Wallets linked to the CyberLeek operation generated approximately $350,000 from liquidity-provider fees surrounding the Solana-based CYBERLEEK token, according to on-chain researcher Conor Grogan. In a September 1 analysis, Grogan said the proceeds came entirely from LP fees rather than a conventional large-scale token sale. The structure turned trading activity generated around unauthorized Grand Theft Auto VI footage into a recurring fee stream for wallets supplying the token’s liquidity.
The connection between the token and the GTA VI publicity is independently documented outside crypto media. The Verge reported that an unidentified person or group using the CyberLeek name began distributing apparent GTA VI footage in August while promoting a related cryptocurrency. What remains unproven is the legal identity of whoever controlled the CyberLeek wallets or whether the same individual personally obtained the leaked material.
The GTA 6 hacker, responsible for the Cyberleek coin, has cashed out about $350k, entirely from LP fees. They have washed funds through a variety of OTC providers
This is the first hacker that I've ever seen make money solely on liquidity provision (versus dumping a token) https://t.co/5czgluVKBn pic.twitter.com/ABzjSjYAed
— Conor (@jconorgrogan) September 1, 2026
Liquidity Fees Turned Attention Into Revenue
CYBERLEEK was launched on Solana around August 15, shortly before the leaked footage began circulating widely. Instead of depending only on appreciation of the token itself, wallets associated with the project supplied liquidity and collected transaction fees as traders exchanged CYBERLEEK through decentralized pools. That model allowed rising speculative turnover to produce revenue repeatedly as long as trading remained active.
The mechanism differs from a simple launch-and-dump strategy. A liquidity provider can earn a portion of trading fees each time market participants swap against its position, potentially generating income without immediately selling the underlying token allocation. Grogan described the CyberLeek case as the first example he had personally observed of a suspected hacker monetizing an operation solely through liquidity provision. That characterization is Grogan’s interpretation of blockchain activity, not a finding from law enforcement or a court.
Earlier estimates of the operation’s proceeds were materially lower, with some market observers placing initial fee income around $40,000 to $60,000. Subsequent wallet analysis expanded the estimated amount to roughly $350,000 as additional fee withdrawals and transfers were identified. The evolving estimates illustrate how retrospective blockchain analysis can materially change the apparent economics of an event as more related addresses and transactions are mapped.
Attribution and Cash-Out Claims Remain Uncertain
Grogan said the funds subsequently moved through several over-the-counter providers. However, using OTC services does not itself prove money laundering or establish that the providers knowingly handled illicit proceeds. Public blockchain records can trace wallet movements and liquidity withdrawals, but identifying the people behind those addresses generally requires information unavailable from the ledger alone.
Take-Two Interactive has separately pursued legal efforts to identify those responsible for the GTA VI leaks. The Verge reported that the company sought records from Microsoft and Discord through DMCA subpoena proceedings. Those legal actions confirm an active investigation into the unauthorized footage, but they do not establish that the wallets analyzed by Grogan belong to any named individual.
A separate viral claim that streamer Adin Ross paid $350,000 for an early GTA VI build also remains unsupported by primary evidence. No public statement, livestream recording or transaction has independently established that purchase. That alleged payment should therefore remain separate from the approximately $350,000 in LP fees identified through on-chain analysis.
The CyberLeek episode ultimately shows how viral attention can be monetized through decentralized market infrastructure without requiring a straightforward token dump. The clearest evidence points to trading fees as the principal revenue mechanism, while the identity of the wallet controller and the complete off-chain cash-out path remain unresolved.
