There is a persistent belief that cryptocurrency is anonymous money. The GTA 6 leaker campaign is turning into a public seminar on why that is wrong, and the specific detail doing the damage is an exchange account.

Community analysis published on GTA Forums by the user Vice Cit, and reported by Dexerto on August 21, traces the funding behind the Cyberleek operation to KuCoin, a centralised exchange that requires identity verification. The same analysis estimated the operation had received roughly $50,000 at that point, with around $391,000 of unsold tokens that could be released gradually.

Everything here is community research and reporting, not a company statement, not a court filing and not a confirmed identification. Nobody has been named, charged or arrested.

Why a KYC Exchange Changes the Calculation

Public blockchains are not private. Every transfer is permanently visible to anyone who wants to look. What they do not contain is names.

Names live at the edges, where crypto meets ordinary money. To convert cash into crypto or crypto into cash at a mainstream exchange, you complete KYC, short for know your customer: identity documents, often a selfie, sometimes proof of address, all retained. That record sits in a company's database attached to every transaction, login and session from that account.

Vice Cit's summary, quoted by Dexerto, puts it plainly: "The crypto that funded all of this can be traced back to a well-known exchange that requires KYC verification. Which means whoever funded all of this had to submit documents verifying their identity that the authorities can subpoena the exchange for."

And on what such a subpoena would reach: "they would have the identity of the account holder, all of their transaction records, session history that could link them to certain events, and all kinds of other information."

That is the shape of the problem. On-chain activity is pseudonymous, but a single interaction with a regulated exchange is a bridge from a wallet address to a passport photo.

The Self Inflicted Part

What makes this notable is that none of it was necessary.

A leak campaign that simply published footage and disappeared would leave investigators with very little: some upload metadata, whatever a hosting platform retained, and file forensics. Difficult, slow, often fruitless.

Instead the operation attached a Solana token to every clip, embedded QR codes in the footage, ran a public website, sold sponsorship slots, and took payment. Each of those is a financial or commercial surface, and financial surfaces are exactly what modern investigations are best at following. Our breakdown of the token itself is in the on-chain timeline, and the detail of who actually profited is in the wallet analysis.

Vice Cit's follow up is the line worth remembering: if a forum user could find the transaction trail in a few hours, Rockstar's team almost certainly had it on day one.

What This Does and Does Not Mean

Some careful limits, because crypto forensics gets overstated in both directions.

It does not mean an arrest is imminent. Subpoenaing a foreign exchange is slower and messier than subpoenaing a US platform. Jurisdiction, mutual legal assistance treaties and the exchange's own policies all matter. Some exchanges cooperate quickly; others do not.

It does not mean the identity is already known publicly. Nothing has been confirmed by anyone with access to the actual records.

It does mean the anonymity assumption was wrong. The operation's own monetisation created a documentary trail through a regulated intermediary. That is a structural weakness, not a bad-luck event.

It also means intermediaries matter more than wallets. The interesting question is never "can you follow the blockchain." It is "where did this touch a company that keeps records."

The Money Never Worked Out Anyway

There is a bleak irony underneath. Independent on-chain analysis of the token found that the five wallets that extracted the most value from the launch, roughly $158,000 between them, all bought inside a six-minute window on August 18 and none of them trace back to the token's creator. They were automated traders positioned to buy anything that moved.

So the operation manufactured a price spike, took on the legal exposure of a financial trail, and watched unrelated trading bots harvest the largest share of the proceeds. Reported operator earnings have been estimated in the tens of thousands, against roughly $29,000 spent on setting up the token, site and infrastructure.

The standing warning applies as it always has: never buy the token, never scan the QR codes in leaked footage, and never pay for promised footage or builds. Coverage of a scheme is reporting, not financial advice, and not an endorsement. More on staying safe in the leak scam guide.

Frequently Asked Questions

Has KuCoin been subpoenaed?

Not that has been reported publicly. The known subpoena requests, filed August 20 in the Southern District of New York, target Microsoft and Discord, with a reported September 4 response deadline. An exchange subpoena has not been confirmed.

Is cryptocurrency actually traceable?

Public chains like Solana record every transaction permanently and openly. What they lack is identity. Identity generally enters through regulated exchanges, which is why KYC records are the pivot point in almost every crypto investigation.

How much did the leaker make?

Unknown. Community analysis estimated around $50,000 received as of August 21, with reported trading fee estimates elsewhere between $40,000 and $60,000. All figures are snapshots and none are audited.

Does this affect GTA 6's release?

No. GTA 6 remains scheduled for November 19, 2026 on PS5 and Xbox Series X and S, with preload on November 12 and the Extended Look on August 27.

The Bottom Line

The footage was the hard part to obtain and the easy part to publish anonymously. The token was the easy part to launch and the hard part to hide. If Cyberleek is eventually identified, the likeliest reason will not be a clever frame analysis of a leaked clip. It will be an account somewhere with a photo of a driving licence attached to it.

Sources: Dexerto, Bitquery on-chain investigation