Last updated: August 2026
GTA 6 leak footage from a playable 2025 build has been rolling out daily since August 18, posted by a hacker persona called CyberLeek, and it is the biggest breach Rockstar has faced since 2022. We tracked every drop, the demands behind them, and what the mess means for the November 19 launch.
Key Takeaways
- CyberLeek has published at least six gameplay videos and a full Leonida map image since August 18, 2026.
- The footage comes from a playable development build dated to 2025, not from stolen clips, which raises real story-spoiler risk.
- Every video is watermarked with a $CYBERLEEK memecoin, and token-holder polls decide what leaks next.
- Rockstar’s only response so far is a DMCA takedown campaign and an internal email reported by Bloomberg on August 21.
- Take-Two has kept the November 19, 2026 release date, and the official Netflix “Extended Look” still airs August 27.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
A Playable Build Is Out in the Wild
The first drop: basketball, a beatdown, and the full map
The leaks started on August 18, 2026, when an account calling itself CyberLeek posted two short gameplay clips and an image of the complete Leonida map. The first clip showed protagonist Jason Duval shooting hoops on a Vice City court. The second showed him driving through traffic before attacking an NPC on the sidewalk.
Within hours the map image was everywhere. Fans have spent three years reconstructing Leonida from trailer frames and satellite-style teasers, and the leak handed them the whole thing in one file. Rockstar’s takedown notices reached the original posts fast. Mirrors reached a hundred more.
We compared the leaked map against the community-built mapping project and the differences are small but real. Several keys, islands, and interior markers in the leaked version have never appeared in official material. That was the first sign this was not recycled 2022 footage.
Four days of scheduled drops
August 19 brought a third and fourth video: taser combat and two story cutscenes with full dialogue. The cutscene leak came with a caption that read “No physical discs? Then more leeks!” August 20 added a fifth video, this one chosen by a public poll, showing airplane gameplay in which Jason spells the word “LEEK” onto a wall with bullet holes.
By August 21 a sixth video of supercar driving was circulating, and Forbes reported that the fresh upload ended a day of rumors claiming the leaker had been caught. The cadence has been deliberate. One or two clips per day, each announced in advance, each tied to an audience-participation gimmick.
That drip-feed structure matters. The 2022 breach was a single 90-clip dump that Rockstar could fight in one wave of takedowns. This one is engineered to stay in the news cycle for weeks, with each drop timed to revive the story just as the previous wave of DMCA notices lands.
Why a live build is worse than stolen clips
The bullet-spelling stunt is the detail that alarmed developers we follow. Writing a word on a wall with gunfire requires someone sitting at a controller inside a working build, and Tom’s Hardware described the breach as a full working build in the leaker’s hands. Build metadata visible in the clips points to a 2025 development snapshot.
A playable build means CyberLeek is not limited to whatever was copied off a server. Any mission, any cutscene, any map corner can be captured on demand. One of the leaker’s own polls asked followers to vote on revealing a “Lucia-led prologue,” which suggests access to story content Rockstar has never even hinted at.
The footage is clearly unfinished. Placeholder textures, debug overlays, and missing reflections show up across all six videos. Rockstar allies have leaned on that point, arguing the leaks undersell the game the same way the 2022 clips did. True, but beside the point. Spoilers do not need polished lighting to spread.
Who Is CyberLeek?
The memecoin machine
Every leaked video carries a watermark advertising $CYBERLEEK, a memecoin the leaker launched alongside the first drop. One overlay reads “HIGHER MARKET CAP = MORE LEEKS.” The stated plan is that trading attention funds a “secret project,” which gives the whole operation the shape of a pump scheme with stolen gameplay as the marketing engine.
This is a genuinely new species of leak. Lapsus$ in 2022 wanted ransom and clout. CyberLeek has built an incentive loop in which the audience pays to keep the leaks coming, and the leaker profits from volatility rather than from a single extortion payment. Security researchers we read expect copycats if the token holds any value.
It also creates legal exposure far beyond copyright. Tying token price to the release of stolen property invites securities and fraud claims on top of the usual Computer Fraud and Abuse Act charges. The watermark is, in effect, a signed confession attached to every clip.
Polls that decide the next leak
CyberLeek runs polls where token holders and followers vote on the next reveal. The August 20 airplane video was the first poll-selected drop. A later poll asked whether followers wanted the rumored Lucia prologue leaked, with the leaker claiming to be personally avoiding spoilers and unable to make the call alone.
The audience-participation angle is doing exactly what it was built to do. Each poll becomes its own news story before any footage exists. Gaming forums argue about what to vote for, wire services cover the vote totals, and the anticipation cycle repeats without CyberLeek spending anything.
It is worth being clear about what participation means here. Voting in those polls is voting for the continued distribution of stolen work from a studio of thousands of people. The one group conspicuously not enjoying the show is the team that built the content being drip-fed for token hype.
The Seychelles trail
Identity speculation has produced one concrete lead so far. A fan investigator traced on-chain activity connected to the $CYBERLEEK token through a Seychelles-registered exchange, a jurisdiction long favored for its loose disclosure rules. That narrows nothing by itself, but it gives investigators a subpoena target.
The 2022 precedent looms over all of it. Arion Kurtaj, the Lapsus$ teenager behind the original GTA 6 breach, was identified within weeks and later handed an indefinite hospital order by a UK court. Rockstar’s parent company had every incentive to make an example of him, and it did.
CyberLeek appears aware of the history. The persona taunts Rockstar directly in-game, mocked capture rumors by posting new footage, and keeps operational details tight. Whether that discipline survives contact with three-letter agencies and blockchain forensics is the open question of the next few weeks.
The Demands: Discs, Leeks, and Monero
A manifesto against digital-only releases
CyberLeek published a manifesto framing the leaks as protest. The stated grievances: GTA 6 shipping without a physical disc version, the industry’s habit of delisting purchased content, and digital storefronts as instruments of control. The caption on the August 19 drop, “No physical discs? Then more leeks!”, ties each leak directly to that complaint.
The manifesto also threatens other publishers with similar treatment. No names were given, but the message was aimed at every studio moving to digital-only distribution. Game preservation advocates have spent years making a version of this argument through legal channels, and most of them want nothing to do with this campaign.
We would not take the ideology at face value. A protest against digital ownership that funds itself through a speculative token is not a coherent philosophy, it is branding. The disc complaint gives sympathizers a reason to cheer, and the token gives the operation a payday either way.
The leek-costume protest and one lonely volunteer
Among the stranger demands: CyberLeek called for at least ten people to stand outside Take-Two or Rockstar offices during working hours, dressed as leeks and holding physical game discs. The demand was framed as proof of public support, with more footage promised if it happened.
On August 24 exactly one person showed up. A video posted to X showed a lone protester outside Rockstar North’s Edinburgh studio asking for “the beach leaks,” well short of the ten-leek quorum. The clip went viral anyway, because of course it did.
The stunt reveals the campaign’s real mechanics. The demands are not designed to be met. They are designed to generate exactly this kind of absurdist content, which keeps the story alive on social platforms that a straight ransom demand would never reach.
The reported ransom
Behind the theater there is a conventional extortion attempt. Multiple reports indicate CyberLeek asked for roughly $165,000 in Monero simply to open negotiations with Rockstar. Monero’s untraceable design makes it the standard currency for this kind of demand.
There is no indication Take-Two engaged. The company’s 2022 playbook was to refuse negotiation, pursue the leaker through law enforcement, and absorb the short-term damage. Nothing in its current behavior suggests a different approach this time.
The number itself is small against GTA 6’s stakes, which analysts expect to be the largest entertainment launch in history. That mismatch supports the read that the ransom is a side bet. The token, the polls, and the attention are the actual business model.
How Rockstar and Take-Two Are Responding
The takedown campaign
Take-Two’s visible response has been a rolling DMCA offensive. YouTube uploads of the leaked clips are disappearing within hours, and X posts carrying the footage are getting copyright-struck in waves. The company used identical tactics in 2022, when it also subpoenaed Discord and Microsoft to unmask uploaders.
Enforcement is losing the volume war. Every takedown wave spawns re-uploads with cropped watermarks, mirrored frames, and altered audio to dodge Content ID. The map image in particular is past containment, having been reposted, annotated, and meme-edited across every platform we checked.
The takedowns still serve a purpose beyond containment. Aggressive DMCA enforcement builds the willfulness record for eventual criminal and civil proceedings, and it keeps the leaked material off monetized channels where it would earn money for re-uploaders.
The internal email
Rockstar has said nothing publicly. Its one known response is an internal email from a senior executive, reported by Bloomberg on August 21, that denounced the leaks and promised staff the incident would not diminish “the excellent work” going into the release.
The silence is strategic and familiar. In 2022 Rockstar waited days before issuing its “extremely disappointed” statement, and Take-Two told investors the breach caused no disruption to development. Expect the same sequence here: internal reassurance first, a short public acknowledgment only if the story forces one.
Reporting around the email also captured the mood inside the studio. Developers who gave up remote work and accepted heavy internal security restrictions after 2022 are said to be furious that another build walked out the door anyway. Morale, not code, may be the real casualty.
What the 2022 precedent tells us
The obvious question is whether history repeats on the outcome. The 2022 breach, 90 clips from an in-development build, produced no delay. GTA 6 shipped its trailers on schedule afterward and Take-Two repeatedly confirmed the timeline. Leaks embarrass studios, but they rarely move launch dates.
The legal outcome was also decisive. Kurtaj was caught through operational mistakes within weeks, prosecuted as part of the broader Lapsus$ sweep, and became the cautionary tale for every would-be leaker since. Take-Two’s litigation machine has run this exact race before and won.
The difference this time is the live build and the incentive structure. A leaker who can generate new material on demand, funded by an audience that profits from continued leaks, is a longer siege than a one-time dump. Containment failed on day one. The race now is identification.
What This Means for November 19
The Netflix reveal collision
The timing could hardly be worse for Rockstar’s marketing calendar. “GTA 6: An Extended Look” premieres on Netflix on August 27, the first official deep gameplay showcase, and it now airs into an audience that has spent nine days watching unpolished stolen footage. We covered the reveal plans in our GTA 6 Ultimate Edition and Netflix reveal report.
Some analysts argue the leak accidentally set Netflix up to win. The stolen clips are debug-build ugly, and the Extended Look will be the first time most viewers see the finished game’s presentation. The contrast between the two may do more for Rockstar than any takedown notice.
Rockstar has not blinked on schedule. No date changes, no statement, no acknowledgment that the showcase might address the leaks. The company is betting that polish beats piracy for the mainstream audience, and the 2022 trailer records suggest that bet usually pays.
Delay odds and the release date
Nothing in the leak has touched the launch plan. The release date Rockstar confirmed in June, covered in our GTA 6 release date report, remains November 19, 2026, and pre-orders continue unaffected. Take-Two told investors after the 2022 breach that leaks caused no development disruption, and the same logic applies to a copied 2025 build now.
Prediction markets agree. Delay contracts on Kalshi and Polymarket barely moved on the leak news, staying in the same range they held through the summer. Traders read the breach as a security story, not a schedule story.
The PC question is the one calendar item genuinely worth watching, and it predates the leak. Console ships first, with the PC version tracked separately, as we detailed in our GTA 6 PC release date analysis. Nothing in the leaked build changes that sequencing.
Spoiler risk for players
The practical concern for anyone planning to play in November is spoilers. Story cutscenes with dialogue are already out, and a poll about leaking the game’s prologue is sitting in public view. If CyberLeek keeps the daily cadence through September, meaningful plot content will be nearly impossible to avoid on gaming social media.
Muting works better than willpower. Blocking the obvious keywords, the leaker’s handle variants, and map-related terms on X, Reddit, and YouTube cuts off most of the exposure. The clips themselves are getting struck fast enough that casual scrolling rarely surfaces them more than a day after each drop.
Our advice is simple. Watch the official Netflix showcase on August 27 for the real look at the game, treat everything watermarked with a vegetable as radioactive, and let the courts handle the rest. Three months out from the biggest launch in entertainment history, the game itself has not changed at all.
Frequently Asked Questions
What did the GTA 6 leak actually show?
At least six gameplay videos and a full map of Leonida leaked between August 18 and August 21, 2026. The clips show Jason Duval playing basketball, driving, using a taser, flying a plane, driving supercars, and two story cutscenes with dialogue. All of it comes from an unfinished 2025 development build with debug elements visible.
Who is CyberLeek?
CyberLeek is the anonymous persona, possibly a group, publishing the leaked footage. Nobody has been identified. The persona promotes a $CYBERLEEK memecoin watermarked on every clip, runs polls to pick the next leak, and published a manifesto protesting digital-only game releases. A fan traced related crypto activity to a Seychelles-based exchange, the only public lead so far.
Is the leaked GTA 6 footage real?
Yes. The volume of material, the consistent build details across six videos, and interactive stunts like spelling “LEEK” in bullet holes confirm live access to a working build rather than fabricated clips. Rockstar’s aggressive DMCA response and its Bloomberg-reported internal email treat it as genuine.
Will the leak delay the GTA 6 release date?
There is no sign of that. The November 19, 2026 date stands, pre-orders are unaffected, and prediction-market delay odds barely moved on the news. The 2022 breach, which was larger in clip count, caused no delay either.
Did Rockstar respond to the CyberLeek leak?
Not publicly, as of August 26. Bloomberg reported an internal email from a senior Rockstar executive on August 21 denouncing the leaks and reassuring staff. Take-Two is issuing DMCA takedowns across YouTube and X. The official Netflix “Extended Look” showcase on August 27 is still going ahead.
What does the $CYBERLEEK memecoin have to do with the leak?
The leaker launched the token alongside the first drop and watermarks it on every video with slogans like “HIGHER MARKET CAP = MORE LEEKS.” Token attention effectively funds the operation, and holder polls decide which content leaks next. It is the first major game leak run on a memecoin incentive model, and it adds fraud exposure to the leaker’s copyright and hacking liability.
Written by Elias Virtanen – gaming and technology reporter covering the games industry, platform economics, and digital security for Tech Insider.
