Since August 18, a person or group going by Cyberleek has been leaking gameplay clips online of the upcoming Grand Theft Auto 6. And it seems the ongoing hunt by cybersleuths online to figure out, unmask, or track down the individual or individuals behind the GTA 6 leaks is making some progress, with a new Discord user now labeled a top suspect.
On August 25, GTA Forums user Vice Cit, who has become well-known in the community in recent days for their digital forensic investigation into Cyberleek, posted a new report based on recently revealed evidence shared on Reddit. The original Reddit thread, which suggested a Discord user named “stayonthegrindd” might be connected to Cyberleek, was deleted on Tuesday by mods shortly after it was posted. But the internet never forgets, and people shared and saved the original, lengthy Reddit post; after digging into the details in that post as well as Cyberleek’s blockchain activity, Vice Cit has compiled some damning evidence.
In the report, Vice Cit lays out a timeline of events, using Cyberleek’s blockchain activity and Discord timestamps. On August 16, Cyberleek shared a sneak peek of what is believed to be the GTA 6 map. The following day, Cyberleek uploaded the infamous basketball gameplay clip to the dark web. Early in the morning on August 18, a user on Dread (a Reddit-like forum on the dark web) named “Cyberleeker” shared that basketball footage using a few hosting sites.
Then, about eight hours later, stayonthegrindd entered a GTA 6 Discord server. A few minutes later, they posted and then deleted the same GTA 6 basketball footage. The user claimed it was from 2026, then asked the server what leaked gameplay they want to see next; someone replied “driving,” and stayonthegrindd responded, “I will be back with driving gameplay.” But stayonthegrindd also said that in the meantime, while the video was allegedly compressing, they could quickly share the full map. About an hour and a half later, the leaked map is uploaded to the blockchain. Two hours after that, the first GTA 6 leak video showing Jason driving was uploaded to the blockchain by Cyberleek.
Finally, a Discord user claimed on August 18 to have seen the start of a GTA 6 gameplay clip involving a black car. They claim this video was sent to them via a DM from stayonthegrindd, but the video was deleted before they could watch all of it. This would end up being the “Gas” gameplay clip, which wasn’t uploaded to the blockchain and spread around until days later, on August 23.
Do we know who Cyberleek is?
So what does this all mean? Well, as explained by Vice Cit, the timeline is damning. While it is possible that stayonthegrindd simply found the basketball leak footage on the dark web and shared it on Discord, the rest of the timeline seems to imply that stayonthegrindd has some connection to Cyberleek.
“This person either had this material and was trying to get this whole thing to blow up by posting it in a place they knew would spread the leaks like wildfire,” speculated Vice Crit, “or this person is a friend of the person who has this leaked material and was able to see the leaks before they ever got uploaded onto Arweave. Either way, I truly do believe this is a huge leap in this case, and Take Two most likely already had this information days ago. If I had to give my personal opinion, even though there is not concrete proof yet, I do believe stayonthegrindd is CyberLeek (or at least a member of the group), and I think this was a huge opsec misstep.”
I agree with this assessment by Vice Cit, who claims to have studied digital forensics while in college. The timeline presented by the Reddit post and investigated by Vice Cit seems to lay out a clear case that stayonthegrindd is either Cyberleek themselves, a member of the group, or a person connected to the group. It just seems they had knowledge of and access to some of the leaked clips and map images before anyone else, and the timing for when they posted in Discord and when the GTA 6 content got uploaded to the blockchain by Cyberleek seems too coincidental to ignore.
At this point, I have to assume Take-Two, the authorities, and the company’s lawyers are fully aware of this Discord user and their seeming connection to Cyberleek, and have likely already been investigating them for at least a few days now. The question is whether this leads them to the hacker/leaker responsible for over a dozen GTA 6 leaks or if it’s a dead end and Cyberleek is able to avoid getting caught.
