GTA 6 Leaks Exploited in Millions-Dollar Crypto Pump-and-Dump Scam

Cybersecurity researchers have uncovered a sophisticated fraudulent scheme involving the exploitation of leaked Grand Theft Auto 6 (GTA 6) footage to facilitate a cryptocurrency pump-and-dump operation. A hacker collective identified as CyberLeek reportedly utilized stolen assets to launch a thematic token, artificially inflating its market capitalization to attract unsuspecting investors before liquidating their holdings. This incident highlights the growing trend of cybercriminals leveraging high-profile entertainment leaks to orchestrate blockchain-based financial fraud.

Mechanism of the Cyberleek Token Manipulation

The fraudulent activity began after the CyberLeek group leaked two confidential files and subsequently sold them on dark web marketplaces. Following the acquisition of these files by third parties, multiple domain names were registered, and a digital asset named Cyberleek was deployed on the market. To create the illusion of organic growth and high liquidity, the organizers employed approximately 20 coordinated accounts. Over a three-day period, these addresses performed repetitive purchases of similar volumes, successfully driving the token's market value into the millions of dollars.

A pump-and-dump scheme involves artificially inflating the price of an asset through false or misleading statements and coordinated buying, followed by the original holders selling their positions at the peak.

Manipulated Voting and Social Engineering

To further engage the community and sustain the token's momentum, the hackers implemented a deceptive social engineering tactic. They established a public poll where users could vote to decide which leaked GTA 6 content would be released next. However, participation was gated behind the requirement to purchase the Cyberleek token to cast a vote. Investigation into the poll results revealed clear signs of automation and fraud:

• Only one specific option received approximately 200 votes.
• All other voting options remained at zero, indicating a lack of genuine user participation.
• The results were likely artificially manipulated to drive token demand without the intent of releasing further content.

Geographic Tracking and Final Outcome

Security analysts investigating the digital footprint of the attackers suggest that the initial hackers responsible for the breach may be located in northern Germany. While the source of the leak has been narrowed down, the subsequent parties involved in the execution of the token scam remain under scrutiny. Once the token's price reached an optimal level, the organizers executed a mass sell-off, cashing out their profits and leaving retail investors with devalued assets that possessed no utility or underlying value.

The intersection of gaming industry security breaches and decentralized finance (DeFi) exploits continues to present significant risks to the crypto community. Experts advise market participants to exercise extreme caution regarding tokens launched in the wake of high-profile corporate leaks or celebrity-themed trends, as these are frequently used as fronts for illicit financial schemes. As of August 2026, investigations into the movement of the stolen funds across various blockchain networks are ongoing.