For a week the GTA 6 leaker known as Cyberleek has operated with no name attached to it. That changed slightly on August 25, when a GTA Forums user posting as Vice Cit published a forensic timeline arguing that a Discord account called stayonthegrindd is either Cyberleek, a member of the group, or someone with direct access to the material before it went public.
Read the next sentence before anything else: nobody has been identified, charged or arrested, and no publisher, platform or law enforcement agency has confirmed any name. This is community analysis of public timestamps, reported by Kotaku on August 25. It is interesting. It is not a conclusion.
The Timeline as Reported
Vice Cit's report, built from a lengthy Reddit post that moderators deleted shortly after it appeared, lines up Discord timestamps against uploads to the blockchain storage the leaker uses. As reported by Kotaku, the sequence runs like this:
| When | What reportedly happened |
|---|---|
| August 16 | Cyberleek shares a sneak peek of what is believed to be the Leonida map |
| August 17 | The basketball clip is uploaded to the dark web |
| August 18, early | An account called "Cyberleeker" posts the basketball footage on Dread, a dark web forum |
| August 18, ~8 hours later | stayonthegrindd joins a GTA 6 Discord server |
| Minutes later | They post, then delete, the same basketball footage, claiming it is from 2026 |
| Then | They ask the server what leaked gameplay people want next. Someone answers "driving." The reply: "I will be back with driving gameplay" |
| Same conversation | They offer the full map while the video is supposedly compressing |
| ~90 minutes later | The map is uploaded to the blockchain |
| ~2 hours after that | The first driving clip is uploaded to the blockchain by Cyberleek |
There is one more strand. A Discord user reportedly says stayonthegrindd sent them a direct message containing the opening of a clip involving a black car, which was deleted before they could finish watching. That clip is said to be the "Gas" footage, which did not surface publicly until August 23, five days later.
Why That Ordering Matters
The load-bearing detail is not that stayonthegrindd had the basketball clip. Anyone could have pulled that from Dread once it was posted.
The problem is everything after. Taking requests for footage that has not been published, then delivering that exact footage hours later, is not something a re-poster can do. Neither is privately circulating a clip five days before it appears anywhere else.
Vice Cit's own framing, quoted by Kotaku, keeps both doors open: "This person either had this material and was trying to get this whole thing to blow up by posting it in a place they knew would spread the leaks like wildfire, or this person is a friend of the person who has this leaked material and was able to see the leaks before they ever got uploaded." Their personal read, explicitly labelled as opinion without concrete proof, is that stayonthegrindd is Cyberleek or part of the group, and that this was "a huge opsec misstep."
How Much Weight This Can Carry
Some, but less than the headlines suggest. A few honest limits:
- It is circumstantial. Timing correlation is evidence, not identification. It narrows a field; it does not name a person.
- The primary source was deleted. The original Reddit post came down quickly. Everything downstream works from copies.
- Nobody has verified the account. Vice Cit is an anonymous forum user who says they studied digital forensics. The work looks careful and the community rates it highly, but that is not the same as an audited chain of custody.
- A leak account is not a legal identity. Even if stayonthegrindd is connected, that is a username, not a person, until a platform ties it to a subscriber record.
What it does establish is that a paper trail exists, which is the theme of this entire campaign. The same conclusion falls out of the KuCoin trail, where the operation's own crypto monetisation appears to lead back to an exchange that requires identity documents.
Where the Official Process Actually Sits
Community sleuthing is running well ahead of anything on the record, and the two should not be confused.
Take-Two's real instrument is the set of subpoena requests filed August 20 in the Southern District of New York, seeking records from Microsoft and identifying information from Discord for accounts in the servers used to spread the material, with a reported response deadline of September 4. Coverage indicates the requested fields include account IDs, emails, IP addresses, phone numbers and linked accounts. Our breakdown is in the subpoena explainer and the widening picture is in the X subpoena piece.
As Vice Cit noted in a follow up, if a forum user could find a transaction trail in a few hours, Rockstar's team very likely had it on day one. That is probably the fairest summary of the whole situation: the public is watching a version of an investigation that professionals started a week ago.
Rockstar has still said nothing. There has been no public statement of any kind since August 6.
Frequently Asked Questions
Has Cyberleek been identified?
No. As of August 25, 2026 no identity has been confirmed by any company, platform or authority. A community report names a Discord account as a likely link, which is not the same thing.
Who is Vice Cit?
An anonymous GTA Forums user who has been publishing forensic analysis of the leak campaign and says they studied digital forensics at college. Their work has been cited by Kotaku and Dexerto.
Could this be a false accusation?
Yes, and that risk is real. Community investigations have misidentified people before, sometimes with serious consequences. Treat a username as a lead, not a verdict, and do not go looking for a person behind it.
Does this affect the August 27 Extended Look?
No. Rockstar's Extended Look premieres on Netflix at 3:00 p.m. ET on Thursday, August 27 and goes free on YouTube and the Grand Theft Auto VI site at 9:00 p.m. ET. Release remains November 19, 2026.
The Bottom Line
The interesting thing about the stayonthegrindd timeline is not the name. It is the demonstration that this campaign has been leaving timestamps everywhere: on Discord, on Dread, on a blockchain and on a crypto exchange. An operation built around watermarks, QR codes and paid polls is an operation optimised for attention, and attention is the opposite of anonymity.