyberleek

🔓 Leaks 💼 Business

The hunt intensifies

On August 30, Mashable reported that Take-Two Interactive — Rockstar's parent company — has filed new subpoenas against X (formerly Twitter) and Google as part of its effort to unmask Cyberleek, the anonymous persona behind this summer's wave of GTA 6 leaks. According to the report, Take-Two asked the U.S. District Court in the Southern District of New York on August 21 to order the two platforms "to produce the identity of" whoever is responsible.

The move follows two similar subpoena requests against Microsoft and Discord, filed the same week. In those documents, Take-Two described the leaked material as "stolen content" and "leaked gameplay videos," and gave Microsoft until September 4 to hand over records from its internal investigation of the Cyberleek persona (Kotaku).

A leak campaign with a crypto twist

Cyberleek first surfaced in mid-August, drip-feeding gameplay clips, screenshots and internal-looking footage of the unfinished game across forums, YouTube and X — material whose authenticity Rockstar has never officially confirmed, although Take-Two's own legal filings go a long way toward validating it (Mashable). The campaign even claimed an ideological motive: a manifesto against what it called "anti-consumer" practices such as digital-only pre-orders and always-online requirements.

But the money trail tells another story. Just hours before Rockstar's official reveal on Netflix, the Solana wallet behind Cyberleek appears to have cashed out around $250,000 in a series of transactions, according to Tom's Hardware — an estimate close to the nearly £200,000 put forward by Eurogamer, and one that has led outlets like PC Gamer to describe the operation as a textbook crypto rug pull. The associated $CYBERLEEK memecoin has since collapsed: CoinDesk reports the token down about 46% in 24 hours, its market cap falling from a $25 million peak on August 23 to roughly $7 million.

Spoilers, subpoenas and a named YouTuber

The leaks have continued even after the official reveal: this week Mashable reported that Cyberleek posted its first major story spoilers, including footage from the Lucia prologue. Meanwhile, at least one YouTuber named in Take-Two's subpoena has publicly insisted he did nothing wrong, telling IGN "I am not special, hopefully" — though no verified link between that channel and the leak operation has been established. FOX 26 Houston, for its part, notes that the identity of the person or people behind Cyberleek remains unknown, and that it has not been publicly established exactly how the unreleased footage was obtained (FOX 26 Houston).

What it means

The stakes for Take-Two are enormous: the publisher lost billions in market value when the leaks first emerged, and GTA 6 — still scheduled for November 19 — is the single biggest commercial bet in the company's history. By subpoenaing X and Google, Take-Two is no longer just chasing the footage: it is forcing the platforms that hosted it to help identify the person behind it. Whether the courts cooperate quickly enough to matter before launch — and whether the leaker has more to drop — remains to be seen. One thing is certain: the hunt for Cyberleek has just become a very public legal battle.

Update — 2026-08-31

The legal push entered a new phase on August 31. Video Games Chronicle reports that Take-Two has asked the court for another Discord subpoena, describing its investigation into the leaker as "rapidly evolving." In its latest filing, the publisher says it has identified one additional Discord user and obtained additional identifying information about a previously identified user, along with more detail on the community servers named in its earlier request — for which it now seeks more targeted information (TorrentFreak).

Take-Two has also asked for the new request to be filed under seal, so the details stay out of public view. The publisher argues that public filing would "tip off the alleged infringers" (Video Games Chronicle), and warned that the sealed attachment "reveals highly sensitive, confidential information about an ongoing investigation into copyright infringement and the misappropriation of Take-Two's confidential information" (TorrentFreak). PC Gamer adds that the new filing dates to August 28, that no ruling on the seal request has been made yet, and that the subpoena itself has not been issued — Take-Two warns that public disclosure could give the infringers time to "delete, destroy, or otherwise conceal evidence" (PC Gamer).

The market reacted the same day. Take-Two shares fell about 7% on Monday, August 31 — down 7.2% in morning trading, according to Investing.com via StreetInsider — as the ongoing drip of leaked footage kept weighing on investor sentiment ahead of the November 19 launch. Stocks Down Under put the slide at more than 6%, with investors worried about what the leaks mean for the blockbuster release; The Motley Fool notes that GTA VI remains "by far the most important game in the company's release pipeline," and Benzinga ties the selling pressure to the string of leaks. Separately, Rockstar has now publicly addressed the leak wave: in a statement carried by Eurogamer, the studio called the gameplay leaks "heartbreaking" and warned they may contain spoilers. The identity of Cyberleek remains unknown, and the investigation continues.

Update — 2026-09-01

The hunt is now described as being close to a breakthrough. Russian outlet ixbt.games, citing TorrentFreak, reports on September 1 that Take-Two has "almost reached" the person behind the leaks and that the investigation has "reached a new level." The report contrasts the publisher's first subpoenas — broad requests that could have swept up data on thousands of users who interacted with the targeted Discord servers — with the narrower filing of August 28, in which Take-Two says it identified one additional Discord user, refined details on a previously known user and gathered new information on the communities named in its earlier request. The contents of the latest request remain sealed so that suspected infringers cannot cover their tracks; the court has yet to rule on the seal request, and the new subpoena has not been issued (ixbt.games). Cyberleek's identity is still unknown — but the net appears to be tightening.

Update — 2026-09-01 (JP coverage)

Japanese coverage of the affair, relayed by finance.biggo.jp, frames the person behind Cyberleek as a cryptocurrency operator — a reading consistent with the Solana wallet and $CYBERLEEK memecoin trail documented above — and quantifies the market damage: roughly $3 billion wiped from Take-Two's market capitalization since the leak wave began (finance.biggo.jp). The same outlet reported the publisher's federal subpoenas against Microsoft and Discord in its push to identify the leaker, and noted that the chaos deepened in mid-August when the person alleged to be behind the campaign denied the scheduled timing of additional footage releases (finance.biggo.jp). These reports predate the filings above; Cyberleek's legal identity remains unconfirmed.

Update — 2026-09-01 (AUTOMATON)

Japanese outlet AUTOMATON adds a significant procedural detail on September 1: Take-Two has reportedly withdrawn its DMCA subpoena request against Google/YouTube. The court had asked the publisher for additional explanations about three accounts linked to the leaked videos — it was not explained whether Take-Two had judged them relevant — and the request was dropped as the investigation progressed, which AUTOMATON reads as a sign the situation is shifting quickly (AUTOMATON). The same report confirms that the second Discord subpoena request of August 28 remains unissued, with no court ruling yet on keeping the sealed attachment out of public view, and that the publisher's hunt has now produced a more targeted filing against specific users and servers rather than the broad requests of the first wave (AUTOMATON).

Update — 2026-09-01 (Northern Star)

A profile published by the Northern Star, Northern Illinois University's student paper, frames the hunt from a different angle — and gives Cyberleek's self-presentation more texture. The outlet describes the persona as a "gaming activist" who advocates for three commandments: no digital pre-orders, no single-player content locked behind paywalls inside the game's code, and the ability to play single-player content offline (Northern Star). It notes that GTA VI's $80 price tag marks a sharp rise from the standard $60 AAA price, and quotes students debating the industry's shift toward battle passes and monetization — one interviewee calling the leaks "a slap in the face to the developers" while acknowledging fans' frustration (Northern Star). The profile also catalogs what leaked: a basketball clip, a beach bike ride, an overhead flight over Vice City — and a previously unreleased video of the first four minutes of the game's prologue, now unavailable online (Northern Star). On the legal front, it dates Take-Two's DMCA subpoenas against Discord and Microsoft to August 20 and notes that, as of publication, it was not known whether they had been served (Northern Star). The "activist" framing is Cyberleek's own claimed identity, as relayed by the outlet: the person's legal identity remains unconfirmed.

Update — 2026-09-01 (CN press)

Chinese outlet cnBeta also covered the investigation on September 1, relaying PC Gamer's reporting on the sealed filing: Take-Two has asked the court to keep the new subpoena request under seal so that details of the probe do not tip off suspected infringers (cnBeta). The report confirms the same procedural facts covered above — the narrower August 28 filing identifying one additional Discord user, the request for more identifying information on a known user and for supplemental leads on the community servers named earlier, and the company's position that public disclosure could lead alleged infringers to delete, destroy or hide evidence (cnBeta). It also notes that the court had not yet ruled on the seal request, that the new subpoena had not been issued, and that Take-Two withdrew its DMCA subpoena request against Google on August 28, reiterating that the investigation continues to evolve rapidly (cnBeta). No new facts beyond the existing coverage — the Chinese report is a confirmation of the same sealed-filing story.

Update — 2026-09-01 (GinjFo)

French outlet GinjFo recaps the same sealed-filing story on September 1, confirming the investigation's shift from broad requests to targeted individual leads — and adds one concrete detail not covered above: the three Google/YouTube accounts at the center of the withdrawn DMCA subpoena request were named CyberLeeks, Surfer24k and CyberLeek_ar_io. According to the outlet, Take-Two dropped that request because the information sought from YouTube was no longer needed as the investigation evolved (GinjFo). The publisher's argument for keeping the new Discord request under seal — that disclosure would let "alleged infringers" delete, destroy or hide evidence, and reveal how far the probe has progressed — is also confirmed, as is the timing of the withdrawal on August 28 (GinjFo). The legal status of Cyberleek is unchanged: the person's identity remains unconfirmed.

Update — 2026-09-01 (Eurogamer)

Eurogamer's own report on the sealed Discord subpoena, published September 1, confirms the details covered above and adds two points. First, the targets of the new filing are completely redacted in the document — Eurogamer reads this as a direct result of the subpoena's narrower focus, and notes that the alarmed public reaction to the original Discord request (which targeted hundreds of thousands of users across several servers) may have played a role in Take-Two's shift to secrecy (Eurogamer). Second, the outlet records Discord's public position: the platform said it had yet to be served and would "evaluate the validity and scope before responding" if and when it was (Eurogamer). Eurogamer also puts the leaker's crypto cash-out at about $270,000 (~£200,000) — a slightly higher estimate than the roughly $250,000 reported by Tom's Hardware — and notes the leaks ceased shortly before the Netflix showcase, consistent with the cash-out timing documented above. The subpoena has still not been issued, and a judge has yet to rule on keeping the filing sealed (Eurogamer).

Update — 2026-09-01 (Sohu / IT之家)

Chinese outlet Sohu, relaying IT之家, adds a naming detail on September 1: Chinese coverage refers to the GTA 6 leaker by the nickname "Da Cong Ge" (大葱哥, roughly "Big Scallion Brother") — a reference to the green-onion avatar associated with the Cyberleek persona — as Take-Two continues to pursue Discord subpoenas in the hunt (Sohu). The report confirms the key facts already covered above: the latest Discord subpoena was filed under seal, with no public details, and the publisher previously subpoenaed Discord, Microsoft and X for records of how the leaked videos were stored and distributed (Sohu). It also recaps the campaign's origins: the person behind the leaks uploaded GTA VI gameplay videos in mid-August, including one showing an aircraft flying across the Leonida map, which drew heavy discussion online (Sohu). No new procedural facts beyond the sealed-filing story — the Chinese report is a confirmation of the same investigation with a distinctive nickname for the leaker. Cyberleek's legal identity remains unconfirmed.

Update — 2026-09-01 (BFM Tech)

French mainstream outlet BFM Tech covered the investigation on September 1, recapping the sealed-filing story for a general audience — and adding one interpretive detail: the publisher's latest DMCA subpoena request, whose targets are kept anonymous, "could be the last," Take-Two describing the affair as "evolving rapidly" (BFM Tech). The report confirms the withdrawal of the request targeting the three Google/YouTube accounts Cyberleeks, Surfer24K and Cyberleek_ar_io — a judge did not accept the request and the publisher dropped it, stating it "no longer needed the information requested" (BFM Tech). BFM Tech also explains the legal mechanism behind the hunt: the DMCA subpoena lets rights holders request information about a third party without suing them, and Take-Two previously used it to target thousands of Discord users who participated, directly or indirectly, in the spread of GTA 6 images and videos (BFM Tech). No new procedural facts — the report is a French mainstream confirmation of the same sealed-filing story. Cyberleek's legal identity remains unconfirmed.

Update — 2026-09-02 (court authorizes the subpoena)

The hunt has cleared its biggest procedural hurdle. French outlet GinjFo reports on September 2 that the US federal court has authorized the second Discord subpoena that Take-Two requested on August 28 (GinjFo). Judge Andrew L. Carter ruled that there is sufficient cause and ordered the clerk's office to issue the subpoena — and, crucially, to do so "as sought by the petitioner," meaning the court accepted Take-Two's request to keep the filing's details under seal (GinjFo).

The ruling validates the shift in strategy already documented here. Unlike the first Discord subpoena — a broad sweep that targeted thousands of members across several servers — the second request seeks precise information on two specific users: one Discord user Take-Two says it has newly identified, and a previously identified user for whom it wants additional identifying information (GinjFo, UNILAD Tech). UNILAD Tech, which covered the same story on September 2, frames the filing as "potentially vital" and quotes Take-Two's position that its investigation into Cyberleek is "rapidly evolving" (UNILAD Tech).

GinjFo adds a note of caution: even with the subpoena authorized, it remains unlikely that Take-Two already knows Cyberleek's true identity — and because the procedure is sealed, the next developments in the affair are likely to unfold away from public view (GinjFo). The legal status of Cyberleek is unchanged: the person's identity remains unconfirmed, but the net has tightened another notch.

Update — 2026-09-03 (the $350,000 LP-fee figure)

The financial picture of the leak operation has been revised upward. On-chain analyst Conor Grogan — known for tracking cryptocurrency movements — now estimates that the wallets linked to the Cyberleek operation cashed out around $350,000, generated entirely from liquidity-provider (LP) fees, rather than from a brutal dump of a large token reserve (GinjFo, BeInCrypto). The mechanism was more sophisticated than a classic "pump and dump": Cyberleek created its own $CYBERLEEK memecoin, provided liquidity to the market, and collected a cut on every trade — meaning each new wave of leaked GTA 6 videos fueled attention, trading volume and fees (GinjFo).

The figure is a significant jump from the roughly $250,000–$270,000 cash-out estimates documented earlier in this article. GinjFo notes that an initial investigation, reported on August 22, had valued the potential fees at only a few tens of thousands of dollars, with a trail leading toward KuCoin — before several more days of intense activity around the token pushed the total much higher (GinjFo). Grogan adds that the funds were then moved through several OTC (over-the-counter) service providers, an intermediary layer that makes tracking harder than a straightforward sale on a centralized exchange — although blockchain movements remain public, and some platforms or intermediaries may hold information relevant to Take-Two's investigation (GinjFo). BeInCrypto, for its part, reports that $CYBERLEEK benefited from heavy speculation during the video releases, with a market capitalization approaching $25 million before collapsing more than 90% from its peak (BeInCrypto).

The new analysis tracks wallets, transactions and fee withdrawals — but, as GinjFo stresses, it still does not establish who actually controlled those wallets. The connection between Cyberleek, the wallet holders and the people responsible for the leaks remains an investigative hypothesis, and the identity behind the persona is still unconfirmed (GinjFo).

Update — 2026-10-14 (the campaign stops, the ending stays unpublished)

The Cyberleek leak campaign stopped on October 14 — not with the promised full build, but with a three-part farewell signed "CYBERLEEK". RockstarINTEL reports that the leaker posted "THE END OF THE ROAD" (parts 1/3, 2/3 and 3/3) at 13:08 on his own website, which then went offline, and that the final drop contained gameplay from the game's closing missions plus a glimpse of the ending, shown out of context.

He says he holds the ending and chose not to publish it. "The ending stays unpublished. Proof: the latest leek – clips from the final missions, out of context, revealing nothing," he wrote, arguing that leaking it "would punish Take-Two greatly – but ruin the experience for the gamers, who did nothing wrong" (RockstarINTEL, Insider Gaming). Neither Rockstar nor Take-Two has authenticated any of this material, so the claim remains what it has always been: an assertion by an anonymous account with a financial stake in being believed.

The most consequential line concerns whoever catches him. "The dead man's switch is active – story spoilers only. Left alone, it never fires. Whoever removes CL chooses it" (RockstarINTEL). Read literally, the account claims a stock of story spoilers would be released if he is taken down. No mechanism, no hosting detail and no proof were offered, and Take-Two has made no public comment on it (Insider Gaming) — a deterrent that costs nothing to claim and that nobody outside the account can verify.

The build never shipped because the money never arrived. "The 30M was not reached, so no build. Uploading 200+ GB anonymously is a serious risk," the farewell states (RockstarINTEL). The Daily Game News reported the token at a $1.7 million market capitalization on October 13, down from a $7.8 million peak on October 11 — a 78% drop — against the $30 million threshold. That left it at 5.7% of the target, needing roughly 17.6 times its value to unlock the release, and the roadmap's lower rungs — $13 million for police-shootout footage and $25 million for a train-versus-train clip — were never reached either (The Daily Game News).

His version of the cash-out matches the on-chain analysis published above. He insists he "sold twice. Both times: trading fees only, as always announced" (RockstarINTEL) — the same liquidity-fee mechanism the analyst Conor Grogan described when he estimated about $350,000 in revenue for the wallets tied to the operation (GinjFo, BeInCrypto). That detail corroborates the fee-based reading and sits awkwardly with the "textbook rug pull" framing that followed the token's collapse in late August (PC Gamer).

Two months on, nobody has been publicly identified. Neither US law enforcement, Rockstar nor Take-Two has named a suspect, and a fact-check published on October 14 relays Dexerto's line that "Cyberleek is a brand, not an identified person". Take-Two's subpoenas against Microsoft, Discord, X and Google — including the sealed Discord order a judge authorized on September 2 — have produced no known arrest, and Rockstar's last GTA 6 Newswire post before the farewell, on October 8, dealt with in-game radio stations rather than the leaks.

The 2022 leak ended far faster for the person responsible. The BBC reported that Arion Kurtaj, an 18-year-old member of the Lapsus$ group, stole 90 GTA 6 clips, breaching Rockstar with an Amazon Firestick, a hotel television and a mobile phone after his laptop had been confiscated, and threatened to release the source code unless the studio contacted him within 24 hours. He was re-arrested after the September 2022 dump and, in December 2023, handed an indefinite hospital order. An arrest in days versus an anonymous goodbye two months on: that gap is the real measure of how this episode ends.

The farewell is hedged, though. "The Edict stands. The leeks stop here. For now," the final message reads (RockstarINTEL) — four words that leave the door open 36 days before the game's November 19 launch, with the ending, by his own account, still unpublished and the switch, by his own account, still armed.

See also

• GTA VI launch guide: release date, editions and pre-orders