Take-Two's CyberLeek Hunt Is Closing In: Sealed Subpoena, Two Suspects Identified
A federal judge has granted Take-Two's request for a sealed subpoena targeting two specific Discord users connected to the GTA 6 leaks. The investigation that started with 107,000 Discord accounts in a wide net has narrowed to two names behind a locked door. CONFIRMED via PC Gamer, VGC, GamesRadar, Dexerto, and TorrentFreak.
What Just Happened
On August 28, Take-Two filed a second DMCA subpoena targeting Discord. Unlike the first one, which was public and cast a wide net across three named servers and thousands of users, this one is different in three specific ways.
It targets two people, not thousands. The filing states that Take-Two "has identified one additional Discord user and obtained additional identifying information for a previously identified Discord user." They went from asking for data on everyone in a room to asking for data on two specific people in it. CONFIRMED.
It is sealed. Judge Andrew L. Carter of the Southern District of New York granted the request on September 1. The contents are private. Take-Two argued that public disclosure "could compromise Take-Two's ongoing investigation and even tip off the alleged infringers as to the nature and progress of Take-Two's investigation and information Take-Two has gathered about the infringement, creating a substantial risk that the infringers will delete, destroy, or otherwise conceal evidence." CONFIRMED.
The YouTube and Google subpoenas were withdrawn. On the same day the second Discord filing went in, Take-Two pulled back its subpoena requests for YouTube and Google. Their explanation: "Take-Two's investigation of the individual(s) responsible for posting infringing content on YouTube, and elsewhere online, has been (and is) evolving rapidly as new information becomes available." When a legal team stops looking in multiple directions and starts looking in one, it usually means they found something in that direction. CONFIRMED.
The September 4 Deadline
The original DMCA subpoenas filed on August 20 gave Microsoft and Discord until September 4 to produce records. That deadline is tomorrow.
What Take-Two asked for in the first round: MachineGuid and MSA device identifiers, registration and last-login IP addresses, phone numbers, linked Google and Xbox connections, OneDrive contents, and all identifying information for every account that communicated in three named Discord servers since June 1. CONFIRMED via Tom's Hardware.
Whether Microsoft and Discord have already begun producing records, or whether the sealed second subpoena changes the timeline, is not public.
The Money Trail
This is the part that matters for VCH's lane.
CyberLeek did not just leak footage. CyberLeek built a business around stolen property and ran it for nine days in public.
The $CYBERLEEK memecoin launched alongside the leaks. Paid polls required sending non-refundable tokens to vote. Strip club footage was gated behind a $3 million market cap target. At least one person paid $80 to vote, the full retail price of the game. CONFIRMED.
A $165,000 advertising rate card was posted on the site, offering sponsorship of upcoming leaks. Gambling and adult content welcome. Scams not. CONFIRMED.
CyberLeek reportedly cashed out $200,000+ from the token as the Extended Look broadcast aired on August 27, then went silent. No new clips have appeared since. The site and Telegram channel reportedly went offline following legal action. CONFIRMED via PC Gamer.
Our full breakdown of the token, the 270 million burned tokens (roughly $1.4M), and where the money actually went is in the CyberLeek token explainer.
What the Leaks Actually Got Right
The irony is that CyberLeek's footage turned out to be almost entirely accurate. Of the fifteen major mechanics visible across fourteen clips, the Extended Look and creator previews confirmed all but one. The six-star wanted system, the police identification vectors, Crime Reported, button-prompt carjacking, character switching, the fishing system, the NINE1NINE nightclub, fuel and repair costs, and vehicle tracking were all real.
The full resolution table, grading every leaked mechanic against official footage, is in our archived leak tracker.
The leaks were real footage. The delivery mechanism was a scam. That was true on day one and it is true today.
What Happens Next
If the September 4 deadline produces records, Take-Two will have IP addresses, device identifiers, and account connections for two specific people it has already identified by their Discord activity. Combined with PC Gamer's open-source research pointing toward a German or Swiss individual in their 30s, and the German hosting already documented, the circle is narrowing.
For the 2022 breach, Arion Kurtaj was arrested, tried, and sentenced to an indefinite hospital order. That case took roughly a year from breach to arrest. This one is moving faster.
Join free and we'll send the Day-One Money Plan before November 19
Keep stacking:
The GTA 6 CyberLeek Leaks: What Was Real (Full Record)
The GTA 6 CyberLeek Token: Where the Money Actually Goes
Every New GTA 6 Detail After the Extended Look
More GTA 6 News
GTA 6 Has No Disc: What Your $80 Actually Buys
Open the box. Inside is a card with a download code. No disc. No offline install. No lending it to a friend. No reselling it when you're done. That is…
The U.S. Army Is Using GTA 6 as a Reenlistment Tool
Twenty soldiers have already signed up. The memo is real. The Army confirmed it. The 9th Brigade Engineer Battalion at Fort Stewart, Georgia, part of…
Rockstar's Official Statement on the GTA 6 Leaks
On August 26, 2026, one day before the Extended Look premiered on Netflix, Rockstar Games broke nine days of silence and issued its first public state…
Free Download
Get the Free Playbook
Every GTA 6 money strategy, launch-day route, and business breakdown — delivered the moment it drops. Join 1,000+ hustlers, free.
Join the Conversation
Log in or create a free account to like, reply, and post your own takes. You can keep reading every comment either way.