A follow-up: the Cyberleek deployer tried to vanish. The money and the clock didn't.

Part I of this investigation: The GTA VI Leak Was a Token Launch. The Bots Took the Money Anyway →

01 — The deployerThe wallet that launched the coin

Everything in the first article happened downstream of one address. Hok9nbV89yBSKCttxe3goqajwbiqQa9mtHvQBsbJH3Np is the wallet that created the CYBERLEEK mint on August 15, seeded the Raydium pool that afternoon, and has sat at the center of the operation ever since. It is the fee payer on the oldest transaction that touches the token, roughly seven hours before the first trade.

The deployer was fed by a single wallet, Ec2qmcpCCD9hjahAcquiQf5JkZWCK68BUahCje1izYC7, with the profile of a purpose-built funnel: 57 inbound transfers from 21 different wallets, and only two outbound transfers, both to the deployer. It sent the deployer 10 SOL at 14:07 UTC, thirteen minutes before the mint, then 311.42 SOL at 20:47, twenty minutes before the pool went live. The round "330 SOL" the launch was advertised with is those two transfers plus change.

The deployer was not careful after launch, either. On-chain trails surfaced by traders show the same wallet funding the deployers of further tokens — two pump.fun mints via MDBLoJyK6WuymugTKojo9Sg3K3ap9e6xR1jFrjYQo4j and a coin called "Rockstar Gays" via FYzoZbGvPsHqXSe8czHgpJPiHXnFUBXoX1z8EBQKSEpA. An operator claiming to be unfindable kept reusing the one wallet that ties those projects together.

02 — A → FSix hops, one exchange, nineteen hours of patience

We walked the funnel upstream, one hop at a time, and the money resolves into a clean chain. Below the funnel sit roughly six feeder wallets that cross-funded each other on August 13–15. Above them, a single thread runs up through a set of relay wallets to a high-volume hub and, community sleuths say, to a centralized exchange. We label the wallets A through F to keep the chain readable; the full addresses are in the table.

Two community investigators had reached parts of this independently, and the useful finding is that their two traces are the same chain. A GTAForums user, Vice Cit, published a route running KuCoin → FWbi → J4zo → 26sZ → EjsB → 2ZdU → funding, with amounts we reproduced hop for hop: 156 SOL into EjsB, 10 then 146 SOL out of it, the forward into the feeder. Separately, an OSINT analyst flagged BS9f2jetmcwafD2AVrZMvdSf5qrsNNqdgVRifsRHWhci as a service wallet that had also received proceeds from a June 24 phishing theft. That wallet turns out to fund E97saCE…, which funds the same hub J4zo…. One trace approached from the exchange side, the other from the phishing side, and they meet at the hub.

We ran all fifteen wallets in the chain through the label directory in Bitquery MCP. None carry a label: no exchange tag, no known entity, no scam flag. Two limits on that. We reproduced the middle of the chain and the phishing-wallet junction ourselves, but the KuCoin terminus carries no label in the directory, because Solana exchange coverage is sparse. So "traces to KuCoin" is corroborated up to the hub and rests from there on Vice Cit's exchange-side evidence rather than ours. And an unlabeled wallet on Solana means "not labeled," not "clean."

03 — The decoysEvery hop was booby-trapped

Following this chain by hand is harder than it should be, because someone salted it with decoys. The technique is called address poisoning, and it works by exploiting one habit every analyst and every wallet user has: nobody reads a full Solana address. A real address is 44 characters of case-sensitive base58, so explorers, wallets and tools all show it truncated — the first four characters, an ellipsis, the last four. 2ZdUUvrr…vJhD. You recognize a wallet by those eight characters and trust the middle.

The attacker weaponizes that. Using a vanity-address generator, they grind out a brand-new keypair whose address happens to start and end with the same characters as a wallet you actually transact with. Then they send a near-zero "dust" transfer, a fraction of a cent, from that look-alike into the target wallet. The fake address now sits in the target's transaction history, one line away from the real counterparty and near-identical in truncated form. The next time anyone copies "the address this wallet sent to" out of that history, whether an analyst tracing funds or the wallet owner paying the same person again, there is a real chance they copy the decoy.

These are the real wallets in our chain, next to the decoys dusted in to impersonate them, with the truncated form each one displays as:

Read the truncated forms in the sub-lines and the problem is obvious. The real hop E reads 2ZdU…vJhD; its decoys read 2ZdU…CJhD and 2Z13…PJhD — one matches the first four characters exactly, both match the last three. The real hop A reads BS9f…Whci; one decoy reads BS9F…Whci, differing only by the case of a single letter and reproducing the last four exactly. The feeder 2Kxn…1woZ is shadowed by 2Kx6…1woZ, again an identical tail. In a truncated display these pairs are visually interchangeable, and case-flipped characters are the hardest of all to catch by eye. An investigator scrolling the transfer list, or a script keying on prefix-and-suffix, can lift the wrong wallet and follow a dead branch that goes nowhere — while the real trail sits right beside it.

The timing shows this was botted, not hand-planted. The dust lands seconds to minutes after each genuine transfer — six seconds behind the June reservoir move, one to two minutes behind the August hops — and it reacted separately to the 10 SOL test and the 146 SOL commit, which means a watcher was triggering on the target wallet's activity in real time. Every burst uses the same template: a 0.00001 paired with a 0.000001, fired from two vanity addresses at once. And it is two-sided — into hop D the decoys imitate hop E, into hop E they imitate hop D — so whichever direction a tracer copies from, a look-alike is waiting.

Address-poisoning bots spray high-value wallets across Solana indiscriminately, so the presence of decoys does not by itself prove the operator ran the poisoner. What it does prove is that these specific hops were live, high-value targets being watched in real time, and that anyone tracing this chain by eye, as the community has been doing, was being actively misled. The effect on an investigation is the same whether the trap was deliberate or ambient: verify every address in full, never by its first and last four.

04 — The clockThe one thing they could not launder

Start with the wallets, not the social account, because the chain has a clock of its own.

Every transaction in this investigation carries a timestamp, and once you line them up, the operation only ever moves during one stretch of the day. The June reservoir transfer landed at 15:03 UTC. The August 13 layering ran 09:23 to 18:50. On launch day the seed hit at 14:07, the mint at 14:20, the 27% allocation split at 14:30, feeder consolidation between 14:22 and 16:41, the main funding at 20:47, and the pool went live at 21:07. Eleven timestamped actions across three separate days, and every one of them falls between 09:23 and 21:07 UTC. Not a single hop, mint or pool action lands between 02:00 and 08:00.

That window is the deployer's working day, derived from nothing but the chain. It is a small sample and we would not hang a conclusion on it alone. What makes it worth reporting is that a completely separate data source produces the same window.

The group's leak account posts exclusively from one device, "Twitter for Android" on every single post, and across 40 posts the hour-of-day pattern is a clean human rhythm.

A silent block from 02:00 to 08:00 UTC, a first post around 09:00, and the heaviest activity in the late evening map to Central European time, UTC+1 or +2. Under summer time (UTC+2) the operator is asleep 04:00 to 10:00 local and posting hardest through the evening, an ordinary schedule. Push the same pattern to US Eastern and the "sleep" block lands mid-evening with a hard-posting overnight, which no ordinary rhythm fits.

Now put the two clocks side by side. The wallet chain operates 09:23 to 21:07 UTC and goes dark 02:00 to 08:00. The leak account posts 09:00 to 01:00 UTC and goes dark 02:00 to 08:00. The dead zone is identical, and the account's evening tail simply runs later than the money does, which is what you would expect from someone who stops moving funds before they stop posting.

We cannot prove from the chain that the account holder and the deployer are the same person, and we are not asserting it. Two things are true and worth stating separately. The deployer's own transaction history, on its own, describes an operator working Central European hours. The leak account, on its own, describes the same. Whether that is one person or a coordinated group, the operation runs on a Central European clock.

The signal is independent of everything else in this article. It comes only from timestamps, and it lands in the same place as separate claims circulating in German-language threads: that the operator is based in Germany, runs Hetzner hosting, is roughly 33 to 35, and left older blog posts and IP addresses behind. Two unrelated methods pointing at Central Europe is worth more than either alone. The account itself was created on July 22, three weeks before the domain went up, which pushes the preparation timeline back further than our first article could show.

05 — The pictureWhat the operation could not hide

Read together, the money and the clock describe an operator who worked hard at anonymity and left three anchors anyway.

We are deliberately not naming anyone. The German origin, the age range and the prior-identity claims are community allegations we have not verified, and this article does not publish a person, a face or a real name. What we have verified is narrower and more useful: the launch money was layered through a six-hop chain that two independent traces tie to a KYC exchange and a phishing-linked service, the chain was actively booby-trapped against anyone following it, and the operator's own account keeps a Central-European clock. The layering and the decoys defend against manual tracing; they do not touch a KYC record, a reused wallet, or a sleep schedule.

06 — SourcesOff-chain sources

Everything about wallets, transfers and timing is on-chain data queried through Bitquery MCP. The community traces, the exchange claim and the identity chatter are public records, listed below and checked on August 24, 2026. As in Part I, this article does not link to the group's website, to any mirror of it, or to any leaked footage; the domain is not printed in resolvable form.

07 — Still openThreads we did not pull