(UPDATE, August 28): Since publishing this article, I was contacted by independent researcher xorextrace, who has published a separate on-chain analysis of the CyberLeek crypto trail along with the code needed to reproduce it. All credit goes to xorextrace for this superb work. In simpler terms: we can now reproduce the key money movements ourselves, making Vice Cit’s reporting even more believable.

I should stress that I am not a blockchain analyst. I’m a games journalist trying to verify someone else’s technical work as carefully as I can. With that said, I downloaded fresh Solana transaction data and ran xorextrace’s tools myself.

The earlier funding figures checked out, including the 331.66 SOL sent into the wallet responsible for creating the $CYBERLEEK token. I also manually checked several of those transactions on Solscan and found the amounts, addresses and timestamps matched the script’s output.

More importantly for this story, the updated tools also reproduced the August 27 cash-out that has led to speculation that Cyberleek is taking the profit and getting the hell out of dodge. Around 3,210.80 SOL left the $CYBERLEEK token operation through a chain of fresh wallets. Of that, roughly 1,336.67 SOL could be cleanly traced to an address labelled by Solscan as a CCE.Cash exchange deposit wallet, while around 543.90 SOL reached an address labelled as a KuCoin exchange deposit address. I manually checked both endpoint labels on Solscan as well.

xorextrace has actually become more conservative with the KuCoin figure since the original report. Additional funds later reach shared KuCoin-labelled infrastructure, but once those funds are mixed with unrelated money, they can no longer be cleanly attributed to CyberLeek. Rather than stretching the number, the updated analysis leaves them out.

That gives me considerably more confidence in Vice Cit’s original reporting. I have not conducted my own forensic investigation here — xorextrace did the hard work — but I was able to reproduce the key figures from fresh public data rather than simply taking them on trust.

None of this identifies the person behind CyberLeek. The recent silence from CyberLeek does not prove they are disappearing either.

Still, the timing is interesting: the leaks have gone quiet just as the money began moving, which fits Vice Cit’s theory that the operation may be winding down. Rockstar’s big official GTA 6 gameplay reveal may also simply have made further leaks less valuable.

xorextrace has published the full report and verification tools on GitHub for anyone who wants to dig into the technical details themselves.

(ORIGINAL STORY):The increasingly bizarre CyberLeek saga may finally be coming to an end just as Rockstar shows off GTA 6 on Netflix, with a new blockchain investigation claiming the leaker has started moving around $270,000 earned through the cryptocurrency attached to the leaks.

I’ve talked about CyberLeek’s strange operation a few times now, including the $CYBERLEEK meme coin that became increasingly central to the whole thing and the conspiracy theory that it has all been a marketing stunt. Rather than simply dumping a huge reserve of tokens in a traditional rug pull, CyberLeek burned around 270 million tokens and appears to have instead made money from transaction fees generated whenever people bought and sold the coin.

According to GTAForums user Vice Cit, who has been steadily following the crypto trail across several lengthy investigations, CyberLeek claimed roughly $270,000 worth of trading fees before converting the proceeds into Solana and moving the money through several different wallets.

Vice Cit traced around $99,000 of that to KuCoin, while another $84,000 was sent through CCE.Cash, a crypto swapping service that doesn’t require users to create an account. The remaining roughly $91,000 was spread between wallets that, at the time of his investigation, had yet to move the funds elsewhere.

That means “cashed out” perhaps isn’t completely accurate just yet, as a sizeable chunk of the money is still sitting in crypto wallets. But it certainly looks like CyberLeek has started extracting the proceeds from the project in probably the most predictable plot twist ever.

Perhaps more interestingly, Vice Cit estimates that setting the entire thing up originally cost around $29,000, including funding the token, website and file hosting. If his figures are correct, that would leave CyberLeek with somewhere in the region of $241,000 in profit.

Not bad money. Whether it’s “risk having Take-Two’s lawyers attempting to crawl through your bedroom window” money is another question.

The use of two different withdrawal methods has also led Vice Cit to wonder whether CyberLeek may actually involve more than one person — potentially somebody organising the operation and somebody else supplying the leaked footage.

What does make the timing interesting is that CyberLeek appears to have suddenly gone quiet. The timing makes sense, too: with the extended look at GTA 6 having just occurred and it about to appear on Netflix, the leaks are a bit less impactful.

There hasn’t been another poll asking users what footage they want to see next, and Vice Cit notes that the most recent leak appeared to tease another part that hasn’t yet materialised. Meanwhile, the $CYBERLEEK token has dropped substantially from its peak as attention surrounding the leaks begins to fade. People have began turning on CyberLeek a little more, and each leak came with even more prominent pushes to by the memcoin.

Put all of that together and the suggestion is that CyberLeek may simply be winding the operation down while taking the money made along the way.