Most retellings of the GTA 6 leak describe a hack that a cryptocurrency later attached itself to. On-chain records say the order was the other way around, and once you see the sequence it is hard to read the campaign any other way.
Blockchain analytics firm Bitquery published an investigation on August 21 built entirely from public Solana and Arweave records. Its finding is a timeline, and the timeline is the argument.
The Four Days Before Anything Leaked
| Date and time (UTC) | Event |
|---|---|
| August 14, 18:30 | An Arweave name matching the group's later branding is permanently purchased for 13,878 ARIO |
| August 15, 21:07 | The Solana token first trades against SOL, at a fully diluted valuation near $55,000 |
| August 16, 00:24 | Two accounts post the contract address on X. Both go almost unnoticed |
| August 16 to 18 | Sixty eight hours of nothing. Hourly volume between $4 and $2,500 |
| August 18, ~17:00 | The first GTA 6 footage and the map appear, watermarked and carrying QR codes for the site and the coin |
The domain was bought four days before a single frame leaked. The token had been tradable for nearly three days and was, by Bitquery's description, effectively dead: a valuation drifting between $55,000 and $77,000 on almost no volume.
Then the footage dropped and the 17:00 hourly candle ran 13x on $1.47 million of volume. The following hour traded $5.47 million, the largest single hour the token would ever print. By late that evening the valuation had touched $3.3 million, roughly sixty times where it sat two days earlier.
Bitquery's summary is blunt: on the chain, the leak reads as a marketing event for a token that already existed.
The Group Did Not Really Hide It
This is not a hostile inference imposed from outside. The manifesto published alongside the first clips makes the funding request directly, in text quoted by Kotaku, GamesRadar and Forbes: "To fight this war, CYBERLEEK is raising funds for a secret project. The specifics cannot be revealed yet... Let it be absolutely clear: this is not a cash grab."
Placing a fundraising ask on the same page as the political demands ties the two together by design. It also explains why the digital rights campaign Stop Killing Games moved so fast to disown the operation on August 19, with its director general Moritz Katzner telling supporters plainly: "Do not send these people your money." Our coverage of that split is in the Stop Killing Games piece.
Every clip since has carried the watermark and the codes. Polygon noted it at the time. PCMag framed the open question as vigilante or crypto scammer. By this week, Kotaku was describing the campaign as something that increasingly seems to be a big crypto scam, and GameSpot had used the phrase pump and dump.
What the Ordering Does and Does Not Prove
It is worth being precise, because two separate claims get blurred constantly.
What it supports: the infrastructure was staged before the leak, so the release was planned as a promotional event with a financial instrument attached. Bitquery puts it as the question of whether someone squatted a lucky name being closed: whoever registered the domain on August 14 and minted the token on August 15 knew what was coming.
What it does not touch: whether the footage is real. It is. Bloomberg's Jason Schreier reported that Rockstar sources confirmed the original clips were genuine, while stressing they were early and unfinished. The monetisation sits on top of authentic material; it does not replace it.
What it also does not prove: that the same individuals performed every step. Bitquery says so explicitly in its own disclaimer. A sequence of public timestamps establishes order, not identity.
Why the Distinction Matters for Readers
If you treat the clips as an organic leak, the natural response is excitement and trust. If you treat them as advertising for a token, the natural response is to enjoy the footage while ignoring everything printed on top of it.
The second posture is the correct one. The clips are genuine material from an internal build dated somewhere between 2023 and 2025. The watermarks, QR codes, polls, countdown teasers and market cap milestones layered over them are a sales funnel. Our full catalogue of what the footage actually claims is in what the leaks showed, and the deeper wallet analysis is in who took the money.
Never buy the token, never scan the codes, never pay for promised builds. This is reporting, not financial advice.
Frequently Asked Questions
Does this mean the leaked footage is fake?
No. The footage is widely treated as genuine, and Rockstar sources reportedly confirmed the original clips were real while noting they were early and unfinished. The token analysis is about motive and staging, not authenticity.
How much money did the token raise?
Reported figures vary and move constantly. Bitquery recorded $22.7 million of turnover in the main pool across 163,014 trades and 16,182 distinct wallets over seven days. That is trading volume, not operator profit, and the two are very different numbers.
Who verified the timeline?
Bitquery, a blockchain data company, using public Solana and Arweave records, with on-chain figures verified as of August 21, 2026. The off-chain events are sourced to contemporaneous reporting from Kotaku, Polygon, GamesRadar and Forbes.
Is Rockstar commenting on any of this?
No. Rockstar has made no public statement of any kind since August 6, 2026. Its only visible actions have been DMCA takedowns and the August 20 subpoena requests.
The Bottom Line
A domain on the 14th, a token on the 15th, silence until the 18th, then footage carrying QR codes for both. That sequence does not tell you whether the leaker believes their own manifesto. It does tell you that the leak had a business plan before it had an audience, which is the single most useful thing to remember every time a new clip appears.
Sources: Bitquery on-chain investigation, Kotaku, Forbes