Why the CyberLeek Token Existed Three Days Before the GTA 6 Footage Leaked

The Raydium pool that trades CYBERLEEK opened at 21:07:26 UTC on Saturday 15 August 2026, and the leaked GTA 6 footage carrying QR codes did not surface until roughly 17:00 UTC on Tuesday 18 August. Across those three days the token barely moved, with hourly volume running between $4 and $2,500. The domain behind the project was registered earlier still, at 18:30:07 UTC on Friday 14 August, eight days after Rockstar announced the "GTA VI: An Extended Look" premiere on Thursday 6 August.

The infrastructure predates the leak. The leak was the advertisement, and because every step of that sequence is timestamped on a public chain, almost every number circulating about this token can be checked against the record rather than taken on trust.

The Sequence, Dated and Verified

Read the order of events and this stops being a story about a token that reacted to news, and becomes a story about a token that was waiting.

That first trade valued the entire supply at roughly $25,000. A domain registration, a pool, a supply and a distribution channel were all in place before a single frame of footage reached the public.

What the 18 August Session Actually Did

The daily candle for Tuesday 18 August opened at $0.000056280 and closed at $0.00329179 on $11,169,710 of volume, a 58.5x move across one session. The single hourly bar that contains the leak, the 17:00 candle, opened at $0.00005158 and closed at $0.00067204 on $1,452,880. Those two figures describe different things, and conflating them is where most of the coverage went wrong.

Inside that hour, the five wallets that ended up furthest ahead all bought between 17:48 and 17:54 UTC, taking roughly $158,000 in combined realized profit, and none of them traces back to the deployer address. Six minutes is a narrow window, and it is the kind of clustering that tells you the buyers were watching the same feed at the same moment. It does not tell you who they were, and nothing in the on-chain record identifies them.

Three Numbers That Circulated and What the Record Shows

Each of the claims below travelled widely. None survives a look at the daily candles.

The Sunday 23 August peak is worth pinning down with two feeds rather than one. The Raydium pool printed a high of $0.03447577 and CoinGecko records an all-time high of $0.03436079 timestamped 13:19 UTC the same day, a spread of 0.33%. Dated closes tell the arc more cleanly than any rolling window. Tuesday 18 August closed at $0.00329179, Friday 21 August at $0.00135226, Sunday 23 August at $0.02507511 and Monday 24 August at $0.01800036.

What the Contract Proves and What It Does Not

The canonical mint is ApZuxdpzMrbEYTGEzeY9afh5pj9d6qPRJCTgQYiipbKg, a standard SPL token with 9 decimals. A direct RPC read on Tuesday 25 August at 09:11 UTC returned a supply of 729,960,124.85 with both mint authority and freeze authority set to null, so no new units can be created and no balance can be frozen. Holder counts diverge sharply by method, with a direct count returning 63,719 against a screening tool's 102,886, the difference being tens of thousands of zero-balance associated token accounts.

Volume disagrees across feeds too. DexScreener counted $19,396,736 over 24 hours against CoinMarketCap's $21,024,445 for the same window, an 8.39% spread. Two feeds and the gap between them beat one feed quoted with false precision, a habit worth carrying into any token you research, including the ones covered in our walkthrough of verifying the Base cat token.

On the safety side the results are better than the story around them suggests. Rugcheck returns a `rugged: false` verdict with a low risk score of 7, liquidity is 99.72% locked on the Raydium market, and the creator balance is zero. A live round-trip probe against the pool sold 50,000 CYBERLEEK for 7.479 SOL at 0.0076% price impact, which rules out a honeypot in the technical sense of a token you can buy and cannot sell.

Two caveats belong next to that. Graph analysis links 37 wallets across seven networks in patterns consistent with coordinated early positioning, and the token's metadata is mutable, meaning its name and image can be changed by the metadata authority after this article publishes. A token that passes a security scan on Tuesday can present itself as something else on Friday, which is why how Solana works at the account level matters more than any single scan result.

One separation gets blurred constantly. The project's published domain is cyberleek.ar.io, which returns HTTP 451 Unavailable For Legal Reasons as of Tuesday 25 August. The phishing report and the 1 out of 100 trust score that circulated attach to cyberleek.com, a different domain that the project neither publishes nor links. Treating the two as one site produces a factual error about the contract, and the contract is what your money touches.

What the Court Filings Do and Do Not Compel

Take-Two filed four DMCA subpoena requests in the Southern District of New York on Thursday 20 August 2026, naming Microsoft, Discord, X Corp and Google/YouTube. The lead matter, In RE: Take-Two Interactive Software, Inc., is docketed as 1:26-mc-00421 (S.D.N.Y.), assigned to Judge Jennifer L. Rochon and terminated on Friday 21 August. A companion matter, 1:26-mc-00422, targets Discord under 17 U.S.C. Section 512(h), the provision that lets a copyright holder seek an identifying subpoena without first filing a lawsuit against anyone.

This is the part almost every headline got wrong. The order signed on Friday 21 August directs the clerk to issue the subpoena. As of the docket read on Tuesday 25 August 2026, the clerk had not issued them. Nothing has been compelled and no data has changed hands. Writing that a judge ordered Microsoft and Discord to hand over records describes a step that has not happened.

TorrentFreak's reporting adds detail that should be labelled as reported rather than registry-verified, including a 4 September compliance date and the categories sought, described as device identifiers, registration and last-login IP addresses, phone numbers, linked accounts and cloud storage contents. The same reporting notes that the X Corp requests name accounts the community had already flagged as impostors, and that later leak videos carried on-screen text stating the persona holds no account on that platform. We are not going to repeat any third-party attempt to name an individual behind any of it, because none of those attempts is evidence and a wrong one causes real harm to a real person.

What Is Scheduled for Thursday 27 August

"Grand Theft Auto VI: An Extended Look" premieres on Netflix at 19:00 UTC on Thursday 27 August and arrives on Rockstar's YouTube channel and the Grand Theft Auto VI site at 01:00 UTC on Friday 28 August. That is the first scheduled official release of extended footage since the leaks began, and it removes the scarcity the leaked clips were trading on.

What a token built on a leak does when the material stops being scarce is not something anybody can tell you in advance. The mechanical point is narrower and more useful. Tokens of this shape run on a supply of attention rather than a supply of cash flows, and this particular attention has a published expiry date. Readers who want the entity rather than the timeline can go to our guide to what CyberLeek is, and the broader pattern sits in the history of memecoin categories.

Frequently Asked Questions

Is the CyberLeek token a honeypot?

No. A live round-trip probe sold 50,000 CYBERLEEK back into the Raydium pool at 0.0076% price impact, which is the practical test for a token that can be bought and not sold. That result speaks only to sell mechanics and says nothing about where the price goes.

Can the CyberLeek token be renamed after launch?

Yes, and this is the caveat most holders miss. The name, symbol and image sit under a metadata authority that has not been revoked, so the token you researched under one identity can present under another without any change to the mint address. Always verify by contract address rather than by displayed name.

Has Microsoft or Discord actually given Take-Two any user data?

No. A judge signed an order directing the clerk to issue a DMCA subpoena, and the clerk had not issued it as of Tuesday 25 August 2026. A section 512(h) subpoena also has to be served and can be challenged before any provider responds, so several steps sit between the current docket position and any disclosure.

Can you trade CYBERLEEK on Phemex?

Phemex does not list a CYBERLEEK perpetual, so there is no leveraged product for this specific token. Tokens of this shape almost always live on Solana memecoin launchpads and decentralised pools rather than on centralised order books, which is where the six-minute wallet clustering became possible in the first place.

Bottom Line

The dates are the whole argument. A domain on Friday 14 August, a pool on Saturday 15 August, three days of near-zero volume, and then $11.17 million through the book on Tuesday 18 August the moment QR codes appeared in leaked footage. Two things are worth watching from here rather than re-litigating what already happened. The first is the docket, where the gap between an order directing the clerk to issue and an actual issued and served subpoena is the difference between a headline and a legal consequence. The second is Thursday 27 August at 19:00 UTC, when the official footage arrives and the scarcity that powered the whole trade stops existing.

Build a position on somebody else's promotional calendar and you own the calendar's risk, not the asset's.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency trading involves substantial risk. Always conduct your own research before making trading decisions.