There have been two GTA 6 leaks that actually mattered, and people constantly mix them up.
What are the GTA 6 leaks?
The first was in September 2022: a teenager named Arion Kurtaj, working with the Lapsus$ group, got into Rockstar's internal communications system and posted ninety clips of pre-release footage to a fan forum. He has been in custody ever since and faces a criminal trial in November 2026. The second was in August 2026: gameplay footage and map files that surfaced carrying QR codes for a website and a Solana token called CYBERLEEK, a token which had already been trading for three days before the footage appeared. The first is a settled matter of court record. The second is an open question where the on-chain evidence is solid but the identity of the people behind it is not. Nothing published so far connects the two.
The 2022 leak: what the court record shows
This one is documented. Kurtaj was convicted in December 2023 of hacking, fraud and extortion, and given an indefinite hospital order rather than a fixed sentence, on the basis that he is severely autistic and had been assessed as intending to return to cybercrime. In July 2026 he was reported to have been moved from the secure hospital into an ordinary prison after doctors judged him fit to stand trial. That trial is listed for November 2026, the same month GTA 6 is due.
He has not been released, despite a wave of headlines in July 2026 that were widely read that way. Separately, and unrelated to the leak, Rockstar itself faces an employment tribunal that ends 35 days before launch.
Read the full case file, tier by tier.
The 2026 leak: what the blockchain shows
This one is stranger, because the money came first. The group's domain went up on 14 August 2026. The CYBERLEEK token made its first on-chain trade on 15 August. The footage did not appear until around 17:00 UTC on 18 August, carrying QR codes pointing at both.
An investigation published by Bitquery on 21 August traced what happened next: a 13x move in an hour on $1.47 million of volume, then $22.7 million turned over across 163,014 trades and 16,182 wallets over the following week. The five wallets that took the most out, roughly $158,000, all bought inside a six-minute window, and none of them trace back to the person who deployed the token. They were bots.
Read the on-chain breakdown, and separately, what the leaked clips and the alleged Leonida map actually showed before the takedowns started.
Are the two leaks connected?
There is no published evidence that they are. Different actors, four years apart, and completely different methods: one was an intrusion into Rockstar's own systems by a member of a known hacking group, the other arrived pre-packaged with a token launch. Anyone telling you the same people are behind both is speculating. That claim sits in the unverified tier, and this site will say so until something changes.
How to tell a real GTA 6 leak from a fake one
- Ask where it came from. Real leaks have a chain of custody you can describe: a forum post, a court exhibit, a build that shipped by mistake. Fakes arrive with no origin story, or one that keeps changing.
- Check who is selling something. The 2026 leak came with a token attached and QR codes stamped on the footage. When a leak has a payment mechanism, the leak is the marketing.
- Wait for a named outlet. Not an aggregator repeating a tweet. Somebody with a masthead and a correction policy putting their name to it.
- Distrust anything that arrives fully explained. Genuine early material is fragmentary and confusing. A leak that neatly answers every open question is usually built to.
That is the same test applied in every video on this channel. How the evidence tiers work.
GTA 6 
