Community Digital Sleuths Narrow In on GTA 6 Leaker’s Identity

The Grand Theft Auto 6 leak campaign that began in mid-August has spawned an unexpected secondary investigation: community members are now engaged in digital forensics work trying to identify the leaker. Since August 18, an entity or collective calling itself Cyberleek has been posting stolen gameplay footage to the blockchain, and a new suspect has emerged that may explain how the leaks spread so quickly through online communities.

On August 25, a GTA Forums user known as Vice Cit published an extensive forensic report arguing that a Discord user named stayonthegrindd holds a direct connection to the Cyberleek leaker. Vice Cit’s investigation pulls from evidence that appeared on Reddit before moderators removed the thread, combined with public blockchain records and Discord timestamps that paint a timeline of how the footage moved through networks.

The Timeline Evidence

The Initial Uploads

The investigation centers on a specific sequence of events spanning August 16–23. On August 16, Cyberleek released a preview of what appears to be the GTA 6 map. The following day, Cyberleek uploaded basketball gameplay footage to the dark web. Early on August 18, a user named “Cyberleeker” on Dread (a dark web forum similar to Reddit) shared that same basketball clip across multiple hosting sites.

Discord Activity and Suspicious Timing

Within hours of that post, stayonthegrindd joined a GTA 6 Discord server and immediately shared the basketball footage with the server members, only to delete it moments later. The user claimed the video showed footage from 2026, then asked the server what leaked content they wanted to see next. When someone suggested driving gameplay, stayonthegrindd responded, “I will be back with driving gameplay.” The user also mentioned that while video compression was ongoing, they could quickly provide the full map to the server.

Approximately 90 minutes after that offer, the GTA 6 map appeared on the blockchain. Two hours later, gameplay footage of the character Jason driving was uploaded to the blockchain by Cyberleek. The sequence of events—an offer to provide the map, followed by its blockchain appearance, then a second piece of content uploaded by Cyberleek—suggests coordination between these accounts.

The Delayed “Gas” Clip

On the same day, a Discord user reported receiving a direct message from stayonthegrindd containing the “Gas” gameplay clip—footage showing a black car—but the video was deleted before the recipient could finish watching. This clip did not surface on the blockchain until August 23, several days after the exchange. The five-day gap between the Discord message and the blockchain upload raises significant questions about how stayonthegrindd obtained footage that was not yet publicly available.

Connecting the Dots

Read also: Witcher 3 Expansion Songs of the Past Unveils Grappling Chain Weapon · GTA 6 Leaks Confirm Dense NPC Crowds Match Original Trailers · GTA 6 Leaks Reveal Radio Stations as Cyberleek Posts Daily Gameplay · Star Wars: Zero Company Reviews Praise Tactics, Debate Story Quality

Vice Cit’s conclusion rests on the alignment of these timestamps and access patterns. The suspect either possessed the leaked material and strategically released it through Discord knowing the content would spread rapidly, or the person is directly connected to whoever holds the source material and gained early access to clips before they were uploaded to the blockchain. Vice Cit, who studied digital forensics during college, described the timing as “too coincidental to ignore.”

In Vice Cit’s assessment: “This person either had this material and was trying to get this whole thing to blow up by posting it in a place they knew would spread the leaks like wildfire, or this person is a friend of the person who has this leaked material and was able to see the leaks before they ever got uploaded onto Arweave. Either way, I truly do believe this is a huge leap in this case, and Take Two most likely already had this information days ago.”

Vice Cit went further, offering a speculation based on the available evidence: “If I had to give my personal opinion, even though there is not concrete proof yet, I do believe stayonthegrindd is CyberLeek (or at least a member of the group), and I think this was a huge opsec misstep.”

What the Evidence Reveals

Access to Unreleased Material

The blockchain and Discord records create a clear chain of access. Stayonthegrindd demonstrated possession of or immediate access to leaked content before public distribution—a position only someone close to the source would occupy. The Discord server interactions also show the user offering to provide additional content on demand, a behavior consistent with someone directly involved in the leak rather than simply reposting material found elsewhere.

Suspicious Delays and Possession

The “Gas” clip’s delayed appearance on the blockchain (August 23, five days after the Discord DM) is particularly telling. If stayonthegrindd had merely found the footage on the dark web and shared it in Discord, why would they possess a video that did not yet exist on any public ledger? The only logical explanation is that the user had access to the source material before it was committed to the blockchain, suggesting an internal connection to Cyberleek’s operation.

Precision Timing

The timing precision—events happening within minutes of each other across multiple platforms—makes random coincidence implausible. The suspect’s specific knowledge of what content existed and when, paired with the ability to share unreleased clips via direct message, points to direct involvement or close proximity to whoever conducted the theft.

The Investigation’s Next Steps

At this stage, Take-Two Interactive (Rockstar Games’ parent company), law enforcement, and the company’s legal team almost certainly possess the same evidence Vice Cit compiled. Take-Two has already begun legal action, sending broad data requests seeking information about the leaker’s identity and distribution methods. The Discord account, blockchain addresses, and IP logs associated with stayonthegrindd’s activity would be among the first targets of an institutional investigation.

The question now is whether this digital trail leads authorities to the original hacker responsible for the initial breach, or whether stayonthegrindd represents a compartmentalized aspect of the operation that can be shut down without exposing the core perpetrator. If the suspect proves to be a member of a larger group, pursuing this lead could unravel the entire network. If stayonthegrindd is merely someone with secondary access, the original leaker may continue operating.

Operational Security Failure

What remains clear is that Cyberleek’s operational security has already failed. The burst of leaks across multiple platforms, combined with the suspect’s careless Discord activity, has left a forensic trail visible to community investigators and certainly to professional investigators with access to account records and blockchain analysis tools that exceed what volunteer sleuths can accomplish. The coordination required to move footage between dark web platforms, Discord servers, and blockchain storage—all within a compressed timeline—suggests a less sophisticated operation than the scale of the breach might otherwise imply.