A dedicated Grand Theft Auto fan has employed digital forensics to investigate the recent Grand Theft Auto 6 leaks, uncovering a cryptocurrency scheme they allege is behind the widespread release of game assets. The leaks, which include five gameplay videos and a full map image posted by an entity known as 'CyberLeek,' have consistently advertised a memecoin of the same name and directed users to a cryptocurrency platform.
Vice Cit, a user on GTAForums, published the findings of their investigation, which focused on the financial aspects of the leaks. The analysis of the $CYBERLEEK token reportedly leads to KuCoin, a cryptocurrency exchange based in the Seychelles. Vice Cit believes that law enforcement could obtain user identity information from KuCoin through a subpoena, potentially identifying the individual responsible for the leaks and the associated cryptocurrency operation. "I had to do a section on digital forensics for my degree so let's put it to use," Vice Cit stated.
According to Vice Cit's research, a central wallet was used to fund the creation of the cryptocurrency, the website hosting the leaks, and the Solana public key associated with the Arweave uploads. This funding originated from a cryptocurrency exchange that requires Know Your Customer (KYC) verification, meaning the individual would have had to submit identification documents. Vice Cit posits that the leaker is strategically releasing game footage in stages to sustain interest in the memecoin, a tactic also evident in a poll that required users to send the memecoin to vote. The investigation suggests the leaker invested approximately $29,000 in setting up the cryptocurrency and website, recouping this investment on the first day of the leaks.
The ongoing trading volume for the coin is reportedly generating substantial profits through trading fees, with Vice Cit estimating daily profits between $4,400 and potentially higher, based on a daily trading volume of $2.1 million. This sustained profit model, they argue, explains why the leaks are being drip-fed rather than released all at once, as was seen in a previous major leak in 2022.
The main website associated with these alleged GTA 6 assets also contained a manifesto criticizing the trend towards all-digital game releases and highlighting issues such as the lack of physical discs for GTA 6 and the unplayability of Ubisoft's The Crew after its servers were shut down. The manifesto issued a warning to publishers, stating, "If CyberLeek can reach Rockstar, no one is safe. This is a message to all big corpo: behave, or be the next target."
However, skepticism surrounds the leaker's motivations, with many suggesting the operation is primarily a cryptocurrency scam. Vice Cit expressed the belief that the financial gain was the primary driver from the outset, with the commentary on gamers' rights serving as a means to garner public support. "The person behind this leak is making a substantial amount of money and I think after reading this post you'll see that we may be in for a longer ride than we initially realize," Vice Cit stated.
As of August 21, no new leaks have surfaced despite online threats. Rockstar Games and parent company Take-Two Interactive have not yet issued a statement. The alleged leaks surface approximately one week before the scheduled release of "Grand Theft Auto 6: An Extended Look," a timed exclusive for Netflix set to debut on August 27, with a six-hour window before becoming available on other platforms like YouTube.