GTA 6 Leaker Cashes Out $350K From CyberLeek Token via Liquidity Fees

$350K Extracted From Liquidity Fees

The anonymous leaker behind the Grand Theft Auto VI breach has pulled roughly $350,000 out of the CyberLeek (CYBERLEEK) token operation — and none of it came from selling coins. On-chain analyst Conor Grogan stated on September 1 that the wallets tied to the Solana-based project cashed out about $350,000 generated entirely from liquidity-provider fees, then moved the proceeds through a variety of over-the-counter (OTC) providers. That channel converts digital assets into conventional money without requiring large open-market token sales, which both smooths the exit and obscures the trail. Grogan, who has tracked several high-profile on-chain exploits, noted this is the first case he has seen in which a hacker earned money solely through liquidity provision rather than dumping a token on holders. The withdrawal surfaced at the same time as a steep slide in CYBERLEEK's price, and the on-chain record shows the leaker never needed to sell the bulk of the original liquidity to profit. Instead, the wallet collected fees each time other traders transacted in the pool — meaning latecomer retail activity effectively financed the payout.

cashed out about $350,000https://x.com/jconorgrogan/status/2094774509500805297

The economics depart sharply from the familiar launch-and-dump script. Rather than offloading large CYBERLEEK holdings into thin order books, the controlling wallet sat on the passive side of the trade, skimming fees whenever participants swapped in and out of its liquidity pool — the automated market-maker mechanic popularized by venues like Curve DAO. The design required only one input: sustained trading activity. The viral GTA VI leaks supplied exactly that. Blockchain researchers traced the token's launch to August 15, and the Solana-based asset appeared alongside each new leak as part of a coordinated campaign. Early clips showed relatively mundane gameplay involving the character Jason; later drops revealed driving, combat and NPC interactions. Each release pulled fresh buyers and speculators into the pool, feeding the fee engine even as elevated volume exposed those participants to wider volatility and potential losses. Meme coins — from Floki down to micro-cap tokens — routinely monetize attention, but few have wired a stolen-content campaign directly into fee accrual this cleanly. The identity behind the controlling wallets remains publicly unconfirmed.

Rockstar Response and Token Sell-Off

Rockstar Games publicly acknowledged the leaks on August 26, describing the situation as heartbreaking, though the studio never named CyberLeek or drew a definitive conclusion about the origin of the footage. The company has since filed DMCA subpoena applications seeking identifying information from Microsoft and Discord, escalating what began as a content leak into a formal legal pursuit. The timing was pointed: CyberLeek began releasing material from what appeared to be an in-development build just days before Rockstar's planned “Extended Look” presentation in late August, upstaging a marketing campaign the studio had kept tightly controlled. The market reaction has been unforgiving. As of the latest reading, CYBERLEEK traded near $0.002959, down 25.6% over 24 hours, according to CoinGecko data, with a market capitalization of $2.17 million and 24-hour trading volume of $2.69 million. Intraday action ranged from $0.0024 to $0.0041 within a single day. The token now sits roughly 91% below the all-time high it set on August 23 — a decline that accelerated once the fee withdrawal became public knowledge. Readers tracking the market in real time can follow live spot and futures prices on Gate.

A Fee-Harvest Playbook to Watch

COINOTAG's read: the CyberLeek episode sketches a troubling template. Where earlier scammers dumped tokens and left obvious sell-side fingerprints, this operator converted stolen IP into marketing, marketing into volume, and volume into fees — a chain that leaves subtler on-chain evidence and pays out through structures resembling ordinary market making. The funds moved through OTC channels rather than resting in a single exchange-linked cold wallet, complicating recovery efforts, though researchers tracing the wallet clusters may still establish whether they funnel through a common HD wallet hierarchy. For traders, the lesson is mechanical: when a token's upside depends on a stream of stolen content drops, liquidity fees are being extracted from latecomers. For now, CyberLeek remains an alias, not a confirmed identity.