The anonymous leaker Cyberleek ties stolen scenes from the video game GTA 6 to his own Solana token's market value. However, anyone buying the Cyberleek memecoin acquires no financial claim, only the prospect of further copyrighted material.
Grand Theft Auto is a video game series from Rockstar Games. Since 1997 it has sold around 475 million copies. Behind Rockstar stands Take-Two Interactive, a group listed on the NASDAQ. After two delays, the next installment arrives on November 19, 2026. For Take-Two, it is the most important product of the year.
Accordingly, the stock reacted sensitively to the first leak videos. It fell temporarily by around 6 percent. The financial press puts that at roughly USD 2.83 billion in market capitalization and attributes it to the releases. Subsequently, the price recovered part of that by August 21. Take-Two itself has not quantified the incident so far. A memecoin, in turn, is a speculative token with no business model and no cash flows. Its price therefore comes almost entirely from trading in onchain pools. Cyberleek repurposes this instrument. Rather, market value here is no price barometer but a switch over the release of stolen material.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
Market capitalization as the unlock condition for leak videos
The associated domain was created on August 14. The mint of the $CYBERLEEK token followed a day later. Its Fully Diluted Valuation initially stood at around USD 55,000. From August 18, the first leak clips appeared. As a condition for further videos, Cyberleek names neither a sum of money nor a date. Instead, the leaker calls out a market capitalization that his own token must reach before the next video. The strip club gameplay appeared exactly when the market capitalization crossed the previously announced threshold of USD 3 million. Moreover, every video published since carries a watermark with a QR code that leads directly to buying the token.
Market capitalization now stands at USD 19.12 million, more than six times that threshold. On August 18, trading volume reached USD 5.47 million in a single hour. Most recently, USD 40.58 million in volume came together over 24 hours. The price rose 3.01 percent to USD 0.026174. That volume thus amounts to more than twice the market capitalization, a sign of short-term churn. Overall, around 730 million of a maximum of 1 billion tokens circulate at present. Previously, between August 20 and August 23, the price had climbed from USD 0.000603 to USD 0.034361. That corresponds to roughly 57 times, measured from the all-time low to the all-time high. All figures are a snapshot from August 24, 12:35 UTC.
Who stands behind Cyberleek remains unresolved. Whether an individual, a group or former Rockstar employees: none of the attributions in circulation is proven. Several alleged profiles likewise turned out to be fakes. Those behind the leaks still style themselves as hacktivists. With the slogan "No Disc, No Peace" they protest against purely digital pre-orders.
Cyberleek memecoin buyers acquire no financial claim
Structurally, $CYBERLEEK is no investment product. Buyers receive no claim to cash flows and no stake in a company or project. A legally enforceable voting right does not arise either. The only consideration Cyberleek holds out is the unlocking of further copyrighted recordings. The return on this token is therefore a video.
For now, the case allows only a general regulatory classification. FINMA distinguishes between payment tokens, utility tokens and asset tokens, and only the latter count as securities. MiCA, the EU regulation, by contrast exempts utility tokens from the core obligations. That exemption applies provided they grant access to an existing good. A case-specific assessment of $CYBERLEEK by a supervisory authority is still outstanding.
The benefit on offer is moreover no existing good but stolen material. At the same time, Take-Two pursues its distribution with ongoing takedown requests. Buyers ultimately finance a service that the rights holder actively tries to stop. A utility token grants access to a legal service. Yet here the value hangs on the continuation of a legal violation.
Onchain data show concentrated gains at early wallets
An onchain analysis by the analytics firm Bitquery covers the first seven days up to August 21. Over that span the company counted 163,014 trades from 16,182 wallets. Volume in the main pool reached USD 22.7 million. Particularly striking is the distribution of the gains. The five most profitable wallets all bought in for the first time on August 18. Their entries fell within the same six-minute window, between 17:48 and 17:54 UTC. On selling they later realized around USD 158,000. None of these addresses links to the deployer of the token, however. One of them had already received 1,000 SOL from an exchange on August 4. That was two weeks before the first leak video.
Whether Cyberleek earns from the trading itself is open. Pump.fun is the largest Solana platform for memecoin launches. It overhauled its creator fee system in January 2026. Creators can since spread their share of the trading fees across up to ten wallets. Consequently, a structure exists through which a leaker could earn from trading volume alone, regardless of what buyers receive. No verifiable source shows, though, that it applies in this case. Evidence of such an inflow to Cyberleek is still lacking.
The sources also contradict each other on the contract address. Bitquery lists the token under an address with the prefix ApZuxdpz. Trading accordingly runs through a Raydium pool without a launchpad. An OpenSea listing instead names a different address ending in "pump", which points to a launch via Pump.fun. Which of the two carries the relevant trading pair is unresolved. Details on a burned liquidity pool likewise come only from scanner and marketing sites. The same holds for revoked mint and freeze rights. An independent review is still missing, so these features form no basis for a risk assessment.
Take-Two pursues the leaker's identity in court
The rights holder answers through the courts. Take-Two Interactive has the videos removed continuously via DMCA notices. The group also applied for subpoenas under DMCA §512(h). Such orders ultimately aim at the release of user data by the platforms. The applications went to the U.S. District Court for the Southern District of New York. They first targeted Microsoft and Discord, and the following day X and YouTube. Judges Andrew L. Carter Jr. and Jennifer L. Rochon signed the orders. Formal service is still pending. So far, no platform has disclosed user data.
"[The purpose is] to identify an alleged infringer or infringers, and this information will be used only to protect the rights of Take-Two." - Take-Two lawyers in the filing with the U.S. District Court for the Southern District of New York
Rockstar Games itself has not commented on the leaks. As a result, the DMCA measures of the parent company remain the only response. A precedent from 2022 shows how seriously earlier cases ended. Arion Kurtaj, a member of the hacker group Lapsus$, was under police protection in a hotel at the time. Nevertheless, he uploaded around 90 GTA 6 videos to a forum.
A British jury found in August 2023 that he had committed hacking, fraud and blackmail. A conviction did not follow, because expert witnesses deemed him unfit to stand trial. In December 2023 the court consequently ordered indefinite detention in a secure hospital. According to BBC correspondent Joe Tidy, he now sits in a regular prison. A retrial follows in November 2026.
