TL;DR:
The crypto wallet linked to the individual behind the massive 2022 GTA VI leaks recently recorded a significant movement of funds. The withdrawal, involving a sum of $350,000, was detected late last week and reignited interest in one of the video game industry’s most talked-about cyberattacks.
The GTA 6 hacker, responsible for the Cyberleek coin, has cashed out about $350k, entirely from LP fees. They have washed funds through a variety of OTC providers
This is the first hacker that I've ever seen make money solely on liquidity provision (versus dumping a token) https://t.co/5czgluVKBn pic.twitter.com/ABzjSjYAed
— Conor (@jconorgrogan) September 1, 2026
The alleged hacker, a British youth just 18 years old, was arrested and subsequently charged for his involvement in a series of intrusions into high-profile corporate systems. Rockstar Games was one of the affected companies, along with other technology and transportation firms. The youth was detained and placed in custody; however, the blockchain movements associated with his previous operations remain under close observation.
The financial activity in the wallet was initially reported by blockchain security analysts who identified the outgoing transaction. The investigators, who have been monitoring the addresses associated with the alleged cybercriminal since 2022, observed the movement of assets toward platforms that hinder the subsequent tracing of funds. This type of maneuver is common when attempting to liquidate assets that might be flagged or under surveillance by authorities and security firms.
The specific transaction involved the withdrawal of Bitcoin and other cryptocurrencies for a total value equivalent to the aforementioned $350,000. The timing of the withdrawal and the techniques used suggest, according to source interpretations, a deliberate attempt to move or “launder” funds that had remained dormant for a considerable period. This action has raised questions about who is currently controlling these addresses, given that the alleged mastermind of the GTA VI leaks is under the supervision of British authorities.
The original identification of the wallet as belonging to the hacker dates back to the days following the leak of the GTA VI development videos. At that time, the attacker allegedly attempted to blackmail Rockstar Games.
Presumably, the young hacker demanded a ransom in exchange for not publishing more sensitive material, including the game’s source code. During these interactions, several cryptocurrency addresses were exposed, allowing researchers to begin tracking them.
To date, the 2022 data leaks remain the most significant in the history of digital entertainment. Around a hundred videos and screenshots of an unofficial version of Grand Theft Auto VI were leaked. Forums and social media networks were flooded with details about the setting, protagonists, and gameplay mechanics of the Rockstar Games title—information that had been kept strictly secret. The company confirmed the authenticity of the material shortly after, describing the event as an illegal intrusion into its network.
The suspect, believed to be part of the Lapsus$ cybercriminal group, was captured in September 2022 following a joint investigation involving law enforcement agencies from multiple countries. Since then, he has faced legal proceedings on charges including unauthorized computer access, blackmail, and conspiracy. His trial has drawn significant attention due to his age and the scale of the damages attributed to his actions.
The new $350,000 movement creates fresh challenges for authorities aiming to recover the assets drained by the Lapsus$ criminal group. The pseudonymous nature of cryptocurrencies allows funds to be moved by other organization members or through automated mechanisms if private keys have not been secured, even with the primary suspects in custody. Continued monitoring of these addresses could shed light on support networks or operational structures that may still be active.
Authorities keep a close eye on this case, not only because of its impact on Rockstar Games and fans of the Grand Theft Auto franchise, but also due to the broader implications for corporate security and the use of intangible digital assets in the execution and post-management of high-impact cyberattacks.
