Seven videos, a complete map and two billion gone up in smoke: where the CyberLeek affair stands
The biggest leak in Rockstar history is underway. 💥 Since August 18, an unknown individual has been drip-feeding GTA 6 gameplay taken from a development build. And unlike 2022, this time the person isn't sharing stolen videos: they're playing.
🕐 Five days, seven videos
The whole affair spans a single week. The pacing matters as much as the content: each clip was calibrated to reignite attention at the exact moment it was fading.
Tuesday, August 18, 7:30 PM — A first gameplay video appears. Doubts arise immediately, as AI has flooded the web with fake GTA 6 footage in recent months. But the art direction, the engine's rendering and details already seen in official material quickly point to the real thing. A complete map of Leonida follows right after.
Wednesday, August 19 — Second and third clips: a distribution center, taser-wielding security guards, a stolen semi-truck. The videos start disappearing from social media after copyright takedown requests.
Thursday, August 20 — The proof. In a clip filmed from a plane flying over Vice City, the player shoots at a wall to spell out the word “LEEK” in bullet holes. This is no longer someone reposting videos: it's someone with a controller in their hands.
Friday, August 21 — After 24 hours of silence, rumors of an arrest start to swell. They're false. A third-party group, 808 mafia, claims to have an Xbox build and offers a trade: in reality, it only has console graphics captures, with no playable build whatsoever. Right after, CyberLeek resurfaces with “HYPERCAR.”
Saturday, August 22 — Seventh clip: gas station robberies, a fuel system, a slow-motion crash, and a strip club entrance cut off abruptly. The same day, Take-Two gets the green light from a federal court for its subpoenas.
✅ Is it real?
Yes, for the most part. And the best clue isn't in the footage: it's the legal response. Nobody spends money on federal proceedings and mass takedowns over AI-generated content. Bloomberg has also confirmed the footage is authentic through internal sources.
⚠️ Fact vs. fiction at a glance — Established: the videos are authentic, the leaker has a playable build, Take-Two has taken legal action. False: the FBI arrest, the second Xbox build, the 113 GB .iso file. Unknown: the exact date of the build and the leaker's identity.
The second clue is the bullet-riddled wall scene: impossible to fake without access to a runnable version of the game. That doesn't prove the person has the full game, though — only a working build.
🎮 What the leaks actually show
A lot of noise for, so far, relatively few revelations. All seven clips stay in sandbox territory: driving, vehicle theft, robberies, getting around. Nothing from the story, nothing of Lucia.
The systems spotted on screen, however, are concrete:
- Stamina — a bar appears in the top left during melee fights and drains with exertion.
- Expanded vehicle theft — in front of a locked car, two options appear: smash the window or clone the key. Dragging a driver out by force uses up stamina.
- Fuel and repairs — at the pump, the game shows the cost of a full tank and the cost of repairs, priced separately.
- Honor system — spotted on screen, although how it works can't be seen.
- Police response — a notice that a crime has been reported appears almost instantly after a car theft out in the street.
As for the map, it shows several counties, a dense rail network, swamps, hilly terrain and islands. If it's accurate, the jump in scale from previous installments is considerable. Nothing officially confirms this.
🕵️ Who is CyberLeek?
Nobody knows. What's circulating rests on weak clues, and it's better to say so clearly than to present them as facts: posting times that suggest a European time zone, infrastructure hosted in Germany behind a protection service, and amateur research that claims to have linked the pseudonym to an earlier identity.
None of these elements has been independently verified. The hosting in particular points to a technical choice, not a location: anyone can rent this type of server from abroad.
🔒 Our position — We are deliberately not publishing any identifying details. This kind of amateur connecting-the-dots regularly lands on the wrong person, and naming someone who has been neither formally identified nor convicted opens the door to legal action.
💰 Activist or salesman?
The stated message is activist. Three demands: an end to digital pre-orders, a stop to the sale of DLC that's already in the base game's files, and a mandatory offline mode for single-player campaigns once servers shut down. The third overlaps with well-known campaigns — whose leaders have, incidentally, distanced themselves from the move.
The rest tells a different story. A cryptocurrency is promoted in every video. Paid polls decide which clip gets released next. A watermark makes the release of new footage conditional on reaching a market cap threshold. And ad space is now being sold within the leaks themselves, at a rate of $165,000 for a mere first meeting.
In other words: the teasing isn't a stylistic flourish, it's a lever to move the price. The clip that stops at the strip club entrance isn't an unfortunate cut, it's a call to buy.
⚖️ What Take-Two has actually set in motion
This is the point most sites get wrong. To date, there is no public criminal investigation, no confirmed FBI involvement, no arrest.
📄 The ongoing proceedings — On August 20, Take-Two filed civil subpoenas in the Southern District of New York targeting Microsoft and Discord: account details, IP addresses, associated devices, sign-up emails and member accounts of the servers in question since June 1st. Response deadline: September 4.
A subpoena of this kind is a court order to produce documents, and refusing to comply carries a penalty. But it only leads to an identity, not an arrest: that would then require criminal action, followed by international judicial cooperation if the person lives outside the United States. Think months, not days.
So the signal to watch for isn't a 24-hour silence on social media, which means nothing. It's the filing of a criminal complaint or an official statement from the authorities. Until either of those exists, any arrest announcement is a rumor.
📼 2022, and why it's not comparable
The September 2022 leak had exposed 90 development videos. Its author, a British teenager linked to the Lapsus$ group, was tried in late 2023: found unfit to stand trial, he was placed in a secure hospital indefinitely, with experts believing he still expressed an intent to reoffend. He has since been held in regular custody awaiting a new trial, scheduled for November — the month GTA 6 comes out. Rockstar had put the cost of the incident at $5 million.
The difference comes down to one word: access. In 2022, someone had stolen recordings, a finite stockpile. In 2026, someone has a tap. As long as the build works, they can produce new content at will — including in places Rockstar absolutely doesn't want anyone to go.
One point deserves emphasis, because it applies far beyond video games: in both cases, the way in had nothing technical about it. Lapsus$ gained access by posing as employees to IT help desks, buying credentials from staff, or flooding people with authentication prompts until someone gave in. The second group that surfaced this week, for its part, claims a successful phishing attack on an employee. Firewalls can do nothing about that. The weak link is still human.
🚨 Beware of fake files
A .iso file of about 114 GB has been circulating on file-sharing sites since Saturday, billed as the complete build. Several clues show it isn't what it claims to be.
- The version number doesn't match the one announced by the leaker themselves. Two different naming schemes, two different origins.
- The file name promises Lucia, even though none of the seven clips shows her. That's the bait.
- The term “repack” refers to a recompressed retail version. It makes no sense for a stolen development build.
- The number of sources is negligible. For the most anticipated file of the year, there would be thousands of shares within minutes.
🛡️ The real risk — It's not wasting your time, it's losing your machine. A huge file nobody checks, distributed at the peak of a viral news story, that often asks you to disable your antivirus to “work”: that's the classic vector for credential-stealing malware and ransomware. Gaming accounts, open sessions, wallets — nothing is spared.
📺 August 27, and beyond
Rockstar is airing the world premiere of Grand Theft Auto: An Extended Look on Netflix on Thursday, August 27 at 9 PM. The format promises commentated gameplay, not a cinematic trailer. The studio has changed neither its marketing schedule nor its release date, still set for November 19, 2026 on PS5 and Xbox Series X|S.
Paradoxically, the leak does it an unintended favor: it provides a point of comparison. If the leaked build is a year or two old, the gap with the official presentation will be obvious, and the argument that GTA 6 is merely an update of its predecessor will collapse on its own.
Two unknowns remain. Rockstar may adjust its content to avoid what has already leaked. And the leaker has hinted that they could release their own long-form footage before the event. They've already shown this week that they know how to pick their moment.
📌 Methodology note — This article does not rebroadcast any footage from the leak and does not link to any mirror. Unverified information is flagged as such. The story is evolving daily: this page is kept up to date.