Take-Two went to federal court on Thursday to unmask the GTA 6 leaker, and the two subpoenas it filed read less like a scalpel and more like a dragnet. My problem isn’t that Rockstar’s parent company wants its leaker. It’s that the trail most likely to produce a name sits on a public blockchain, while the filings sweep up phone numbers from people who never posted a clip.
What the subpoenas actually demand
I pulled both petitions, filed in SDNY under DMCA Section 512(h) by Kirkland & Ellis. The Discord request is the one that should worry you. Take-Two wants identifying data for every member of three named servers going back to June 1. Not the leaker’s account. Every account.
That means registration emails, login IPs, phone numbers, linked Google and Xbox connections, device identifiers like MachineGuid and MSA, and OneDrive content referencing GTA or Rockstar. The named handles are CYBERLEEK, CINEMATICROCKSTAR, and Surfer24k. The servers are Ødyssey.gg, the “! Odyssey” guild, and discord.gg/darkviperau, labeled a “DarkViperAU editors’ server.”
Here’s the detail that made me sit up. The Microsoft petition demands all internal records tied to Microsoft’s own investigation of the cyberleek persona, with a GitHub DMCA notice attached as an exhibit. Microsoft was already investigating. That presupposed fact suggests the breach vector runs through Microsoft infrastructure, Xbox accounts, GitHub, or OneDrive, rather than a classic Rockstar-side hack. It’s the biggest unanswered question in these documents, and almost nobody is asking it.
Remember, these are ex parte identification subpoenas, not lawsuits. There’s no accused party and, as of Friday, no public confirmation either was approved or served. A lurker in one of those servers has essentially no standing to object before their data ships.
The blockchain named a wallet before the lawyers filed anything
The on-chain trail was public before the filings were. The $CYBERLEEK token was created on August 15, roughly seven hours and forty-seven minutes before the first clip appeared. One wallet funded the token, the leak site, and the publishing wallet. A GTAForums user posting as Vice Cit traced it to a KYC-verified KuCoin account in the Seychelles. The fans got there first, and the exchange already holds the leaker’s identity.
Every clip carries the same watermark: “HIGHER MARKET CAP = MORE LEEKS.” Seen against that timeline, this was never hacktivism. It’s a memecoin pump scheme wearing activist skin, with setup around $29,000 and claimed fees of $40,000 to $60,000, though my own check of the chain found no confirmed cash-out as of Thursday.
Then there’s the jurisdictional wall. The leak site runs on Arweave, the token lives on Solana, the exchange sits in the Seychelles. An SDNY subpoena binds US platforms, not that stack. Which is why I keep landing on the same conclusion: the Discord trail probably ends in a pile of lurkers, and the KuCoin file probably ends in a name.
The fog isn’t helping either. The main cyberleek X profiles look like impersonators, and a fake build torrent spreading on a Russian tracker is pure malware riding the hype.
DarkViperAU is the cautionary tale
Matthew Judge, the YouTuber behind DarkViperAU, found his community’s invite link named in a federal filing. His response was immediate. He knows nothing, the named server isn’t his editors’ Discord, no leak clips exist in his servers, and Rockstar hasn’t contacted him. Then he streamed for nearly three hours about it.
The beat that stuck with me came mid-stream, when he accidentally flashed a leaked screenshot and killed it fast because he didn’t want to get in trouble. Covering the leaks now carries legal exposure. That’s the chilling effect in action, and it lands on creators, not leakers.
None of this is new territory for Discord, either. Nintendo subpoenaed the platform over the Pokémon Teraleak in April, and Rockstar itself testified in a UK tribunal that it fired 30-plus employees over private Discord chatter about a secret 32-player online mode. The line between an employee channel and a fan server keeps getting thinner.
The corporate responses tell their own story. Xbox CTO Scott Van Vliet posted on the official Xbox account that his team is “working closely with Take-Two and Rockstar Games to support efforts to protect creative works and intellectual property.” Discord calls compliance with valid subpoenas standard and routine. Rockstar and Take-Two have said nothing, and the silence is doing work. When an account that reposted clips got locked within hours, the takedown became the only confirmation the footage is real.
Now comes the squeeze. The leaks are landing right before Rockstar’s exclusive Netflix extended look on August 27, with the November 19 launch still ahead. Microsoft and Discord owe production by September 4, and if either platform pushes back, the fight will be over that June 1 start date and the device telemetry, because both predate and outsize anything a leak ID needs.
My honest read: Take-Two knows the crypto trail leads to an exchange it can’t easily touch, so it’s squeezing the platforms it can, and the deterrence is aimed at everyone adjacent to leak culture. The uncomfortable takeaway is that you don’t need to leak anything to get swept up. You just need to have joined the wrong server before the wrong date. I broke down the August leak wave when it started, and nothing since has changed my mind about where this ends: not with a Discord export, but with a KYC file in the Seychelles.
