The GTA 6 Hackers: The Kurtaj Breach and the Hunt for Cyberleek

Update, August 26, 2026: Rockstar is chasing a leaker again. Fourteen alleged gameplay clips surfaced between August 18 and 25 under the Cyberleek banner, and a community forensics trail now points at a Discord account. Jump to the new case.

In September 2022, Rockstar Games was deep into finishing what would become the most anticipated game in history. Internally, footage of a sun-soaked Leonida under construction was circulating on the studio’s Slack channels. Then, overnight, those same clips started appearing on GTAForums for anyone in the world to see. The culprit was not a sophisticated state actor or a well-funded cybercriminal syndicate. It was a 17-year-old from Oxford, England, sitting in a budget hotel room with an Amazon Fire TV Stick, a mobile phone, and a cheap wireless keyboard.

That teenager was Arion Kurtaj, a central figure in the hacker collective Lapsus$. What he pulled off that night became the single largest leak in gaming history, a watershed moment in cybersecurity, and the start of a legal saga that ended with him in a secure psychiatric hospital. For GTA fans, it was the first real look at GTA 6 in motion. For Rockstar, it was a nightmare that cost the studio roughly $5 million to recover from plus thousands of hours of staff time. This is the full story.

Arion Kurtaj did not fit any conventional criminal profile. Diagnosed with severe autism and ADHD, he was a teenager who spent most of his time gaming, coding, and cycling around Oxfordshire. But from an early age he was also pulling apart games to see how they worked, and that curiosity quickly pushed him toward darker territory online.

By his mid-teens he had moved from tinkering with Minecraft cheats to probing live websites for vulnerabilities. He drifted into underground forums where teenagers traded exploits, SIM-swap techniques, and stolen credentials. Around 2021, he linked up with another UK teenager online and the two began collaborating on increasingly bold attacks. They were eventually charged together, though the second individual remains unnamed in court records due to being a minor at the time of trial. Before Lapsus$ came into focus, Kurtaj was already involved in SIM-swapping scams and crypto theft, the kind of low-level financial crime that provided both income and a reputation inside underground hacking circles.

What made Lapsus$ unusual was the method. Most high-profile hacker groups rely on zero-day exploits, custom malware, or lengthy reconnaissance. Lapsus$ achieved its biggest wins through social engineering and phishing, techniques that exploit human psychology rather than software bugs. The group would impersonate IT staff, bombard employees with multi-factor authentication requests until someone accidentally approved one (a technique called MFA fatigue), or bribe insiders at telecoms to perform SIM swaps that bypassed account security entirely.

Between late 2021 and mid-2022 the group racked up an extraordinary target list. They hit BT and EE in the UK, attempted a $4 million ransom against BT/EE for stolen source code and user data, and then moved on to Brazil’s Ministry of Health, Nvidia, Samsung, Okta, Microsoft, Uber, Revolut, and finally Rockstar Games. The combined damage to all targeted firms approached $10 million. It was not nation-state-level technical wizardry. It was audacity, persistence, and a willingness to exploit the weakest link in any corporate security chain: the people inside it. Kurtaj and his unnamed co-conspirator were first arrested by City of London Police in January 2022, then re-arrested and charged in April 2022. Kurtaj was subsequently granted bail.

Here is where the story takes a turn that even seasoned cybersecurity professionals found remarkable. After being arrested and released on bail, Kurtaj was moved by police to a Travelodge hotel in Bicester, Oxfordshire, partly for his own protection after a rival faction had doxxed him online. Authorities confiscated his laptop. The internet access was meant to be restricted. None of that stopped him.

In September 2022, while still under police protection, Kurtaj plugged an Amazon Fire TV Stick into the hotel room television, connected his mobile phone, added a cheap keyboard and mouse, and used that setup to infiltrate Rockstar’s internal Slack workspace. He had breached Uber just three days earlier using a similar MFA fatigue approach. Now he turned his attention to Rockstar, accessing confidential development channels for GTA 6. He posted a message directly into Rockstar’s Slack.

If Rockstar does not contact me on Telegram within 24 hours I will start releasing the source code.

When no contact came, he posted 90 clips of unreleased GTA 6 development footage to GTAForums under the username TeaPotUberHacker. The clips showed early builds of Lucia Caminos and Jason Duval, the game’s two protagonists, moving through a recognizable Vice City-inspired Florida landscape. Rockstar confirmed the breach the same day. The internet went into overdrive.

Kurtaj was rearrested shortly afterward and detained. He never saw freedom again before his case went to court. Rockstar estimated the hack cost the studio around $5 million to remediate plus thousands of hours of developer time, derailing internal schedules and forcing a comprehensive security overhaul. The carefully planned reveal strategy for GTA 6 was in ruins. For the record, the game’s first official trailer did not arrive until December 2023, more than a year later, and it racked up 128 million YouTube views in four days, suggesting the damage to the game itself was ultimately limited. GTA 6 is now confirmed for November 19, 2026, on PS5 and Xbox Series X|S.

Kurtaj’s case reached Southwark Crown Court in London in the summer of 2023 alongside his unnamed teenage co-defendant. The proceedings were unusual from the start. Psychiatrists assessed Kurtaj and determined he was unfit to stand trial in the conventional sense because of the severity of his autism. Under UK law this meant the jury was not asked to decide guilt in the normal criminal sense. Instead, jurors were asked a narrower question: did he actually carry out the alleged acts?

After a six-week trial, the jury found unanimously in August 2023 that Kurtaj had committed 12 offences:

• Six counts of unauthorized computer access
• Three counts of blackmail
• Two counts of fraud
• Non-compliance with police requests to unlock his devices

His unnamed co-defendant was found to have committed three offences and was later sentenced to a youth rehabilitation order. Mental health reports presented during sentencing hearings described Kurtaj as violent in custody, having injured people and damaged property, and as expressing a clear desire to return to cybercrime at the first opportunity. One assessment noted he was "highly motivated" and intended to resume hacking as soon as he was able. His defense team argued the success of the GTA 6 trailer, which launched weeks before sentencing, showed that the gaming community’s excitement for the game was undimmed and that no lasting harm had been caused to Rockstar’s commercial prospects.

On December 21, 2023, at Guildford Crown Court, Her Honour Judge Lees handed down the sentence. Kurtaj received an indefinite hospital order under Sections 37 and 41 of the UK Mental Health Act 1983. He was sent to a secure psychiatric facility, with the order carrying no fixed release date. Under this provision, he will remain detained until medical professionals and the Ministry of Justice are satisfied he no longer poses a serious risk to the public. The judge was explicit: Kurtaj’s combination of technical skill and continued motivation to commit cybercrime made him a "high risk of serious harm to the public."

It is a remarkable outcome on multiple levels. Kurtaj never went to prison in the conventional sense, yet he faces a potentially longer period of detention than any fixed prison term he might have received. The judge acknowledged that real victims, including the individuals targeted in blackmail and fraud schemes beyond the Rockstar hack, suffered genuine harm. The defense’s argument that the GTA 6 trailer success minimized harm was rejected in relation to those other victims. As of mid-2026 there have been no reports of Kurtaj being released or of any change in his detention status. His case remains one of the most cited examples in UK cybersecurity law regarding the intersection of mental health and serious cybercrime.

For nearly four years the Kurtaj case stood alone as the definitive GTA 6 breach. Then, in August 2026, the pattern restarted. Between August 18 and August 25 an operation calling itself Cyberleek pushed fourteen alleged gameplay clips and purported full-map images onto the blockchain, timed to land in the run-up to Rockstar’s Extended Look premiere. Where Kurtaj was an impulsive teenager bragging on a forum, Cyberleek behaves like a campaign: scheduled drops, audience polls, watermarked taunts and a promoted memecoin that turns every release into trading volume. The methods could hardly differ more, yet the question underneath is identical: who inside or around Rockstar let a build escape?

The strongest lead so far did not come from law enforcement. GTAForums investigator Vice Cit, doing digital-forensic work on the case since the first drop, published an analysis on August 25 that exploits a property of the leaker’s own distribution channel: uploads to the Arweave blockchain carry immutable timestamps. Lined up against a preserved copy of a since-deleted Reddit thread, the sequence shows the first basketball clip reaching the dark-web forum Dread on August 17, then a Discord user called stayonthegrindd sharing identical footage in a GTA 6 fan server roughly eight hours later, before it was public anywhere else, claiming it was from 2026 and promising driving gameplay on request. The full map landed on-chain about an hour and a half after the account said it could share it, and the promised driving clip followed two hours after that. Vice Cit’s read is blunt: either the account belongs to whoever holds the material or to a friend of that person, and posting early in a busy fan server was, in their words, a huge opsec misstep. It is the same species of error that undid Kurtaj, who could not resist announcing himself.

The corporate response has been faster and broader than in 2022. Take-Two filed DMCA subpoenas in a New York federal court on Friday August 21 targeting user-account records at Microsoft, Discord, X Corp and GitHub, filings the BBC obtained and which explicitly reference stolen material. Microsoft says it is working closely with the publisher, while Discord, which by late August had not yet been served, says it will assess the validity and scope of the request first; the Discord order reportedly carries a September 4 response deadline. The dragnet has raised eyebrows for its width: per creator coverage, the paperwork sweeps in small YouTubers such as Shan Easy, a channel of about four thousand subscribers with no apparent connection beyond covering the story. Alongside the subpoenas runs a rolling takedown campaign that has reportedly reached even text-only descriptions of the footage. Rockstar itself has never publicly acknowledged the clips.

Around the real investigation swirls a circus familiar from every leak saga. A Reddit user, PilotX1970, posted a video of a lawyer supposedly sent by Rockstar arriving at their door, a month after predicting the August 18 leak date; sceptics counter that the whole scene may be staged to pump meme coins, and outlets covering it concede the truth is close to unverifiable. A rumour that the FBI had already arrested Cyberleek collapsed with no evidence behind it. At least three X accounts post under the Cyberleek name even though the operation claims to run none, and one shredded its own credibility by publishing AI-generated fakes. Cyberleek, as investigators keep stressing, is a brand rather than an identified person.

Follow the money and premeditation is hard to miss. Community tracing puts the promoted token’s funding through KuCoin, an exchange that enforces identity checks, and the infrastructure was in place days before the first clip dropped.

The leaker also claims a dead man’s switch: complete GTA 6 builds staged for automatic worldwide release unless cancelled daily. Nobody can verify the threat, and it reads as insurance theatre aimed at whoever is closing in.

Identity theories multiply in the vacuum. Investigator King Julien describes a known threat actor with a prior reputation, arguing the build may be a year old but was stolen this spring, possibly through a backdoor. A rival theory that the affair is a Rockstar marketing stunt is roundly rejected, not least because Take-Two’s market value briefly shed billions during the wave. What separates this hunt from 2022 is the trail: Kurtaj was caught after loud self-incrimination, while Cyberleek’s fate likely rests on subpoena returns and a single early Discord post. The clip-by-clip ledger sits in the leaks guide, and whatever happens next lands in the news hub first.

Cyberleek’s own claims always outran the evidence. He presented himself as holding a complete, fully playable development build rather than scattered clips, at one point marking the name leak on an in-game wall to show he was playing the build himself rather than reposting footage. He claimed to be playing the game from beginning to end, claimed to have completely finished the whole storyline, and rated it 9 out of 10. Every one of those statements is his claim alone. Nothing about the build’s completeness, his supposed playthrough or his review score has been verified by Rockstar, by journalists or by anyone else.

The community’s read on motive hardened once the Extended Look landed. Creators openly characterised the operation as a cryptocurrency grift, with one putting it bluntly during a watch stream: that guy was a grifter trying to make money off of his cryptocurrency, and that is pretty much out in the open now. The same pitch ran through his content claims, including screenshots asserting an in-game currency tradable for real money in the style of Robux, which nothing official has ever supported. One creator with game development experience separately argued the build most likely reached him through a developer connection during the beta phase rather than a server breach, though that too is speculation.

Then came the silence. In the days after the Extended Look premiered, creators reported that Cyberleek had been shut down, with one flatly telling viewers the leaker is no longer a part of anything any more. No statement from Rockstar, Take-Two or law enforcement has explained what happened, so the shutdown itself rests on community reporting rather than confirmed fact. What the official showing did make plain is the gap between his claims and his material: the footage he presented as the finished game was assessed by creators as a roughly 2024 development build, captured poorly, and side by side with the Extended Look it looked exactly like what they said it was, an old build sold hard.

The Lapsus$ story carries lessons that go well beyond any one company. Rockstar spent enormous resources on GTA 6’s development secrecy, and a teenager with a $30 Fire Stick still got in. The attack vector was not a flaw in Rockstar’s code. It was a Slack workspace, which is to say, it was people. Social engineering and phishing remain the most effective tools in a hacker’s toolkit because no firewall filters out a convincing impersonation. Every major company Lapsus$ hit, Uber, Nvidia, Microsoft, Samsung, Okta, all fell not because of technical exploits but because an employee somewhere trusted the wrong message or approved the wrong authentication prompt.

For GTA fans, the leaked clips offered a bittersweet first glimpse at Lucia and Jason in a game that still had years of development ahead of it. Rockstar tightened its internal security significantly after the breach, and the official December 2023 trailer arrived on Rockstar’s own terms, shattering YouTube records. With GTA 6 now confirmed for November 19, 2026 on PS5 and Xbox Series X|S, and two official trailers released, that chaotic September night in 2022 reads as a footnote to the game’s history rather than a defining wound. For a full picture of everything those leaked videos revealed and how community knowledge has evolved since, check out our GTA 6 Leaks guide and the Development guide, which covers how Rockstar rebuilt its security posture and kept production on track through the fallout.

The case also set a significant legal precedent. It showed that severe neurodiverse conditions can result in an individual being found to have committed serious criminal acts without a conventional guilty verdict, and that the UK courts are willing to impose effectively open-ended detention when they judge the risk to be real and ongoing. Kurtaj remains, as of 2026, in a secure hospital. The game he tried to hold for ransom is about to launch as the biggest entertainment release in history.