Wallets associated with the CYBERLEEK memecoin moved approximately $350,000 generated through liquidity provider fees after unauthorized GTA VI footage drove attention toward the token, according to onchain analyst Conor Grogan.
- Onchain analyst Conor Grogan traced roughly $350,000 in withdrawals to wallets associated with CYBERLEEK activity.
- Grogan said the proceeds came from liquidity fees rather than large direct token sales alone.
- CyberLeek’s controller remains publicly unidentified, and wallet analysis does not prove the operator’s legal identity.
- Take-Two obtained federal subpoenas seeking Microsoft and Discord records connected to the unauthorized gameplay leaks.
- Microsoft and Discord were directed to produce requested records by September 4, court documents show.
Grogan said on Sept. 1 that the funds passed through several over-the-counter providers. He attributed the wallets to the person or group responsible for the GTA VI leaks, but the controller’s identity has not been confirmed publicly.
The analyst’s post described the proceeds as coming entirely from liquidity fees rather than the operator selling a large CYBERLEEK allocation directly into the market.
Take-Two Interactive, the parent company of GTA VI developer Rockstar Games, is separately using federal court subpoenas to identify accounts involved in publishing and distributing the leaked material.
CYBERLEEK wallets collected trading fees
CYBERLEEK launched on Solana on Aug. 15, according to publicly reported blockchain data. The project gained attention as an online account using the CyberLeek name released previously unseen footage from GTA VI.
A liquidity provider supplies token pairs to a decentralized exchange pool. Traders use that pool to buy or sell an asset, paying fees that are distributed to liquidity providers based on the platform’s rules.
Grogan said the CYBERLEEK operator profited from that structure. Each release of unauthorized GTA VI material attracted attention, while the resulting token trades produced additional fees for the wallet supplying liquidity.
The process did not require the operator to sell the bulk of the original liquidity position. Instead, the wallet could collect fees while traders continued exchanging CYBERLEEK through the pool.
Grogan described the arrangement as the first instance he had observed in which a suspected hacker made money solely through liquidity provision rather than dumping a token. His statement reflects his analysis of the wallet activity, not a finding by a court or law enforcement agency.
The onchain data can show transfers, liquidity positions and fee withdrawals. It cannot independently prove who controlled the wallets or whether the same person obtained and released Rockstar’s copyrighted files.
Wallet movements do not identify the GTA VI leaker
The individual or group behind CyberLeek remains unknown. No court filing, police statement or Rockstar announcement has publicly connected a named person to the wallets examined by Grogan.
Referring to the controller as the GTA VI hacker therefore goes beyond the currently established evidence. The available record shows that the CyberLeek alias distributed unauthorized footage and promoted a token carrying the same name.
Grogan said the $350,000 passed through several OTC providers. These services can facilitate direct asset trades between counterparties without routing the full order through a public exchange.
Using an OTC provider does not automatically prove money laundering. Grogan used the term “washed” to describe the transfers, but no regulator or court has ruled that the funds constituted criminal proceeds or that the service providers knowingly processed illegal transactions.
The distinction matters because blockchain attribution often relies on transaction patterns, address labels and links between wallets. Such methods can establish probable relationships, but they may not reveal the ultimate beneficial owner.
The case resembles other memecoin structures in which locked or retained liquidity continues producing revenue for its creator. An explanation of how locked liquidity can still generate creator fees shows why a token operator does not necessarily need to remove the pool or sell a large allocation to profit.
Take-Two pursues Microsoft and Discord records
Take-Two filed Digital Millennium Copyright Act subpoena requests in the U.S. District Court for the Southern District of New York on Aug. 20.
One proceeding, filed as In re Take-Two Interactive Software, Inc., case number 1:26-mc-00421, sought information from Microsoft. The court docket identifies GitHub as the Microsoft service that allegedly hosted copyrighted GTA VI material.
Take-Two said the disputed material included proprietary software, audiovisual content, artwork, images and dialogue from GTA VI. The company requested information capable of identifying the alleged infringer or infringers.
Related requests directed at Microsoft and Discord sought account identifiers, registration information, IP addresses, phone numbers and some device data connected to accounts that may have distributed or discussed the leaked footage.
The orders directed the companies to produce the requested records by Sept. 4. Microsoft said it was working with Take-Two and Rockstar to protect their intellectual property.
Discord said it would evaluate the validity and scope of any subpoena before responding. The company also said on Aug. 25 that it had not yet been served at that time.
Obtaining identifying information does not establish that an account holder committed hacking, copyright infringement or another offense. The records could help Take-Two determine who operated an account, but further evidence would be needed to prove who acquired the footage.
Rockstar calls the GTA VI leaks “heartbreaking”
Rockstar publicly addressed the leaks on Aug. 26, describing the unauthorized release as “heartbreaking” for developers who had worked on the game.
The company said the footage was not how it intended the public to see GTA VI after years of development. Rockstar continued with its planned extended presentation on Aug. 27 rather than changing its marketing schedule.
CyberLeek had released clips showing driving, combat and interactions involving GTA VI character Jason. The material appeared to come from an unfinished version of the game, although Take-Two has not publicly explained how the files were obtained.
The leaks differed from Rockstar’s 2022 security breach, when development footage from an earlier GTA VI build appeared online. The person convicted in connection with that incident has not been publicly tied to the current CyberLeek operation.
Rockstar has not said the latest leaks changed GTA VI’s development schedule. Its official Newswire lists the extended presentation released after the unauthorized clips appeared.
CYBERLEEK fee model leaves traders exposed
Grogan’s findings show how attention around leaked material can be converted into trading revenue without a conventional token sale by the creator.
Memecoin prices can rise rapidly when an online event attracts traders. Liquidity providers benefit from higher transaction volume because each swap can produce fees, regardless of whether buyers ultimately make or lose money.
The model can also align the token operator’s revenue with continued controversy. More footage can produce more attention, while additional attention can increase trading volume and liquidity fees.
Locked liquidity does not eliminate that incentive. A pool may remain available for trading while its creator continues claiming accumulated fees. Research into how memecoins generate revenue through bonding curves and trading explains why direct token sales are not the only way insiders can profit.
Grogan did not publish evidence proving that all $350,000 had been converted into fiat currency. His analysis showed funds moving through providers and described the activity as a cash-out.
The next confirmed development could come after the Sept. 4 subpoena deadline. Records from Microsoft or Discord may help Take-Two identify people connected to the accounts, although such disclosures may remain confidential during the company’s investigation.
Until then, the blockchain evidence supports the finding that CYBERLEEK-linked wallets collected and moved substantial liquidity fees. It does not establish the legal identity of the controller or prove who obtained the GTA VI footage.
