FollowTheLeek
CyberLeek uses stolen Grand Theft Auto VI leaks as bait for a cryptocurrency it profits from. This investigation separates the quiet operation that holds the money from the loud persona wearing its name.
The setup was funded, through one wallet, from a KuCoin account, which is the identity lead. The token earns from locked-liquidity trading fees, not a dump. Every indicator is public and cryptographically hashed, so anyone can verify it.
hops from the funding wallet back to a KuCoin (KYC) account
dev tokens burned on-chain: he cannot dump them, and there is no lump cash-out
things wear the name: the money operation and a copycat
of indicators public, archived, and cryptographically hashed
Two thieves wear one name.
A hyped token pulls in thousands of traders and bots, and a loud account insists it is the only real one. Most of that is noise. The work is separating what the operator actually did from everything that only looks related, and here it splits cleanly in two: a quiet operation that holds the money, and a loud persona that does not connect to it on-chain.
Every finding here is passive open-source intelligence: public websites, the public blockchain, public posts, and public archives. Nothing was accessed without authorization.
How the money is made
- Locked-liquidity fees · the pool is locked and cannot be pulled; the operator earns the fee on every trade
- Drip-fed leaks · released slowly to keep the coin trading and the fees flowing
- Pay-to-vote polls · recycled wallets manufacture demand and stage the next drop
- 270M burned · dev tokens burned on-chain, so he cannot dump them; the profit is a trading-fee stream, not a pulled lump
The trail leads backward, to an exchange.
One wallet paid for the whole setup: the leak site’s name, the permanent Arweave uploads, and the token that holds the locked liquidity. Trace that wallet’s SOL back six hops and it comes out of a KuCoin account, an exchange that verifies a government ID. That account, not a bridge, is the identity lead. The funding trace was first published by GTAForums user Vice Cit and reproduced here independently.
Hover or tap any box. The money came from a KYC exchange, not out to a bridge. One wallet funded the site name, the permanent leak uploads, and the token, whose liquidity is locked and earns a trading fee on every trade. The 270M dev allocation was burned. The KuCoin account is the identity lead. The funding-to-KuCoin trace was first published by GTAForums user Vice Cit and reproduced here independently.
6 hops to KuCoin
locked LP · 270M burned
Hidden from the public, not from law enforcement.
The operation is deliberately layered so that no single lookup exposes the operator. That same layering is its weakness: every layer is run by a real company that keeps billing and account records. A shield that would have hidden the origin server was available and left switched off, so the host IP is exposed.
The leak videos are mirrored on a permanent decentralized network so they cannot be taken down. That copy is neutral, shared infrastructure, but the upload that paid for it leaves a wallet and a receipt on record, which is one strand of the funding trail.
The stack
- Origin server · rented US hosting, IP exposed (DNS left unproxied)
- Media host · a second rented server, hardened against direct access
- Permanent leak copy · an Arweave mirror paid for by a traceable wallet
- Two domains · the operation's cyber-leek.com, and the persona's now-dead cyberleeks.fun
The loud half, and why it is kept separate.
A Telegram and X account calls itself “The Only Real Cyberleek” and pushes a second token, launched on pump.fun, that went nowhere. This is where the human fingerprints are: the machine in the screenshots, an AI-generated profile picture, repeatable writing habits, a daily posting rhythm.
None of it connects on-chain to the KuCoin-funded money. Whether that is the same operator siloing the loud half, or a copycat riding the brand, no transaction links them. So this track is kept separate, and read as observations about a persona, not an identification of the money operator.
The persona's fingerprints
- Browser and account · OS, browser, and a signed-in account from their own screenshot
- Posting cadence · a repeatable active-and-quiet daily cycle, measured in UTC
- Writing style · consistent spelling and punctuation habits across channels
- AI-generated avatar · content credentials prove the profile picture is synthetic
Every claim is checkable by a stranger.
Passive only
Public websites, the public blockchain, public posts, and public archives. Nothing accessed without authorization.
Hashed and reproducible
Every artifact is SHA-256 hashed for chain of custody, and the on-chain trail can be re-pulled transaction by transaction.
Two tracks, kept apart
The money and the loud persona are documented as separate tracks. Nothing is attributed across them without a transaction to back it.
Read the full investigation.
The complete evidence, the funding trace to KuCoin, the infrastructure map, and the chain-of-custody hashes live in the public repository, maintained openly.