The GTA VI leak. How big leaks become bait.

On August 18, two minute-long gameplay clips and a map of Grand Theft Auto VI's Leonida showed up online. A group calling itself CyberLeek claimed them. By the weekend there were eight or nine clips, each one burned with a watermark, a manifesto, and a QR code pointing at a cryptocurrency coin. Take-Two, Rockstar's parent company, started filing copyright takedowns the same day. Two days later, on August 20, it asked a federal court in New York to make Microsoft and Discord hand over the identities of everyone in three Discord servers. By the weekend it had gone after X and Google too.

The clips are real. Take-Two's own court filings call them copyrighted material, and in one of them the player sprays the word LEEK into a wall with bullets, which is not something you do with recycled footage. These clips are also getting harder to find by the day, and that is where this story can turn dangerous for the people looking for them.

Follow the money

CyberLeek's manifesto reads like consumer advocacy. No digital-only preorders, no day-one DLC that was already on the disc, an offline mode for single player. The group says it will keep leaking until Rockstar apologizes.

The blockchain tells a different order of events. Bitquery, an on-chain analytics firm, traced the group's website to a domain registered August 14 and its Solana token, $CYBERLEEK, to a first trade on August 15. The footage came three days later, with the coin's QR code in the watermark. Five wallets that bought inside a six-minute window during that first spike took about $158,000 out of it. The coin's high did not come on the night of the leak either. It came on August 23, five days later, and as of Monday evening the token carried a market value around $15 million. The group has since tied its drops to that price, holding one clip back until the coin cleared a number it had named. A coin like this can move fifty percent in a day, so treat any figure as a snapshot rather than a valuation. Stop Killing Games, the consumer campaign the manifesto borrows from, told fans not to send the group money, "no matter how much sympathy you may feel for their actions."

The leak was a sales funnel from the start. What followed it was worse.

What the takedowns did

Take-Two is doing what any copyright holder does with its own stolen work. It files notices, platforms pull the videos, and reposters get strikes. YouTube, X and Telegram have all been hit, and X has suspended the three accounts Take-Two named. CyberLeek's own site and Telegram channel went dark around August 22. The clips have not stopped coming.

There is a ripple effect. The clips did not disappear, they moved. When the easy copies vanish from YouTube and X, the people still looking go to the next layer down. Discord invites, Telegram channels, mirror sites, torrents. NordVPN's chief technology officer, Marijus Briedis, called it "exactly the environment where fake 'leak' downloads and credential-harvesting pages thrive."

Scarcity makes people less picky, and the demand here is not normal. This is the game an entire industry rearranged its release calendar to get out of the way of. A fan who would never click a "free GTA 6 download" ad in June will click a "full leak archive" link in August, because it is the only thing left.

What was waiting

Three new things showed up within days.

A 113 gigabyte torrent, named as a CyberLeek "repack" of the full game, started circulating on torrent sites. A user on X who pulled it apart reported that it is almost entirely zeroes, padded to look like a real game install, with a roughly 50 kilobyte program inside. The decompiled code tells Windows Defender to ignore the entire C: drive and then kills security software. Tom's Hardware reported it on August 23. That analysis comes from a hobbyist, not a security vendor, so treat the exact numbers as a claim. The shape of it is not in doubt. CyberLeek has shown clips, and nothing in the clips or the court filings suggests anyone is handing out the game.

Fake "leak" websites appeared with the game's name in the domain. Malwarebytes published an analysis of four of them on August 24, and two of them matter here. One poses as a playable demo. The other poses as Rockstar's own Extended Look, the trailer event that streams this Thursday. Both hand you a file called gta6_installer.exe carrying Vidar, a password stealer that has been around since 2018. It takes browser cookies and saved logins, Discord and Telegram tokens, and cryptocurrency wallets. An independent researcher who took one of the same domains apart on August 20 found a second trick in the set, the fake CAPTCHA box that asks you to paste a command to prove you are human. Neither write-up ties any of this back to CyberLeek. It doesn't have to. The group opened the door and other people walked through it.

Impostor accounts multiplied. The three X accounts Take-Two named in its subpoena had already been flagged by fans as fakes, and the group's later clips carried the watermark "CYBERLEEK DOES NOT HAVE TWITTER." Any account offering you the videos is somebody using the name.

And the older wave never stopped. Malwarebytes documented "VIP Digital Access" sites in June charging $250, payable only in Bitcoin, USDT or Ethereum, for early access to a game that does not exist yet. McAfee listed fake early access, secret beta downloads and "exclusive" launchers among the top gaming lures on August 12, six days before the leak. The leak gave those sites a fresh coat of paint.

The playbook is older than this game

None of this is new. It is the same sequence every time something people want gets scrubbed.

Kaspersky counted more than 19 million attempts to download malware disguised as popular games between April 2024 and March 2025, affecting over 400,000 people. Grand Theft Auto was the most-used disguise at about 4.5 million attempts, ahead of Minecraft and Call of Duty. That was before anyone had seen a frame of GTA VI gameplay.

Proofpoint traced Vidar, StealC and Lumma stealers to YouTube videos advertising game cracks in 2024. The downloads were password-protected archives, which antivirus cannot scan, padded to around 800 megabytes so they looked like real games, with on-screen instructions to turn off Windows Defender first. Many of the videos targeted games popular with kids.

Movies work the same way. When The Odyssey hit theaters in July, Malwarebytes found fake torrents and fake "browser issue" pop-ups waiting within hours. I covered that one here. Hogwarts Legacy got fake cracks in 2023. Cyberpunk 2077 got a fake mobile beta in 2020 that turned out to be ransomware. Game of Thrones topped Kaspersky's list of TV shows used as malware bait in 2018, with fake episode files ending in .avi.exe.

The names change. The steps do not. Something people want gets pulled and the hunt for it moves somewhere darker. The first result in the darker place is a file that is not what it says it is.

If you want to see the clips

• A video is never a download. The real clips played on X and YouTube like any other video. Anything that arrives as a zip, an ISO, a "player" or an installer is a program, and the program is the point.
• Show file extensions. In File Explorer, click 'View', then 'Show', then check 'File name extensions'. A "video" ending in .exe gives itself away.
• Treat every CyberLeek account as an impostor. The group says it has no X account. Nobody selling you a link, an archive or a coin is the source.
• Never paste a command to "verify you are human." That is the fake CAPTCHA scam, and it is what one of the leak sites was running.
• If you already ran one, disconnect that computer, change your passwords from a different device starting with email, and check Discord and Steam for sessions you do not recognize. Here is the order to do it in. A password manager makes the rebuild a lot faster.

The limits

Neither Rockstar nor Take-Two has made a public statement, though Take-Two has said plenty in court filings. No arrest has been reported and nobody has been identified, so treat the names going around as guesses. The 113 GB torrent is the one piece here still resting on amateur analysis. One person on X took it apart, a lot of outlets repeated it, and no security vendor has published on that file either way. Nobody has published a count of how many people downloaded it. And a clip that came from a video site is still just a video. Watching one will not hurt your computer. Hunting for the copies that got pulled is where it goes wrong.

What everyone wants is two days away. Rockstar's Extended Look at GTA VI streams Thursday, August 27, at noon Pacific on Netflix, then at 6 p.m. Pacific on YouTube. There are already fake sites posing as that stream. The real one does not need a zip file.