Grand Theft Auto VI has spent years being one of the most closely guarded games in the industry. Rockstar Games has released information about the game on its own terms, carefully controlling trailers, screenshots, characters and gameplay footage.

That changed on 18 August 2026.

An account calling itself CyberLeek began releasing previously unseen Grand Theft Auto VI gameplay footage online. What initially looked like another isolated leak quickly became something much larger.

More footage followed over several days. Maps appeared. The videos showed Jason Duval driving, fighting, flying, stealing vehicles, interacting with NPCs and moving through parts of Vice City and the surrounding world.

Then came the other side of the story.

CyberLeek attached political and anti-industry messaging to the leaks, promoted a cryptocurrency token and began using the attention around GTA VI to build its own online presence. Take-Two Interactive, Rockstar’s parent company, responded with legal action aimed at identifying the people behind the accounts.

By 24 August, CyberLeek’s own website was documenting 11 gameplay videos and three map images.

On 27 August, Rockstar finally addressed the situation publicly, describing the leaks as heartbreaking for the development team while confirming that the game remains on course for its 19 November release.

This is the complete picture so far.

The CyberLeek GTA VI leak timeline

18 August: the first footage appears

The CyberLeek operation first became widely known on 18 August.

The initial material consisted of gameplay footage showing Jason in the GTA VI world. This was not a trailer, promotional clip or previously released Rockstar material. It appeared to be footage captured from an internal development build.

The timing was particularly significant.

Rockstar had already announced that an official Grand Theft Auto VI: An Extended Look would premiere on Netflix on 27 August, with the same presentation subsequently appearing elsewhere.

CyberLeek had therefore released genuine-looking gameplay material only days before Rockstar was due to show the public more of the game itself.

The first clips were enough to establish that this was not simply another recycled 2022 GTA VI leak.

More footage followed almost immediately.

1. Basketball

The first entry in CyberLeek’s later drop log was labelled Basketball.

The footage shows Jason shooting hoops outside his house.

On its own, it was not particularly long or story-heavy. Its importance came from what it demonstrated.

It showed ordinary open-world activity rather than a scripted trailer sequence. Jason could simply be in the world, interacting with the environment and carrying out an everyday activity.

That helped establish the broader nature of the material that followed.

2. Random 1

The second major clip, labelled Random 1, provided a broader look at Jason moving through the open world.

The footage reportedly included NPC interactions, weapons and elements of the personal vehicle system.

Again, the important point was not necessarily any individual feature.

It was the accumulation of small details.

The leaked material showed the game behaving like an actual playable environment rather than a collection of isolated cinematic scenes.

That distinction became increasingly important as more clips appeared.

3. Taser

The next release was labelled Taser.

This footage moved away from the relaxed open-world material and into a nighttime sequence involving a taser and combat.

The footage also included a cutscene segment.

By this point the leaks were beginning to demonstrate several different parts of the game rather than repeatedly showing the same area or activity.

4. Junkies

The Junkies footage followed.

This sequence reportedly included a motorcycle theft, swimming or river footage and an encounter underneath a freeway.

Once again, the footage was not presented as a coherent mission from beginning to end.

Instead, it appeared to provide fragments of a much larger development environment.

That was becoming a recurring characteristic of the CyberLeek material.

5. Plane

The next major clip showed Jason flying a plane during the daytime.

The footage provided a different perspective of the world, with Vice City and its surrounding environment visible from above.

The clip became particularly memorable because it ended with a “LEEK” message being shot into a wall.

The joke was obvious, but the message also reinforced that the footage was being released deliberately as part of the CyberLeek campaign rather than simply appearing anonymously without explanation.

6. Hypercar 1

The sixth video was labelled Hypercar 1.

This footage concentrated on driving.

It showed a high-performance vehicle being driven through Vice City, with additional details relating to the wanted system and vehicle identification.

For people interested in the technical side of GTA VI, clips such as this were arguably more revealing than the headline-grabbing scenes.

They offered glimpses of how Rockstar’s systems actually operate during ordinary gameplay.

7. Hypercar 2

Hypercar 2 expanded on the driving footage.

This sequence reportedly included driving, refuelling and a gas station robbery, along with progressive vehicle damage.

The footage also contained a tease involving a strip club.

Taken together, these clips suggested a world containing a much greater range of ordinary interactions than Rockstar had publicly demonstrated at that point.

8. Strip Club

The next release focused on the strip club.

The footage reportedly provided an extended look around the interior before moving into a separate Jason cutscene near the Rusty Anchor area.

Unlike a conventional trailer, the material was not edited to present the game in its best possible light.

That is one of the reasons the footage attracted so much attention.

Viewers were seeing development material, including ordinary transitions and unfinished-looking elements, rather than polished marketing footage.

9. Gas / Wasted

The ninth reported video was labelled Gas / Wasted.

It showed a gas station encounter involving a stolen pickup, followed by a vehicle explosion.

The footage also reportedly contained the first visible WASTED screen in the CyberLeek material, alongside another cutscene sequence.

This was another example of the leaks revealing small pieces of the underlying gameplay systems rather than simply spoiling a major story moment.

10. Plane (Night)

A second aircraft clip followed, this time at night.

The footage showed a nighttime flight around Vice City International Airport and the illuminated city skyline.

A fishing-location prompt was also reportedly visible.

The significance of the clip was largely environmental.

A nighttime aerial view provided another opportunity to see the scale and lighting of Vice City, particularly away from the carefully selected angles used in official marketing.

11. Nudist Town

The latest entry in CyberLeek’s own drop log was Nudist Town, released on 24 August.

The footage reportedly showed a pool and sauna party area populated by nude NPCs.

It was an unusual piece of footage and quickly became one of the more widely discussed clips because of its subject matter.

More importantly, it demonstrated that CyberLeek was still releasing new material nearly a week after the initial leak.

The group’s own website listed the sequence as the eleventh gameplay video in its chronology.

The three map images

The videos were not the only material released.

Three map images were also associated with the CyberLeek leak campaign.

The map material attracted considerable attention because GTA VI’s world is one of the biggest unanswered questions surrounding the game.

Vice City has been officially confirmed, but Rockstar has deliberately avoided publishing a complete navigable map of the game world.

The leaked images therefore became another source of speculation about locations, roads, bodies of water and the overall scale of the map.

As with the videos, however, it is important to distinguish between what an image actually demonstrates and what people subsequently infer from it.

A map image can reveal geography.

It cannot, by itself, prove that every marked location will function exactly as viewers expect in the final release.

Did CyberLeek actually have a GTA VI build?

This is one of the most important questions surrounding the entire affair.

The footage appeared sufficiently extensive and internally consistent to lead multiple outlets to report that whoever was behind the operation appeared to have access to an actual development build rather than a handful of isolated video files.

Push Square reported that the leaker appeared to have an actual build of the game.

That does not necessarily mean CyberLeek itself originally obtained the build.

There is an important distinction between:

having access to a development build

and

being the person who originally extracted it from Rockstar’s systems.

The public evidence does not establish that CyberLeek was necessarily the original intruder.

The group may have obtained the material from another individual, received it through a private network or gained access through an account or system belonging to somebody else.

That distinction matters because the legal investigation is ultimately about attribution.

Who uploaded the files is not necessarily the same question as who originally obtained them.

The CyberLeek message

As the releases continued, CyberLeek’s identity became more obvious.

The operation was not simply dumping files anonymously.

The footage carried CyberLeek branding and messages.

One recurring theme was the word “leek”, a deliberate play on “leak”.

At least one video also contained messaging relating to physical game discs.

The basic argument was that publishers increasingly sell digital licences rather than physical ownership, while games can be altered, restricted or removed through online services.

CyberLeek presented its actions as part of a wider argument about the future of gaming.

The CyberLeek Edict

CyberLeek published what it called The CyberLeek Edict.

The document positioned the group as an opponent of what it described as anti-consumer practices in the games industry.

Its complaints included digital-only ownership, digital pre-orders, downloadable content and games being shut down after consumers have purchased them.

CyberLeek also claimed that it was raising money for a secret project.

The group said the money would be used for infrastructure, security and protection against what it described as an inevitable response from large companies.

Whether that explanation should be taken at face value is another matter.

The leaks were accompanied by a cryptocurrency promotion, which introduced an obvious financial incentive into the operation.

The $CYBERLEEK cryptocurrency connection

The cryptocurrency angle changed the story considerably.

CyberLeek promoted a Solana-based token known as $CYBERLEEK alongside the leak campaign.

That immediately created a question which did not exist with a conventional game leak:

Was the GTA VI leak an ideological protest, a publicity campaign, a money-making operation, or some combination of all three?

Reports have suggested that the token generated significant trading activity after the GTA VI footage began spreading.

One blockchain analysis reported an estimated $40,000 to $60,000 in trading fees, although that figure is an estimate rather than a confirmed amount of money personally received by the people behind CyberLeek.

The token’s valuation and trading volume also reportedly increased sharply following the appearance of new GTA VI footage.

That does not prove that financial gain was the original reason for obtaining the GTA VI material.

It does, however, establish that the leak campaign created a financial ecosystem around the CyberLeek name.

Claims about cryptocurrency inside GTA VI

CyberLeek also made claims about cryptocurrency or an in-game currency being convertible into real-world money.

Those claims spread rapidly because of the obvious connection between the leak campaign and the $CYBERLEEK token.

There is currently no official Rockstar confirmation that GTA VI will contain such a system.

That distinction is important.

A statement made by a person claiming access to leaked material is not automatically evidence that the feature will exist in the final game.

For now, the claim should be treated as unconfirmed rather than established GTA VI information.

The Arweave connection

CyberLeek also used decentralised storage infrastructure.

Its own website discussed Arweave and the idea of permanent storage, arguing that removing an original upload does not necessarily remove the underlying data from decentralised systems.

This was significant because the group was effectively anticipating copyright enforcement.

Traditional takedowns work by removing files from a particular platform.

Decentralised storage creates a different problem: the original hosting location and the gateways used to access that information can be separate.

CyberLeek explicitly highlighted this distinction.

That does not make the material immune from copyright law. It simply changes the practical problem facing anyone trying to remove it from circulation.

Take-Two fights back

Take-Two did not simply watch the footage circulate.

The company began pursuing information about the accounts and infrastructure connected with the leaks.

On 20 August, Take-Two filed DMCA subpoena requests in the US District Court for the Southern District of New York targeting Microsoft and Discord.

The objective was straightforward:

identify the people behind CyberLeek.

The requests sought identifying information and account records associated with the people and communities believed to have been involved in distributing the material.

What Microsoft was being asked for

The Microsoft request was particularly interesting because of the amount of information potentially available through Microsoft services.

Reporting on the filing said the request sought information associated with accounts, including registration details, IP information, linked services and device identifiers.

The request also referenced OneDrive material and information associated with Microsoft’s own investigation into the CyberLeek persona.

That could potentially be much more valuable to investigators than simply knowing which account uploaded a video.

If a leak-related account was connected to an Xbox account, Microsoft account, Google connection, device or historical IP address, those links could potentially help establish who was actually operating it.

Discord was also targeted

Take-Two’s Discord request was broader in some respects.

The filing sought information relating to accounts and specified Discord communities connected with the leak investigation.

The request reportedly included identifying information, IP logs, email addresses, telephone numbers, linked services, device identifiers and other metadata.

One particularly notable aspect was the scope of the requested information.

The filing did not simply focus on a single CyberLeek account.

It also sought information concerning users communicating within specified servers.

That immediately raised concerns among members of the GTA community who had no direct involvement in the original leak.

Being named in a subpoena request does not mean that person is accused of stealing GTA VI.

That distinction is essential.

The DarkViperAU connection

One of the names that attracted attention was Matthew “DarkViperAU” Judge.

His name appeared in reporting surrounding the Discord request.

Judge publicly stated that he did not know anything about the leaks and disputed the description of the Discord server associated with him.

This illustrates one of the problems with a broad investigation into an online leak.

A person can appear in the investigative paper trail simply because of a server, account or association without being the source of the material.

The legal filings should therefore not be interpreted as a list of people Take-Two has established were responsible.

Take-Two expands the investigation

The investigation did not stop with Microsoft and Discord.

Further reporting said Take-Two also sought information from X and Google/YouTube concerning accounts and videos connected to the CyberLeek material.

This is important because the leak campaign was distributed across multiple platforms.

Taking down one account does little if copies have already appeared on:

• X
• YouTube
• Discord
• GitHub
• Telegram
• decentralised storage
• other file-hosting services
• mirrors and reuploads

The investigation therefore became a network problem rather than a single-account problem.

The subpoenas are not a finding of guilt

This point has been lost in some of the online reporting.

A subpoena request is not a criminal conviction.

It is not a court finding that a particular person stole GTA VI.

And it does not establish that every account named in a filing was responsible for the original leak.

The purpose of the process is to obtain information that may help identify alleged infringers.

TorrentFreak’s review of the filings also noted an important procedural detail: the documents were requests for DMCA subpoenas rather than a conventional lawsuit establishing liability.

That distinction matters when discussing who is actually responsible.

Microsoft, Discord and the September deadline

The filings sought production by 4 September 2026.

Discord subsequently said it had not yet been served with a subpoena at the time of its public comments and would review any valid request before responding.

That means the investigation is not necessarily at the point where Take-Two has received a complete set of account information.

The legal process is still developing.

The CyberLeek website and Telegram channel disappear

The situation took another turn when CyberLeek’s website and Telegram presence were reportedly taken down.

That was interpreted by some observers as a sign that the leak campaign might finally be coming to an end.

But a takedown does not necessarily mean the material itself has disappeared.

Copies had already been redistributed across the internet.

That is precisely the problem CyberLeek had been highlighting through its discussion of decentralised storage.

What is confirmed, and what is not?

This is probably the most useful way to look at the entire story.

Confirmed or strongly established

• GTA VI gameplay footage appeared online beginning on 18 August 2026.
• The footage was released under the CyberLeek name.
• Multiple previously unseen gameplay clips circulated.
• CyberLeek documented 11 gameplay videos and three map images through 24 August.
• The material showed Jason and elements of the GTA VI world.
• CyberLeek promoted the $CYBERLEEK cryptocurrency.
• CyberLeek published an anti-industry manifesto known as the CyberLeek Edict.
• Take-Two pursued legal processes aimed at identifying people connected with the leak.
• Microsoft and Discord were targeted in subpoena requests.
• Further legal action involving X and Google/YouTube was subsequently reported.
• Rockstar has now publicly addressed the leaks.
• GTA VI remains scheduled for 19 November 2026.

Reported but requiring caution

• That CyberLeek itself originally obtained the GTA VI development build.
• That a particular individual is behind the CyberLeek account.
• That every person named in the legal filings was involved in obtaining or distributing the original material.
• That GTA VI will contain a real-world-convertible cryptocurrency system.
• That the $CYBERLEEK token represents a legitimate funding mechanism for CyberLeek’s stated project.
• That every map detail circulating online represents the final game.

Was this connected to the 2022 GTA VI hack?

The answer is not straightforward.

GTA VI was already subjected to a major leak in 2022 after a hacker gained access to Rockstar’s internal systems and released a huge quantity of development footage.

That incident exposed the game years before release.

The 2026 CyberLeek operation is different in several obvious ways.

The 2022 material was associated with a major intrusion into Rockstar’s systems.

The CyberLeek material appeared years later and was released as part of a deliberate campaign with branding, messaging, cryptocurrency promotion and a manifesto.

That does not prove the two incidents are completely unrelated.

It simply means there is currently no established public evidence that CyberLeek was the same person or group responsible for the 2022 intrusion.

Why the CyberLeek leaks matter

At first glance, this might seem like another GTA leak.

It is not quite that simple.

The footage itself is interesting because GTA VI is arguably the most anticipated game release in the world.

But the wider story is more significant.

CyberLeek turned a game leak into a campaign.

The gameplay footage generated attention.

The attention drove people towards CyberLeek’s website and social channels.

The channels promoted a manifesto.

The manifesto promoted an ideological argument about the games industry.

The operation also promoted a cryptocurrency.

Then Take-Two began attempting to identify the people behind it.

The result is no longer simply a story about leaked gameplay.

It is a story about how quickly unreleased digital material can move through modern networks, how difficult it can be to remove once replicated, and how an anonymous online identity can become both a media brand and a financial vehicle.

The timing could hardly have been more awkward for Rockstar

Rockstar had planned an official extended look at GTA VI for 27 August.

The company had announced the presentation weeks earlier, with the extended look scheduled to premiere on Netflix before subsequently becoming available elsewhere.

Instead of controlling the final days before that presentation, Rockstar found itself dealing with a stream of unofficial footage.

That does not necessarily mean the leaks have damaged the game itself.

In some respects, they may have done the opposite.

The enormous interest in the clips demonstrated just how closely people are watching GTA VI.

But it has unquestionably changed the environment surrounding the official reveal.

Rather than being the first opportunity for the public to see several of these systems and locations, Rockstar’s presentation now arrives after days of unofficial material.

Rockstar finally responds

On 27 August, Rockstar publicly addressed the situation.

The company described the leaks as deeply upsetting for the development team and thanked players for continuing to support the game.

Rockstar also stressed that GTA VI remains in development and that the team is focused on delivering the game to the expected standard.

Most importantly, the company did not announce another delay.

GTA VI remains scheduled for 19 November 2026.

What we still do not know

There are still several major unanswered questions.

Who is CyberLeek?

No publicly confirmed real-world identity has been established.

Where did the footage originally come from?

The existence of apparently authentic development footage does not, by itself, identify the original source.

Did CyberLeek possess the entire build?

There is evidence suggesting access to substantial development material, but that does not establish precisely what was possessed or by whom.

Was the cryptocurrency the primary motivation?

The token clearly became part of the campaign.

It is not yet possible to say with certainty that financial gain was the original reason for the leak.

How much money was actually made?

Blockchain analysts have produced estimates of trading fees and activity, but estimates of fees generated by a token are not the same thing as proven personal profit.

Will anyone be identified?

That may depend heavily on what Microsoft, Discord, Google, X and other services retain about the accounts involved.

Will the final GTA VI be identical to the leaked build?

Almost certainly not in every detail.

Development builds change.

Features are added, removed and modified.

A leaked build is a snapshot of development, not automatically a blueprint of the finished product.

The complete CyberLeek story in one place

The CyberLeek GTA VI leak began as a handful of unexpected gameplay clips.

It quickly became something considerably larger.

Across the following days, footage showed basketball, driving, combat, tasers, motorcycles, aircraft, gas stations, vehicle damage, nightlife locations, NPC encounters and other parts of the game’s world.

Three map images added another layer to the story.

Then came the CyberLeek Edict, the anti-industry argument and the $CYBERLEEK token.

As the material continued circulating, Take-Two moved towards identifying the people behind the operation, targeting Microsoft, Discord and subsequently other platforms through legal processes.

CyberLeek’s website and Telegram presence later disappeared.

And then, on the same day Rockstar’s official extended look was due to arrive, Rockstar finally spoke publicly about the situation.

What happens next is more difficult to predict.

The footage is already out.

Copies exist in multiple places.

The legal investigation is underway.

And whoever is behind the CyberLeek identity now faces the most important question of the entire affair:

Can an anonymous leak operation remain anonymous once the companies involved start following the accounts, devices, IP addresses and financial transactions behind it?

That is the part of the CyberLeek story that has not been answered yet.

CyberLeek GTA VI leak chronology

Date	Material / event	What it showed
18 Aug 2026	Basketball	Jason shooting hoops
18 Aug 2026	Random 1	Open-world gameplay and NPC interaction
19 Aug 2026	Taser	Night sequence, taser and combat
19 Aug 2026	Junkies	Motorcycle theft, swimming and encounter
20 Aug 2026	Plane	Daytime aircraft footage
20 Aug 2026	Take-Two legal action	Microsoft and Discord subpoena requests
21 Aug 2026	Hypercar 1	High-speed driving and wanted system
22 Aug 2026	Hypercar 2	Driving, refuelling and gas station robbery
22 Aug 2026	Strip Club	Interior footage and Jason cutscene
23 Aug 2026	Gas / Wasted	Gas station encounter and WASTED screen
23 Aug 2026	Plane Night	Night flight and Vice City skyline
24 Aug 2026	Nudist Town	Pool/sauna area and NPCs
24 Aug 2026	CyberLeek website/Telegram reportedly taken down	Leak infrastructure begins disappearing
27 Aug 2026	Rockstar response	Official response to the leak
27 Aug 2026	GTA VI Extended Look	Rockstar’s planned official presentation