The GTA VI leak was a token launch. The bots took the money anyway.

01 — The order of eventsThe coin came before the leak

Read the timeline before anything else, because it settles what kind of event this was.

The group did not hide this. Its manifesto, published on that site and quoted at length by Kotaku and Forbes, spends most of its length on three "commandments" about digital preorders, locked single-player content and offline fallback states, and then makes the ask directly: "To fight this war, CYBERLEEK is raising funds for a secret project. The specifics cannot be revealed yet... Let it be absolutely clear: this is not a cash grab."

Press coverage read it the same way. Kotaku reported the manifesto and the funding pitch on August 18. PCMag asked whether the leaker was a vigilante or a crypto scammer. Polygon noted every clip carried the watermark. And Stop Killing Games, the digital-rights campaign whose demands overlap with Cyberleek's, publicly disowned the group on August 19 for "using the leak to promote a meme coin," with its director general, Moritz Katzner, telling supporters plainly: "Do not send these people your money."

Two things about that text matter for this investigation. First, it ties the funding ask to the same page as the commandments, so the token was framed as the campaign's treasury from the start. Second, the demands overlap closely with those of Stop Killing Games, which is why that organization felt it had to disown the group publicly rather than let the association stand.

So the question of whether someone squatted a lucky name is closed. Whoever registered the domain on August 14 and minted the token on August 15 knew what was coming on August 18, because they were the ones bringing it.

02 — The pumpWhat the leak did to the price

At 17:00 UTC on August 18 the hourly candle opened at $0.0000519 and closed at $0.000685, a 13x move in sixty minutes on $1.47M of volume. The next hour ran from $0.000684 to a high of $0.00348 on $5.47M traded, the largest single hour the token would ever print. By 23:00 the fully diluted valuation had touched $3.3M, sixty times where it sat two days earlier.

Volume spiked again at 01:00 UTC on August 19 ($1.4M) and at 14:00 ($1.04M), matching the follow-up drops. By the morning of August 21 hourly volume was back under $30,000 and the valuation was chopping around $1.3M. Over seven days the main pool turned over $22.7M across 163,014 trades and 16,182 distinct wallets.

Four copycat mints with the same ticker also launched and did real volume: 7cTj9kKPwDskZfnQfdYxrEe1osGSxNHnvh4jWysgzyCd ($713,000), AKEB7SwHKs3EmSHipWkcwnh6YgDjNbwuixwwDgBgw8EB ($422,000), DCHKemF4rpVvS5FGCzs7YSWQUcApjJJHpTVdXujDpump ($297,000) and BM2a4nXYH8nxqX1iifn5y3ipFJRSzZ4pYN3HJHasTz6w ($200,000). The total retail money that chased this name is larger than any one chart shows. This article sticks to the main pool.

03 — The winnersFive wallets, six minutes

We ranked every trader of the token over the five days ending August 21 by realized profit, meaning USD sold minus USD bought. Each trade is valued at the more conservative of its two legs, so a thin pool with a manipulated quote cannot inflate anyone's number. The top five:

Look at the first-trade column. The token had been tradable for 68 hours. All five of these wallets made their first purchase inside a window that opened at 17:48:26 and closed at 17:54:02. The hourly candle that contained them was the 13x candle. By the time the second, bigger candle was printing and the token was showing up on screeners and in Telegram groups, these five were already selling into it.

The second thing to notice is the buy sizes. kai5bkDZS9jvapW5bWopzKDHJVagamTxZbAn4u4r5Ya put in $2,771 and took out $37,428. HmBPYtybyKVuWALbJSJ9yRawL85Scc9Vo3ycmP8mXois put in $4,688 across nine trades and was out with $29,759 before 19:00. Those are the returns you get from being first, and only from being first.

We ran all five, plus every wallet we found upstream of them (sixteen addresses in total), through the label directory in Bitquery MCP. None carry a label. No exchange deposit tag, no known entity, no scam flag. That is a meaningful negative. It means what follows is behavioral, and it also means nobody here was operating from an address anyone had already named.

There was one group further down the ranking that looked worse than the top five. Three wallets, 2CRyKAMiJwscv3oQw467MAHnR6cczrjfwnGJ9Qx2WRJ1, 4FMCwgZwNhv5S1SBaMbk5ZkPArXx2bNuoMLA9tUGmepE and FiN6YjR6Q1ovRhUHJsGW2VuLKWgqgQ59Yr3ck6pU7jbm, showed $62,000 of CYBERLEEK sold and zero bought. A wallet that sells tokens it never purchased is the signature of a deployer allocation, so we opened their transactions. They are arbitrage bots. At 17:54 UTC on August 18, six minutes into the pump, someone opened a second CYBERLEEK pool on Meteora, CMLqxbQU7CDKqzWPpAbKTgiQKuPV1tzYZNLyDjr1BwZz. From then on these wallets ran atomic loops between the Raydium vault and the Meteora pool: buy on one, sell on the other, route the SOL through USDC and a third token, all inside a single transaction. Their buys were signed by a sibling wallet, 8KQN4cPUiHC1LAuVPjjk7oEoTvCPw1knTSUmsLTMGBKR, so the index booked the buy to one address and the sell to another. The Meteora pool did $1.14M in volume in three days, nearly all of it this kind of flow. There was no allocation and no deployer behind these three, only plumbing.

04 — Cluster AOne person, four wallets, and a 51-minute head start

kai5bkDZS9jvapW5bWopzKDHJVagamTxZbAn4u4r5Ya is the most interesting of the five, because of how it got its money.

At 16:57:27 UTC on August 18, in a single second, three wallets each sent it SOL: 24.19 SOL from AsaBY8hPfVFVoCHJWi2tJVGag2d1njxcqR6D245MMu5a, 26.96 SOL from D9hVUnaGFqPAtjj22rhczCpYRn6EpAq1xpioGspRYWMz, and 17.85 SOL from K3gmTmQo6UM26JoKekrB3BwEFHUL1cXwV46wzUgpKzL. That is 69 SOL, about $10,000, consolidated 51 minutes before the token moved.

Three unrelated people do not send money to the same wallet in the same second. So we looked at where those three had been getting their SOL. The answer was kai5bkDZS9jvapW5bWopzKDHJVagamTxZbAn4u4r5Ya itself.

That pattern has one explanation. A script controls all four keys, spreads SOL across them so it can trade from several addresses at once, and pulls the balance back into one wallet when it wants to concentrate on a single position. The profile of the main wallet fits: 14,983 inbound transfers, 51,648 outbound, against 2,435 distinct senders and 2,964 distinct receivers. A human does not touch three thousand counterparties. A launch-sniping bot does, every week.

Two of the sub-wallets, and the main wallet itself, also show recurring SOL inflows from AxiomRXZAq1Jgjj9pHmNqVP7Lhu67wLXZJZbaK87TTSk, which is the router address for the Axiom trading terminal. So this operator executes through Axiom and runs its own wallet rotation on top.

We wanted to know what the wallet did with the 51 minutes between pooling its SOL and buying CYBERLEEK, because a bot that consolidates and then waits is a bot that might have been told something. It did not wait. Between 16:57 and 17:48 it traded in bursts across other tokens and pools: 25 trades at 17:07 and 17:08, 37 trades between 17:25 and 17:27. It made 432 trades on August 18 and 621 on August 19. CYBERLEEK was one position among dozens that day, entered with $2,107 at 17:48 and already being sold at 17:49. The pooling was treasury management for a machine that sprays every launch it sees, and this was the one that hit.

05 — Cluster BThe terminal users

The biggest single winner, tAg2tgyHmkGTsmq8wBSKsGvUUgoH37cxmCfRUZSXdtB, is a different animal. It made 713 trades in the token and was still net selling on August 21. Its SOL arrives in a steady drip from the same Axiom router: 3.14 SOL at 09:46, 5.62 at 11:35, 8.76 at 13:21, 7.36 at 15:32, and three more top-ups between 15:52 and 16:50, all on August 18, all before the move. Those are swap proceeds being routed back from other trades. This wallet was active in other tokens all day and simply added CYBERLEEK to the list at 17:48:26.

It also has its own satellite. 7wqrdPuxA6cYWtmWVmEyWBWQFAmBFhUUdEAom6dqxL3p sent it 16.47 SOL at 08:05 on August 18. Going back a step, 7wqrdPuxA6cYWtmWVmEyWBWQFAmBFhUUdEAom6dqxL3p had received four transfers from tAg2tgyHmkGTsmq8wBSKsGvUUgoH37cxmCfRUZSXdtB on August 16 and 17 (8.51, 5.77, 7.00 and 9.64 SOL), plus a single 62.82 SOL deposit on August 15 from 7eTU6LbY43xXyK9oCX7uMbTLmotRvud5TQjRqrBHrEL, a wallet with 43,084 outbound transfers to 3,872 receivers. That looks like a payout or distribution service. We did not trace it further.

HmBPYtybyKVuWALbJSJ9yRawL85Scc9Vo3ycmP8mXois is the cleanest case in the whole set. It received 1.06 SOL from the Axiom router at 17:25:19, bought at 17:54:02, and was fully out by 18:59:39 with $25,072 of profit on nine trades. Sixty-five minutes, one position, and the wallet went quiet.

06 — Cluster CThe whale who withdrew two weeks early

71CBfHX36b2wNjeBui59UDwzFWW6SMemHWWzTBWSxy4t is the outlier. No bot signature, no sub-wallets, 25 trades total. Its funding is a single transaction: exactly 1,000 SOL, roughly $150,000 at the time, received on August 4 at 09:18:31 UTC from 6LY1JzAFVZsP2a2xKrtU6znQMQ5h4i7tocWdgrkZzkzF.

That sender has made 5,290,849 outbound transfers to 504,181 distinct addresses and received 2,134,065 from 377,418. Only an exchange's withdrawal wallet moves money to half a million different people. It carries no label in our directory, so we cannot tell you which exchange. The shape is not ambiguous.

So the read on this one is simple. Someone with size withdrew a round number from a centralized exchange on August 4, sat on it for two weeks, and bought CYBERLEEK at 17:50:43 on August 18, two minutes and seventeen seconds after the first bot. They spent $9,673, sold $34,652, and were out by 19:23. The August 4 date predates the token, the leaks, and the hacker's public name. Nothing links this wallet to the deployer or to the other four. It is a fast, well-capitalized discretionary trader, and it was still slower than the machines.

07 — The pictureThe operation manufactured the pump. Bots took it.

There are two separate findings here and it matters that they stay separate.

The first is that the pump was manufactured. The domain, the token, the manifesto and the QR-coded footage are one operation, built in that order, and the group said so itself. Anyone who bought CYBERLEEK because the leaks felt organic was buying a launch that had been staged four days earlier.

The second is that the staging did not pay the stagers, at least not through the wallets that made the most money. None of the five winners trace to the deployer. The whale's money came from an exchange before the token existed. The bot cluster's money came from itself. The terminal wallets' money came from other trades earlier the same day. Whatever the operation collected, it collected somewhere we cannot see from the top of the trading book.

That gap is the useful part. A group spent four days building a narrative designed to move a token, and within the first six minutes the proceeds were being harvested by wallets that had never heard of Cyberleek and did not need to. Those wallets were positioned to buy whatever moved. They were in and mostly out while the story was still being written up, and the wallets that looked like they had been handed free supply turned out to be arbitrage bots working a second pool that opened six minutes into the run. Event coins are a latency market. The narrative decides which token moves; the fill decides who gets paid, and retail is never first on either.

The leak was written to sell a token. It sold it to 16,182 wallets, and to none of the five that made the money.

Bitquery Research

08 — SourcesOff-chain sources

Everything about wallets, trades, pools and transfers in this article is on-chain data queried through Bitquery MCP. The timeline of the operation itself relies on the following public records, all checked on August 21, 2026. This article does not link to the group's website, to any mirror of it, or to any leaked footage; the domain name is not printed in resolvable form; only its registration date and price, which are the evidence.

09 — Still openThreads we did not pull