Since August 18, an individual or group calling themselves "Cyberleek" has been sequentially leaking actual gameplay footage of GTA 6 online. Recently, online detectives seem to have made substantial progress in their investigation—a Discord user has been identified as the prime suspect, and related evidence chains are gradually coming to light.
On August 25, GTAForums user Vice Cit published an investigative report based on the latest clues from Reddit. Previously, a detailed long post on Reddit pointed out that a Discord user named "stayonthegrindd" might be linked to Cyberleek. Although the post was deleted by moderators, it was archived by many users. Combining the content of that post with Cyberleek's activity records on the blockchain, Vice Cit compiled a highly consistent timeline.
The investigation revealed that on August 16, Cyberleek shared what is believed to be a preview image of the GTA 6 map for the first time; the following day, Cyberleek uploaded the famous basketball gameplay clip to the dark web; in the early hours of August 18, a user named "Cyberleeker" appeared on the dark web forum Dread, posting the basketball video through multiple hosting sites.
About eight hours later, stayonthegrindd joined a GTA 6 Discord server. Within minutes, they posted and then deleted the same basketball video, claiming the footage was from 2026 and asking members what leaks they wanted to see. When someone replied "driving gameplay," they responded, "I'll bring back driving gameplay." While claiming the video was being compressed, they also offered to share the full map first. About an hour and a half later, the leaked map was uploaded to the blockchain; two hours after that, Cyberleek uploaded the first leaked GTA 6 video showcasing the character Jason driving to the blockchain.
Additionally, on August 18, a Discord user claimed to have received a private message from stayonthegrindd containing a clip of a black vehicle in GTA 6. The video was deleted before it finished playing—this clip is the leaked content later known as "Gas," which only spread on the blockchain on August 23.
Vice Cit noted that while it cannot be ruled out that stayonthegrindd simply found the basketball video on the dark web and reposted it, the subsequent timeline strongly suggests a direct connection to Cyberleek. "This person either possessed these materials themselves and deliberately chose channels capable of triggering viral spread, or is a friend of the leaker who had access to the content before it was uploaded to the blockchain." Vice Cit personally believes that, although there is no conclusive evidence yet, stayonthegrindd is likely Cyberleek themselves or a member of their group, calling it "a major operational security failure."
Reports indicate that copyright holder Take-Two, relevant law enforcement agencies, and legal teams may have already obtained information on this Discord user and have been investigating for several days. The key question now is whether this lead will ultimately point to the true source behind the hacking and leakage of over a dozen GTA 6 clips, or if it will become a dead end, allowing Cyberleek to evade investigation.