Cyberleek dumped GTA 6 footage nine days early, with a memecoin attached and no provenance

Clips, map images and a cutscene apparently from Grand Theft Auto VI spread online on August 18 and 19, 2026, watermarked by a person or group calling itself CyberLeek ^[1][2]. That is nine days before Rockstar's Extended Look premiered on Netflix on August 27 ^[3][8], and the material shipped with a pitch for a Solana memecoin ^[4], which is the part operators should look at rather than the footage.

The campaign frames itself as a protest. Its website publishes a document it calls the CYBERLEEK Edict, which insists "Let it be absolutely clear: this is not a cash grab" ^[5], and sets out three rules: no digital preorders before release and independent reviews, no resale of single-player content already sitting in base-game files, and an offline fallback when servers shut down ^[15]. The Verge reports that one still-live clip carries a call to buy a CyberLeek cryptocurrency, a QR code, links to CyberLeek URLs, and the line "NO PHYSICAL DISCS? THEN MORE LEEKS!" ^[6]. The Edict also states that targeted publishers must issue a public statement, apologize and make restitution, or the leaks continue ^[16].

Test the grievances against the record and they separate. GTA 6 preorders opened on June 25, and the so-called physical version contains a download code rather than a disc ^[7], so rule one describes something real. Rule two is narrower than a general objection to paid DLC: it targets content already present in base files and unlocked by a key or flag, and there is no public evidence that GTA 6's Ultimate Edition extras meet that definition ^[17]. Rule three cites The Crew, which Ubisoft made inaccessible on every platform, including solo play, when it shut servers on March 31, 2024 ^[18], not any known GTA 6 problem.

Provenance is the hole. According to Dexerto, no public identity, no method of acquisition and no link to Rockstar's confirmed 2022 network intrusion has been established, and Rockstar has not attributed the new material to Cyberleek ^[9]. The brand exists as a website on an ar.io gateway plus at least two X profiles, MrCyberLeek and cyberleek_ar_io, the second of which now calls itself "MrCyberLeek V2" ^[19]. VideoTech has warned that both accounts appear to be fake rather than the original leaker, citing an investigation by GameRoll ^[20]. Dating is also contested: NateTheHate said the footage was more than a year old and GTAForums users found metadata pointing to 2023, though an older encoder can produce old-looking metadata ^[22].

The only signal from the rights holder is enforcement, not confirmation. VideoTech said Rockstar was issuing DMCA reports against posts carrying the material ^[10]; The Verge saw three clips and found two had been pulled under a copyright claim ^[11]. Rockstar and Take-Two did not immediately reply to The Verge's request for comment ^[12]. None of that proves who obtained the files.

Keep the 2022 case separate. Rockstar confirmed a network intrusion then, 90 videos leaked, and a teen who played a key role was sentenced to life in a secure hospital ^[13][14]. Nothing public connects Cyberleek to that breach ^[9].

What to watch: whether Rockstar or Take-Two says anything attributable before the $79.99 game ships on November 19 ^[8], whether the GameRoll and VideoTech account analysis hardens into a named source, and whether the token outlives the manifesto. A protest that requires a wallet is a business model until proven otherwise.