The unidentified person or group behind a series of purported Grand Theft Auto VI leaks has begun offering paid advertising and custom-made gameplay footage, escalating an incident that has already resulted in apparent footage and map material from Rockstar Games’ highly anticipated title spreading online.
Operating under the name CyberLeek, the source has released a succession of videos since 18 August which purport to show gameplay from an unfinished GTA 6 build.
BPI News has seen footage being circulated in connection with the leak but is not publishing, embedding or redistributing the leaked material.
The provenance of the footage has not been independently established, and Rockstar has not publicly authenticated each of the clips attributed to CyberLeek. Take-Two Interactive, Rockstar’s parent company, has, however, pursued copyright removals of material circulating online.
The first footage appeared on 18 August and purported to show Jason, one of GTA 6’s two principal characters, playing basketball.
Further material subsequently emerged apparently showing driving, fighting, police encounters, the use of a taser, swimming, an in-game cutscene and other elements of the open world. CyberLeek has also published images it claims depict GTA 6’s map.
A later video showed Jason flying a propeller aircraft across a large section of the game world before apparently being controlled to fire bullets into a wall spelling “LEEK”.
That sequence is potentially important in establishing the nature of the breach.
A collection of stolen pre-recorded development videos would allow a leaker to release only what had previously been captured. If the “LEEK” sequence is genuine and has not been manipulated, deliberately producing that message inside the game would instead indicate that whoever recorded it was able to control a playable build.
That does not establish that CyberLeek currently possesses the game, nor does it reveal where or when the footage was recorded. A person could potentially have had temporary access to a development system and recorded material for later publication.
There is consequently still no publicly established evidence showing that a complete GTA 6 build has been removed from Rockstar’s systems or is presently in the leaker’s possession.
Questions Over Age Of GTA 6 Build
The age of the apparent development build has also generated considerable discussion.
Some initial assessments suggested the material could have originated considerably earlier in GTA 6’s development.
However, one of the clips reportedly features “Sports Car” by Tate McRae, a song released in January 2025. Provided the audio is genuinely part of the game footage and has not subsequently been added or manipulated, its presence would place that material no earlier than 2025.
An unfinished development build would not necessarily represent the appearance, performance or content of the final game. Features can be introduced, altered or removed throughout development.
Among the apparent features visible across the material are aircraft, cars and motorcycles, swimming and diving, police and wanted systems, NPC interactions and basketball.
Observers examining the clips have also pointed to vehicle damage, weapon-storage options and dynamic cloud systems.
However, substantial areas of the game remain unseen in the publicly circulating material. There has been no demonstrated access to significant portions of the story, extensive mission progression, gameplay involving Lucia, vehicle customisation or several other systems expected in the finished title.
Claims that CyberLeek possesses a complete current version of GTA 6 therefore remain unproven.
CyberLeek Begins Selling Access
The operation has now moved beyond simply releasing alleged gameplay.
A contact page added to CyberLeek’s website advertises what it describes as “Secure Contact & Advertising”.
The page states that CyberLeek is raising funds through “community support and strategic partnerships” and claims it is not demanding payment from publishers in return for withholding leaks.
Instead, it offers advertising space on its material and opportunities to request custom-made gameplay footage tailored to particular brands.
The page says a prospective advertiser must make a payment of 400 XMR in the cryptocurrency Monero before gaining access to negotiations through the Session messaging service.
The payment is described as a contact fee guaranteeing a response and is separate from the eventual price of any advertising or requested footage.
At valuations cited around the latest developments, 400 XMR would amount to approximately $160,000, although cryptocurrency values fluctuate.
The offer of custom gameplay could potentially provide further evidence about the extent of CyberLeek’s access. If the operator fulfils highly specific new requests that could not reasonably have been anticipated when earlier recordings were made, that would strengthen the possibility that someone involved retains access to a playable build.
Until such evidence emerges, however, the precise nature and duration of that access remain unknown.
Cryptocurrency Promoted Alongside Leaks
CyberLeek has also created and promoted a Solana-based cryptocurrency, $CYBERLEEK.
The token has featured alongside the leaked material and has been used to operate paid votes over which clip should be released.
One poll allowed participants to choose between several gameplay scenarios. Rather than one person receiving one vote, participants sent tokens towards their preferred option, meaning the outcome was effectively weighted according to the amount of cryptocurrency committed.
The option featuring daytime aircraft gameplay won one such poll and was subsequently released.
The cryptocurrency has experienced significant price volatility, and publicly available blockchain figures cited by those monitoring the project have indicated concentrated ownership among a relatively small number of wallets.
Claims circulating online about individual investors losing substantial sums cannot be independently verified from the supplied information and should not be treated as established fact.
CyberLeek itself has described the cryptocurrency as a means of donating to the operation rather than an investment.
From Consumer Campaign To Commercial Operation
CyberLeek has attempted to frame the leaks as a campaign against practices it considers harmful to video-game consumers.
Its published manifesto objects to digital pre-orders, publishers charging separately to unlock certain single-player material and games becoming permanently inaccessible when their supporting servers are closed.
The group has also criticised the lack of a conventional physical-disc edition of GTA 6 and threatened additional leaks if its demands are not met.
Some of those issues overlap with established debates within the gaming community over ownership and preservation of digitally distributed games.
However, the methods employed by CyberLeek are separate from those wider campaigns. Stop Killing Games, a consumer initiative campaigning for purchased games to remain playable, has rejected CyberLeek’s tactics and urged people not to financially support the operation.
CyberLeek’s subsequent introduction of paid voting, cryptocurrency promotion, advertising and six-figure access fees also represents a significant commercial element alongside its stated consumer-rights objectives.
Take-Two Attempts To Identify CyberLeek
The identity of whoever is responsible remains unknown.
CyberLeek routinely uses the term “we”, although that alone does not establish that multiple people are involved.
According to reporting by Bloomberg’s Jason Schreier, Rockstar had not identified the source of the leaks or established how the footage escaped.
Take-Two is also reported to be pursuing information from third parties as it attempts to identify those responsible.
Reports indicate legal requests have targeted companies including Microsoft and Discord, potentially allowing investigators to obtain account or other records relevant to the investigation where legally available.
Claims circulating online about the identities of suspected individuals remain unverified, and BPI News is not publishing speculative identification of people who have not been publicly established as responsible.
CyberLeek has also warned about impersonators, saying its website and designated Telegram presence are its official channels and that accounts appearing elsewhere should not automatically be assumed to belong to the operation.
Rockstar Faces Another Major GTA Leak
The incident comes four years after Rockstar suffered one of the gaming industry’s most significant security breaches.
In September 2022, dozens of early GTA 6 development videos appeared online after Rockstar’s systems were compromised.
British teenager Arion Kurtaj, a member of the Lapsus$ cybercrime group, was later found responsible for hacking Rockstar and other companies. A UK judge subsequently ordered his indefinite detention in a secure hospital.
The latest incident is not known to be connected to the 2022 breach.
It also differs in an important respect. Rather than releasing a large archive simultaneously, CyberLeek has been releasing material incrementally while building an online operation around the leaks.
The unanswered question is whether those responsible have obtained an actual playable build or instead accumulated recordings produced during temporary access.
The apparent ability to produce deliberately personalised gameplay would make the former possibility increasingly significant, because access to a playable build could potentially allow someone to seek out unreleased missions, dialogue, cutscenes and major story developments.
No evidence supplied so far establishes that CyberLeek has access to GTA 6’s complete storyline or its ending.
The timing nevertheless creates a significant problem for Rockstar and Take-Two. An official extended look at GTA 6 is scheduled for 27 August, while the game itself is currently scheduled for release on 19 November.