FollowTheLeek: a GTA VI leak-coin, traced on-chain to a KYC account
Setup funding followed six hops to a KuCoin account. The fee model, the infrastructure, every indicator hashed and public.
On-chain · Fraud · Infrastructure
Key findings
- One wallet funded the whole setup. Six hops back, it comes out of a KuCoin account, where a government ID is on file.
- The token earns from locked-liquidity trading fees, not a dump. 270M dev tokens were burned on-chain. The profit is the fee on every trade.
- On 2026-08-27 the operator claimed about $270,000 in fees and moved it through four fresh wallets. About half went back to the same KuCoin account.
- A loud “only real Cyberleek” persona and a second token share the name. No transaction links them to the money. We keep the two apart.
What CyberLeek is
CyberLeek drips stolen Grand Theft Auto VI footage to keep a cryptocurrency trading. The leaks are the bait. The fees are the business. Thousands of traders and bots piled in, and a loud account kept insisting it was the only real one. Most of that is noise. The work was separating what the operator did from everything that only looks related.
How the money is made
- Locked-liquidity fees · the pool is locked and cannot be pulled; the operator earns the fee on every trade
- Drip-fed leaks · released slowly to keep the coin trading and the fees flowing
- Pay-to-vote polls · recycled wallets manufacture demand and stage the next drop
- 270M burned · dev tokens burned on-chain, so he cannot dump them; the profit is the trading fee, later claimed and cashed out
The funding trail
One wallet paid for the setup: the leak site’s domain, the permanent Arweave uploads, and the token that holds the locked liquidity. We traced that wallet’s SOL back six hops to a KuCoin account. KuCoin checks a government ID, so the trail ends at a name on file, not at a mixer or a bridge. The trace was first published on GTAForums by Vice Cit. We re-pulled every hop ourselves.
Hover or tap any box. We traced the money back to a KYC exchange that has a real ID on file, not forward into a mixer or bridge where the trail would dead-end. One wallet funded the site name, the permanent leak uploads, and the token, whose liquidity is locked and earns a trading fee on every trade. The 270M dev allocation was burned. The KuCoin account is where a real name is on file. We first saw the funding-to-KuCoin trace from GTAForums user Vice Cit and re-pulled it ourselves.
6 hops to KuCoin
locked LP · 270M burned
The cash-out
On 2026-08-27 we watched the fees come out. The creator claimed the locked-pool fees, swapped 15.49M CYBERLEEK to SOL, and moved 2,705 SOL through four fresh wallets. About half went back to KuCoin, the exchange that funded the setup. The rest went to CCE.Cash, which takes no ID. The hub in the middle looked like a dead end. It loops back to KuCoin too.
At that day’s SOL price, about $270,000 in fees, roughly $241,000 net of the ~$29,000 setup. That setup capital was locked into the pool upfront and is unrecoverable. This was a funded operation, not a zero-budget grab.
Hover or tap any box. We followed the profit out. On 2026-08-27 the creator claimed the locked-pool fees, swapped them to SOL, and split 2,705 SOL: about 51% back to KuCoin (the KYC exchange that funded the setup) and about 49% to the no-KYC CCE.Cash. The hub that looks like a dead end feeds straight back into KuCoin, so the exchange sits on both ends of the money. First flagged by GTAForums user Vice Cit (Part 4); full split reproduced on our own node.
~51% to KuCoin · both ends
~49% to CCE.Cash · no-KYC
The infrastructure
Layered, so no single lookup exposes the operator. The layering cuts both ways: every layer is run by a company that keeps billing and account records. The proxy that would have hidden the origin server was available and left off, so the host IP is visible.
The leak videos sit on Arweave, so nobody can pull them down. The upload that paid for that copy left a wallet and a receipt. That is one of the strands in the funding trail.
The stack
- Origin server · rented US hosting, IP exposed (DNS left unproxied)
- Media host · a second rented server, hardened against direct access
- Permanent leak copy · an Arweave mirror paid for by a traceable wallet
- Two domains · the operation's cyber-leek.com, and the persona's now-dead cyberleeks.fun
The persona
A Telegram and X account calling itself “The Only Real Cyberleek” pushes a second token, launched on pump.fun, that went nowhere. This is where the human fingerprints are: the machine in the screenshots, an AI-generated profile picture, repeatable writing habits, a daily posting rhythm.
None of it connects on-chain to the KuCoin-funded money. It could be the same operator on the side, or a copycat using the brand. No transaction links them, so we read it as notes on a persona, not an identification of the operator.
The persona's fingerprints
- Browser and account · OS, browser, and a signed-in account from their own screenshot
- Posting cadence · a repeatable active-and-quiet daily cycle, measured in UTC
- Writing style · consistent spelling and punctuation habits across channels
- AI-generated avatar · content credentials prove the profile picture is synthetic
Timeline
The money moved first. The KuCoin account funded the wallet, the token was minted and its dev supply burned, and the leaks were running on the dark web and Arweave before any clearnet site existed. Then cyber-leek.com was registered through Cloudflare on Aug 22 and first seen serving Aug 24. The copycat spun up Aug 25 on a different registrar. Every point is anchored to an on-chain, registrar, or certificate record.
- Aug 13the money
KuCoin funds the chain
SOL leaves a KuCoin (KYC) account and reaches the funding wallet 3YLN in six hops.
- Aug 14the money
Arweave leak name registered
The ArNS name for the permaweb leak distribution (cyber-leek.ar.io). The leaks live on Arweave, not on any clearnet site yet.
- Aug 15the money
$CYBERLEEK minted; leaks on Arweave
The token is minted (14:20 UTC) and liquidity locked. The leaks first appeared on the dark-web forum Dread, then were mirrored to Arweave from here (first upload Aug 15), a week before any clearnet site existed. Dread origin per Vice Cit.
- Aug 18the money
Launch front-run
As the leak clips spread, four wallets buy $CYBERLEEK in a roughly six-minute window (17:48 to 17:54 UTC); none trace to the deployer. On a full pull they are automated sniper bots that buy whatever moves, consistent with Bitquery, so the launch was sniped by bots, not tipped. Verified on our own pull.
- Aug 22the money
270M burned; domain registered
270M dev tokens burned (18:27 UTC), and cyber-leek.com is registered through Cloudflare (06:36 UTC). This is the clearnet front's real registration date.
- Aug 24the money
cyber-leek.com first seen live
First proof the clearnet site was serving: the first Let's Encrypt cert and the earliest archive snapshot (14:20 UTC). The domain was registered Aug 22, so it went live somewhere in the Aug 22 to 24 window; the exact moment is not independently recorded.
- Aug 25the persona
Copycat spins up
pump.fun copycat token minted (06:33 UTC), cyberleeks.fun registered through Hostinger (12:11 UTC), and @cyberleeksreal starts posting (07:08 UTC). A different registrar from the operation.
- Aug 27the money
Fees claimed and cashed out
The creator wallet claims the locked-LP trading fees, swaps 15.49M $CYBERLEEK to SOL, and splits 2,705 SOL across two exchanges (07:27 to 14:05 UTC): about 51% back to KuCoin deposit addresses (including a leg laundered through a hub) and 49% to the no-KYC swap service CCE.Cash. KuCoin sits on both the funding and the larger half of the cash-out. First flagged by Vice Cit (Part 4), full split reproduced on our own pull.
Hover or tap any point. We pieced this together from hard records only. The money was funded from a KuCoin account, the token built and burn-signalled over roughly ten days, and the launch front-run by snipers on Aug 18. The site’s leaks ran on the dark web and Arweave from Aug 15; cyber-leek.com was registered through Cloudflare on Aug 22 and first seen serving Aug 24; and the copycat spun up Aug 25 on a different registrar. On Aug 27 we watched the operator claim the trading fees and cash out, splitting the SOL back to KuCoin and the no-KYC CCE.Cash. Every point is a hard on-chain block time, a registrar record, or a certificate record.
Method
Passive only: public websites, the public blockchain, public posts, public archives. Nothing accessed without authorization. Every artifact is SHA-256 hashed for chain of custody, and the on-chain trail can be re-pulled transaction by transaction. The money and the persona are documented as separate tracks, and nothing is attributed across them without a transaction to back it.
Why it matters
Leaked material becomes a revenue engine within days. If your IP leaks, assume someone will build a business on it, and that the business will be loud. Commodity infrastructure is layered, not anonymous: each layer is a company with records, and the exchange that checks an ID is the chokepoint. And the loudest account is usually not the one holding the money. Attribution discipline is the whole job.
Evidence
The full investigation is public: the funding trace, the infrastructure map, and the chain-of-custody hashes. github.com/deepwoodssec/FollowTheLeek