CyberLeek is an active operation that uses stolen Grand Theft Auto VI material (Rockstar Games' unreleased IP) as bait for a cryptocurrency it profits from. This is an open, evidence-backed investigation. Every indicator here is public, verifiable, and cryptographically hashed, so researchers, defenders, exchanges, and platforms can identify the operation and act on it.

Maintained by Deep Woods Security.

A note on signal and noise

A case like this is mostly noise, and that is the whole difficulty. A hyped token pulls in thousands of traders, bots, and arbitrage wallets. A loud social account insists it is "the only real one." A large number sitting on a block explorer looks like a smoking gun. None of that, on its own, is the operator. The work is not finding data, there is far too much of it. The work is separating the signal, what the operator actually did, from everything that only looks related.

The method here is deliberately conservative. Start from what cannot be faked: who paid to register the site, who signed the file uploads, who created the token. Follow the funding, because money has to come from somewhere, and that somewhere tends to be a door. Claim only what a specific transaction proves, not who traded the most or who posts the loudest. When two things share a name, treat them as different until a transaction says otherwise.

A tale of two thieves

There are two separate things carrying the CyberLeek name, and on-chain they do not connect:

• The operation (the money). The leak site cyber-leek.com, the Arweave-hosted leak distribution, and a live token whose entire setup was funded, through one wallet, from a KuCoin account. It is quiet, has no confirmed social presence, and makes money from trading fees on locked liquidity. This is the real one, and the KuCoin account behind it is the identity lead.
• The persona (the copycat). A loud Telegram and X account (@cyberleeksreal, "The Only Real Cyberleek"), the cyberleeks.fun domain, and a pump.fun token that stalled and went nowhere. This is where the human fingerprints are (an AI-generated profile picture, a writing style, a daily posting rhythm), but no transaction ties any of it to the money.

Whether these are two people, or one operator keeping the loud half walled off from the paying half, the chain does not link them. So this investigation keeps them apart, and labels which track each finding belongs to.

The two tracks

Track 1 - the operation (the money)

• crypto/ - the funding traced back to KuCoin, the locked-liquidity fee model, and the 270M dev-token burn
• infrastructure/ - hosting, DNS, media delivery, and the Arweave leak distribution behind cyber-leek.com (also maps the persona's dead cyberleeks.fun domain)

Track 2 - the persona (the copycat)

• posting-pattern/ - the Telegram and pump-wallet activity rhythm, and how well they match
• writing-style/ - language and writing-style markers
• browser/ - the persona's browser fingerprint, from their own cyberleeks.fun screenshot
• pfp-metadata/ - the AI-generated profile picture and its C2PA / Grok content-credential provenance

Evidence integrity (chain of custody)

Every artifact cited in this repo is hashed and timestamped so anyone can confirm it has not been altered since collection:

• SHA256 of each source artifact is recorded in EVIDENCE.md.
• UTC capture time is recorded next to each hash.
• archive.ph snapshots provide an independent, third-party timestamp for the live pages and posts.
• The crypto trail is reproducible from raw transactions; the on-chain evidence package verifies against its own SHA256 manifest.

Raw sensitive material (for example the leaked frames) is not published here. Its hash and archive link are enough to prove it existed and is unchanged, without redistributing it.

Deliberately not here

• No leaked media. The stolen frames are not redistributed.
• No personal-identity attribution. This documents the operation, not a named individual. We make no claim about whether the money operation and the social persona are the same actor, whether either is one person or a group, or where they are located. Those determinations are left to law enforcement. "Operator" and "persona" are neutral shorthand.

Contributing

PRs welcome if verifiable from public sources. Cite every indicator with a block-explorer link, an archive.ph snapshot, or a transaction hash, and include the artifact's SHA256. No PII, no leaked media, no accusations against named people.

Credit

The funding-to-KuCoin trace in crypto/ was first published by GTAForums user Vice Cit and reproduced here independently.

Victims

Report to https://www.ic3.gov with your transaction hashes, wallet addresses, and timestamps.