Cyberleek has opened a « contact » tab on its site. The group behind the GTA 6 video leaks now offers advertising space on its own leak videos. The manifesto and the cryptocurrency token that came with these leaks have already made the news. The entry price, though, has just appeared: 400 XMR, the Monero cryptocurrency, roughly $165,000 at the exchange rate of late August 2026.
This sum buys no placement. It only guarantees contact within 24 hours, through an encrypted messaging app, to open a negotiation. The actual prices, terms and deliverables are then discussed in private, far from any public price list.
Three things make this worth a closer look. It reveals a carefully built technical setup, a legal timeline closing in on Cyberleek, and one simple question nobody can answer today: who would pay to negotiate with a group of hackers, and on what guarantee.
Cyberleek sets up its ad shop
The offer fits in a few lines. Cyberleek talks about « premium advertising space » and « exclusive content opportunities » on its videos. Two formats are offered: a watermark, a discreet brand overlaid on the image, or gameplay sequences custom-built around a specific product.
Advertisers face almost no restrictions. The group states it will promote pretty much anything, gambling and adult content included. Funding, meanwhile, would come from « community support » and « strategic partnerships », far from the classic ransom demand tied to this kind of operation.
| What the 400 XMR covers | What they don’t cover |
|---|---|
| Guaranteed contact within 24 hours via Session | An actual advertising placement |
| The opening of a private negotiation | A price, duration or format fixed in advance |
| Direct access to the group | A guarantee that the deal will be honored |
GamesRadar sums up the move in one line. Ashley Bardhan calls it « a bold response to Take-Two’s subpoenas », an inflated response to Take-Two’s legal filings. PC Gamer goes further on the amount: Andy Chalk titles it « The GTA 6 leaker is selling ads now », with this deck: « For $165,000, you too can ask Cyberleek about promoting your product on his videos ».
Twelve decimals that give Cyberleek away
The contact mechanism was dissected by Aurea (@AureaLibe) on X. The site first generates a Session account, an end-to-end encrypted, anonymous and decentralized messaging app, with a unique recovery phrase. It then produces a donation amount in Monero, a cryptocurrency whose chain stays private: unlike Bitcoin, Ethereum or Solana, transaction amounts remain invisible on it.
Twelve digits after the decimal point hold the trick. They’re generated at the same time as the Session account and serve as a unique identifier. When the buyer sends exactly that amount, the system detects the transaction on the chain, extracts the decimals, recalculates the matching Session identifier, and triggers contact.
The calculation is purely cryptographic and runs client-side, on the buyer’s device, without going through a central server. Since Monero hides the amounts, only the recipient can recover the identifier hidden in the transaction. One practical consequence follows: the funds must be sent from a personal wallet, an app installed on one’s own device that leaves full control over its keys, never from an exchange, a centralized service that would round off the decimals and make contact impossible. Aurea cites Cake Wallet and Feather as valid options.
Aurea’s verdict is blunt: « I went and looked at Cyberleek’s site, and this is clearly not an amateur » (translated from French). Then: « I’m convinced this isn’t a single person, but indeed a group of hackers » (translated from French).
Rockstar has been drawing this kind of adversary for a while. The studio had already suffered a massive breach, 78 million records exposed, claimed by another group with no established link to this one. The common thread is the method: operations built to last, not one-off hits.
Take-Two targets Microsoft and Discord
Take-Two filed two requests before a federal court in New York on August 20, 2026. A subpoena is a legal procedure that forces a company to hand over information under threat of sanctions. The first targets Microsoft and demands internal investigation records on the « cyberleek » username, GitHub, OneDrive and linked Xbox accounts included.
The second, addressed to Discord, is broader. Take-Two is demanding the identification information for every account that is a member of the servers involved in spreading the leaks between June 1, 2026 and today: IP addresses, phone numbers, linked Google and Xbox accounts, device identifiers, Microsoft telemetry, OneDrive files. Both companies have until September 4 to respond.
The scale of the request shows the size of the investigation. Take-Two isn’t after one account, it’s raking through three months of activity across entire servers, hoping a single member left a usable IP address or phone number. This is the usual method against an adversary who leaves no direct trace, and it relies on human error, not a technical flaw. Both exist: a flaw at LiteLLM was enough to expose 2,500 companies in forty minutes, without a single human making a mistake.
Xbox’s chief technology officer confirmed working closely with Take-Two and Rockstar Games to support intellectual property protection efforts. Variety revealed these two requests on August 21, written by Jennifer Maas.
A timeline that raises questions
One of Cyberleek’s sites, hosted on Ar.io, a network presented as a permanent, decentralized cloud, has also stopped working. As of August 22, the page returns a single line: « requested content blocked by this node’s content policy ».
The block is justified by a copyright infringement claim, tied to GTA 6 content hosted on this site between August 18 and 21. Three events therefore overlap within a handful of days: the opening of the ad shop, the filing of the two subpoenas, and the shutdown of one of the group’s access points.
Rockstar’s next appointment falls just days after this bout of legal pressure: the Extended Look premiering on Netflix on August 27. No public trace shows that any buyer has paid their 400 XMR, nor that Cyberleek would honor its side of the deal if someone did. A brand negotiating with a group targeted by two federal subpoenas would take a risk whose scale nobody can measure for now.
0 Commentaires
Aucun commentaire pour le moment. Soyez le premier à commenter !