The Hunt for Cyberleek: Blockchain Timestamps Point at a Discord Account

For a week the question under every leaked clip has been the same: who is actually doing this? On August 25 the community produced its strongest answer yet. GTAForums user Vice Cit, already known for digital-forensic work on the case, published a report built on a preserved copy of a since-deleted Reddit thread, per Kotaku, and the chain of events it reconstructs is uncomfortably tidy.

Cyberleek uploaded the first basketball clip to the dark-web forum Dread on August 17. Roughly eight hours later, a Discord user named stayonthegrindd joined a GTA 6 server, posted the same footage before deleting it, claimed it was “from 2026”, and asked what people wanted to see next. When someone requested driving, the account answered: “I will be back with driving gameplay.” The full Leonida map hit the blockchain about an hour and a half after stayonthegrindd said they could share it, and the first driving video followed two hours later, per Kotaku. Because every Cyberleek release is timestamped on-chain, the ordering is not a matter of memory or screenshots. It is arithmetic.

Vice Cit’s conclusion is carefully worded: “Either this person had this material and was trying to get this whole thing to blow up by posting it in a place they knew would spread the leaks like wildfire, or this person is a friend of the person who has this leaked material and was able to see the leaks before they ever got uploaded onto Arweave,” adding, “I do believe stayonthegrindd is CyberLeek (or at least a member of the group), and I think this was a huge opsec misstep,” per Kotaku.

That is a lead, not an identity. A Discord handle is not a name, and the account could belong to an insider’s friend rather than the leaker themselves. But it matters for one practical reason: Discord is on Take-Two’s subpoena list. If the publisher’s lawyers reach the same account the forum sleuths did, Discord’s records could turn a username into registration details, IP logs and payment traces. The community may have just drawn the map for them.

The legal track is moving on its own schedule. Take-Two filed subpoenas in a New York federal court on Friday August 21 seeking user-account records from Microsoft, Discord, X Corp and GitHub, per filings obtained by the BBC. The paperwork explicitly references stolen material, which several outlets treat as the closest thing yet to official confirmation that the footage is genuine, per Mashable. Rockstar itself has still not publicly acknowledged the clips or attributed them to anyone.

The recipients are not moving in lockstep. Microsoft says it is working closely with Take-Two and Rockstar, while Discord had not yet been served as of the latest reports and says it will evaluate the validity and scope of the request before responding, per Kotaku, with responses due in early September. Alongside the subpoenas, Rockstar keeps up a rolling DMCA campaign that has reportedly reached even text-only posts describing the material, per Dexerto. Cyberleek’s main Telegram channel is gone, the website’s last mirror returned an error, and per Notebookcheck the releases simply rerouted through new channels anyway.

Around the real investigation, the circus. Reddit user PilotX1970 shared video of a lawyer allegedly arriving at their door on Rockstar’s behalf, a month after posting “August 18th, don’t ask me how I know. If you don’t believe me, come back on that date and we will see.” Others allege the whole doorstep scene was staged to pump meme coins, and per GAMINGbible the truth is nigh impossible to verify. A rumour that the FBI had arrested Cyberleek spread widely and remains unsubstantiated.

The impersonation layer is just as messy. Cyberleek claims to run no real accounts on X, yet at least three profiles post under the name, one of which shared AI-generated images before deleting them, per Dexerto. A fake 113GB GTA 6 download circulating alongside the leaks is malware, per Notebookcheck. Every one of these dead ends makes the timestamp work above stand out more: it is the only thread so far that runs on verifiable data rather than claims.

Follow the wallet and the operation looks less like activism and more like a business. Vice Cit traced the promoted memecoin’s funding to KuCoin, an exchange that enforces identity checks, and estimates the operation clears roughly $4,400 a day in trading fees, somewhere between $40,000 and $60,000 in total, per Gameranx. Reddit users note the Cyberleek domains were registered around August 14 and the token, liquidity pool and voting programme stood up around August 15, days before the first clip, per GameSpot. Reported side income includes advertising deals worth around $165,000 and a 400 Monero fee quoted for a meeting.

The leaker’s latest flourish is a claimed dead man’s switch: multiple GTA 6 builds allegedly staged for automatic worldwide release unless manually cancelled every day, per GAMINGbible. There is no evidence the mechanism exists, and it reads like insurance theatre aimed at whoever is closing in. Between the KYC exchange, the premeditated infrastructure and the Discord slip, the anonymity this whole performance depends on is thinner than it was a week ago.

The clips have not stopped. The count stands at fourteen after the August 25 triple drop, and a paid poll on releasing a Lucia-led prologue reportedly ran to 99.7 percent in favour, closing around August 26 with nothing released so far. Every hour that passes without it is worth watching: story spoilers would mark a sharp escalation from environment tours, and our leak tracker logs each release as it lands.

The other clock is Rockstar’s. The Extended Look premieres on Netflix on August 27, unmoved by any of this, and it will say more about GTA 6 than fourteen leaked clips combined. And if the saga feels familiar, our 2022 hacker dossier covers the last time Rockstar hunted a leaker, when Arion Kurtaj breached the studio from a Travelodge with a Fire TV Stick.