FollowTheLeek
CyberLeek is an active cryptocurrency fraud that uses stolen Grand Theft Auto VI material as bait, drives victims into a token it controls, then moves the proceeds off-chain and hides behind AI-generated branding.
This is a public, evidence-backed field investigation. The money is traced on the blockchain, the infrastructure is mapped end to end, and every indicator is archived and cryptographically hashed so anyone can verify it independently.
in proceeds traced on-chain to the bridge
revenue mechanisms: token dump, pay-to-vote polls, paid access
layers of the operation documented end to end
of indicators public, archived, and hashed
A scam built on stolen intellectual property.
The operator stands up a website on rented US servers and drives traffic to it with paid ads and stolen GTA VI leak clips. Those clips funnel victims into a cryptocurrency token created for free. The operator hypes it, lets real buyers pour money into the trading pool, then sells the free tokens on top of them and bridges the proceeds off Solana toward a trading platform.
Every finding here comes from passive open-source intelligence: public websites, the public blockchain, public social posts, and public archives. No system was accessed without authorization.
Three ways it takes money
- The rug pull · free tokens sold into the pool of real buyers, then dumped
- Pay-to-vote polls · victims send tokens to operator wallets to “vote” on the next leak
- Paid access · advance-fee tiers from $499 to $29,999 for fake GTA 6 access
Follow the money off Solana.
The on-chain tell is unmistakable: wallets that sold a large amount of the token while having bought none of it. That is only possible if the tokens were handed over for free at creation. These wallets funneled the proceeds through a single pass-through relay and across a bridge off Solana. Roughly 4,186 SOL (about $439,000) moved through this one path, and the relay reconciles to the lamport: the money in equals the money out.
Hover or tap any box to read its role. Line thickness tracks the amount that moved. One dump wallet (7sg) sold the free token allocation for SOL; a feeder and a funder carried the rest. All three funnel into a single relay, which reconciles to the lamport, and across the bridge off Solana. A second dump wallet, EfV, sold separately and is traced on its own. Past the bridge the public record stops and the trail continues only in the bridge’s and platform’s private books.
~4,186 SOL · ~$439K
in = out at the relay
Hidden from the public, not from a subpoena.
The operation is deliberately layered so that no single lookup exposes the operator. That same layering is its weakness: every layer is run by a real company that keeps billing and account records. A shield that would have hidden the origin server was available and left switched off, so the host IP is exposed.
The leak videos are also mirrored on a decentralized network so they cannot be taken down. That copy is neutral, shared infrastructure, not the operator’s, but the upload that paid for it leaves a wallet and a receipt on record.
The stack
- Origin server · rented US hosting, IP exposed (DNS left unproxied)
- Media host · a second rented server, hardened against direct access
- Paid traffic · an ad account with a billing identity on record
- Decentralized backup · permanent video copy paid for by a traceable wallet
He tried to stay anonymous. He left fingerprints.
The operator posted screenshots taken on his own machine, which give away the computer he works on and the signed-in account behind it. His activity times form a consistent daily rhythm, and his writing carries repeatable habits that tie his separate accounts to a single author. Even the profile picture is AI-generated, so the persona itself is fabricated.
Individually these are common. Together they form a behavioral fingerprint that correlates the accounts and points records requests at the right companies. They are documented as observations, not a public identification of a person.
Documented fingerprints
- Browser and account · OS, browser, and a signed-in account tied to his sessions
- Posting cadence · a repeatable active-and-quiet daily cycle, measured in UTC
- Writing style · consistent spelling and punctuation habits across channels
- AI-generated avatar · content credentials prove the profile picture is synthetic
Every claim is checkable by a stranger.
Passive only
Public websites, the public blockchain, public posts, and public archives. Nothing accessed without authorization.
Hashed and archived
Every artifact is timestamped and SHA-256 hashed for chain of custody, with archived copies of the source pages.
Reproducible
The money trail can be regenerated from published commands, so anyone can arrive at the same numbers.
Read the full investigation.
The complete evidence, the on-chain trail, the infrastructure map, and the chain-of-custody hashes live in the public repository. It is maintained openly and updated as the story develops.