Take-Two filed two DMCA subpoena petitions in a Manhattan federal court on Thursday, and most coverage treats that as the story. It isn’t. The sharpest evidence in the GTA VI leak saga has sat in plain sight on a public blockchain for a week, pointing somewhere the subpoenas don’t. The group behind the leaks calls itself Cyberleak and wants you to see a consumer rights crusade. The wallet history shows a product launch.
Quick catch-up. On August 16, Cyberleak began posting alleged GTA VI assets on Dread, a darknet forum past the reach of normal moderation. Jason playing basketball, a melee scrap triggering a wanted level, the full Leonida map, later clips of cops being tased. Every file carries a watermark for their site and a $CYBERLEEK Solana memecoin banner baked into the video itself.
The coin was minted before the first clip dropped
Here’s the detail that reframes everything. I spent part of this week pulling the on-chain records myself, building on the fan mapping of Cyberleak running on GTAForums. The $CYBERLEEK token was minted roughly seven hours and forty-seven minutes before the first leak appeared. A single wallet funded the domain, the token launch, and the distribution wallet. Nobody stumbled into monetization mid-crusade. The funnel was built first, then filled with stolen footage.
The economics explain the behavior. Setup ran near $29,000, with an estimated $40,000 to $60,000 recovered on day one and roughly $4,400 a day accruing in trading fees. That’s why the releases are metered like episodes. Lapsus$ blasted everything it took from Rockstar in 2022 in a single night. Cyberleak runs polls on what drops next, escalates threats on schedule, and hoards inventory, because fees accrue daily until November 19. This isn’t a dump, it’s a subscription.
And the amplification is free, because Rockstar’s own marketing calendar does the promoting. The exclusive extended look hitting Netflix on August 27 hands every future drop a ready-made news cycle. We broke down the Netflix extended look earlier this week, and the timing here is no accident.
The dragnet is catching bystanders
The Microsoft petition, filed August 20, reaches for GitHub records, Xbox accounts, device IDs, telemetry, OneDrive content, and tellingly, documents from an internal investigation Microsoft had apparently already opened into the cyberleek persona. Telemetry flagged this activity before Take-Two ever went to court. Within a day, Xbox CTO Scott Van Vliet was publicly confirming Microsoft is working closely with Take-Two and Rockstar. Companies don’t align that fast unless they were talking first.
The Discord petition is uglier. It demands member records back to June 1 across five servers, including the editors’ server for YouTuber DarkViperAU. Emails, phone numbers, login IPs, machine IDs, OneDrive files, for every member of those servers, not a named suspect. Matthew Judge, the man behind the channel, said it plainly: “They’re asking for my discord info, I’m mentioned by name… I don’t know anything.” He then spent three hours on stream working through the panic, at one point flashing a leak frame and deleting it live.
Judge also gave the saga its defining meme. He mocked how badly the leaker drives, and soon “cyberleak can’t drive” surfaced as a watermark on later clips. The leaker lurks his community closely enough to answer back. Funny, until you remember this same person is dangling story spoilers over millions of fans.
Legally, these remain ex parte petitions, unconfirmed as served, with a September 4 compliance deadline if they land. Rockstar has said nothing beyond firing off takedowns, which most read as quiet authentication. Those takedowns carry a cost, though. Recompressed re-uploads now dominate, and the evidentiary record is degrading in real time.
What matters before November
Two questions deserve honesty. On authenticity, an insider claims the footage is over a year old, and the file metadata carries a 2023 FFmpeg build, though old encoders get reused for years and date nothing. Claims of live access to a current build rest on one biplane clip that vanished before verification. On quality, the “is it mid” discourse mostly measures compression, not the game. Modders have shown the washed-out screenshots come from apps botching HDR to SDR conversion, not a graphical downgrade.
Meanwhile a stranger collision unfolds. The fired Rockstar developers known as the Rockstar 34 urged fans this week not to boycott GTA VI and to fund their September UK tribunal through merch instead. Stop Killing Games publicly begged people not to send Cyberleak money, spooked by guilt by association. Genuine preservation advocacy is now squeezed between a union fundraiser and a memecoin wearing its rhetoric.
My honest read: the subpoenas probably identify a persona eventually, maybe sooner given Microsoft’s head start. But the strongest identification vector never sat in Redmond or San Francisco. It’s the KYC’d cash-out route through KuCoin in the Seychelles, which needs law enforcement rather than litigation, and which the leakers chose themselves the moment greed beat caution. Until someone acts on it, every clip and threat is a candle burning toward November 19, and the only asset guaranteed to appreciate is the coin. The uncomfortable question isn’t whether Take-Two catches them. It’s why the scheme works at all, and the answer is that none of us can stop watching.
