The anonymous leaker known as Cyberleek has tied the release of stolen scenes from the upcoming video game Grand Theft Auto VI (GTA 6) to the market value of his own Solana token. Under the scheme, new leaked footage is unlocked only when the token's valuation reaches specified levels. Anyone buying the Cyberleek memecoin, however, acquires no financial claim — the only consideration on offer is the prospect of further copyrighted material.

GTA 6, Rockstar Games and Take-Two

Grand Theft Auto is a video game series from Rockstar Games. Since 1997, it has sold around 475 million copies — more than 200 million of them from the previous installment, GTA V, which ranks among the most successful entertainment products of all time. Behind Rockstar stands Take-Two Interactive, a group listed on the NASDAQ. After two delays, the next installment in the series arrives on November 19, 2026. For Take-Two, it is the most important product of the year, and public anticipation is measurable: the first official trailer set a YouTube record for non-music video debuts when it appeared in December 2023, drawing more than 90 million views within 24 hours.

Accordingly, the stock reacted sensitively to the first leak videos, temporarily falling by around 6 percent. The financial press puts that decline at roughly USD 2.83 billion in market capitalization and attributes it to the releases. By August 21, the share price had recovered part of the loss. Take-Two itself has not quantified the incident so far.

A memecoin, in turn, is a speculative token with no business model and no cash flows. Its price therefore comes almost entirely from trading in onchain pools. Cyberleek repurposes this instrument: market value here is no price barometer but a switch governing the release of stolen material.

Market capitalization as the unlock condition for leak videos

The associated domain was created on August 14. The mint of the $CYBERLEEK token followed a day later, with its Fully Diluted Valuation initially standing at around USD 55,000. From August 18, the first leak clips appeared.

As a condition for further videos, Cyberleek names neither a sum of money nor a date. Instead, the leaker calls out a market capitalization that his own token must reach before the next video is released. The strip club gameplay appeared exactly when the market capitalization crossed the previously announced threshold of USD 3 million. Every video published since then carries a watermark with a QR code that leads directly to buying the token. In automated onchain pools, market capitalization is derived from the current pool price, so a headline threshold can in principle be crossed with trades far smaller than the stated figure.

Market capitalization now stands at USD 19.12 million, more than six times that threshold. On August 18, trading volume reached USD 5.47 million within a single hour. Most recently, USD 40.58 million in volume came together over 24 hours, while the price rose 3.01 percent to USD 0.026174. That volume thus amounts to more than twice the market capitalization — a sign of short-term churn. Overall, around 730 million of a maximum of 1 billion tokens circulate at present. Previously, between August 20 and August 23, the price had climbed from USD 0.000603 to USD 0.034361, which corresponds to roughly 57 times, measured from the all-time low to the all-time high. All figures are a snapshot from August 24, 12:35 UTC.

Who stands behind Cyberleek remains unresolved. Whether an individual, a group, or former Rockstar employees — none of the attributions in circulation is proven. Several alleged profiles have likewise turned out to be fakes. Those behind the leaks still style themselves as hacktivists. With the slogan "No Disc, No Peace," they protest against purely digital pre-orders.

Cyberleek memecoin buyers acquire no financial claim

Structurally, $CYBERLEEK is no investment product. Buyers receive no claim to cash flows and no stake in a company or project. A legally enforceable voting right does not arise either. The only consideration Cyberleek holds out is the unlocking of further copyrighted recordings. The return on this token is therefore a video.

For now, the case allows only a general regulatory classification. FINMA distinguishes between payment tokens, utility tokens and asset tokens, and only the latter count as securities. MiCA, the EU regulation, by contrast exempts utility tokens from the core obligations. That exemption applies provided the tokens grant access to an existing good. A case-specific assessment of $CYBERLEEK by a supervisory authority is still outstanding.

The benefit on offer is, moreover, no existing good but stolen material. At the same time, Take-Two pursues its distribution with ongoing takedown requests. Buyers ultimately finance a service that the rights holder actively tries to stop. A utility token grants access to a legal service; here, the value hangs on the continuation of a legal violation.

Onchain data show concentrated gains at early wallets

An onchain analysis by the analytics firm Bitquery covers the first seven days up to August 21. Over that span, the company counted 163,014 trades from 16,182 wallets. Volume in the main pool reached USD 22.7 million. Particularly striking is the distribution of the gains. The five most profitable wallets all bought in for the first time on August 18. Their entries fell within the same six-minute window, between 17:48 and 17:54 UTC. On selling, they later realized around USD 158,000. None of these addresses links to the deployer of the token, however. One of them had already received 1,000 SOL from an exchange on August 4 — two weeks before the first leak video.

Whether Cyberleek earns from the trading itself is open. Pump.fun is the largest Solana platform for memecoin launches and has hosted millions of token launches since it went live in January 2024. It overhauled its creator fee system in January 2026. Creators can since spread their share of the trading fees across up to ten wallets. Consequently, a structure exists through which a leaker could earn from trading volume alone, regardless of what buyers receive. No verifiable source shows, though, that it applies in this case, and evidence of such an inflow to Cyberleek is still lacking.

The sources also contradict each other on the contract address. Bitquery lists the token under an address with the prefix ApZuxdpz, with trading accordingly running through a Raydium pool without a launchpad. An OpenSea listing instead names a different address ending in "pump," which points to a launch via Pump.fun. Which of the two carries the relevant trading pair is unresolved. Details on a burned liquidity pool likewise come only from scanner and marketing sites. The same holds for revoked mint and freeze rights. An independent review is still missing, so these features form no basis for a risk assessment.

Take-Two pursues the leaker's identity in court

The rights holder answers through the courts. Take-Two Interactive has the videos removed continuously via DMCA notices. The group has also applied for subpoenas under DMCA §512(h), orders that ultimately aim at the release of user data by the platforms. The applications went to the U.S. District Court for the Southern District of New York. They first targeted Microsoft and Discord, and the following day X and YouTube. Judges Andrew L. Carter Jr. and Jennifer L. Rochon signed the orders. Formal service is still pending. So far, no platform has disclosed user data.

"[The purpose is] to identify an alleged infringer or infringers, and this information will be used only to protect the rights of Take-Two." — Take-Two lawyers, in the filing with the U.S. District Court for the Southern District of New York

Rockstar Games itself has not commented on the leaks. As a result, the DMCA measures of the parent company remain the only response.

A precedent from 2022 shows how seriously earlier cases ended. Arion Kurtaj, a member of the hacker group Lapsus$, was under police protection in a hotel at the time. Nevertheless, he uploaded around 90 GTA 6 videos to a forum. A British jury found in August 2023 that he had committed hacking, fraud and blackmail. A conviction did not follow, because expert witnesses deemed him unfit to stand trial. In December 2023, the court consequently ordered indefinite detention in a secure hospital. According to BBC correspondent Joe Tidy, he now sits in a regular prison. A retrial follows in November 2026 — the same month in which GTA 6 itself is scheduled for release.