Hacker leaks GTA 6: the story of the attack and what we know in 2026
New videos indicate that Cyberleek had access to a playable version of GTA 6. Look back at the 2022 attack, understand Take-Two's reaction, and find out why there's still no proof that the full game has been released.
By Ederson Andrade · August 29, 2026 · 9 min read
Illustrative art: TecEdi.
A new wave of leaks has putGrand Theft Auto VIagain at the center of a security crisis. Since August 18, a person or group using the nameCyberleekpublishes unauthorized videos that appear to show the game in operation, as well as images attributed to Leonida's map.
In direct terms,GTA 6 content has been leaked and is circulating on the internet. One of the recordings indicates that the person in charge had access to a playable version, or at least a portion of it, because the player interacts with the scenario and writes "LEEK" on a wall using gunshots. This is different from just getting videos recorded by someone else.
But there is an essential distinction:There is no reliable confirmation that the full game has been published for download. Files promising a "leaked build" have appeared on websites and torrents, but experts warn that these offers could be scams or malware. TecEdi does not reproduce the stolen material and does not provide links to unauthorized copies.
The first official trailer was published by Rockstar in December 2023.
The story began in September 2022
The first major leak happened inSeptember 18, 2022. An account called "teapotuberhacker" posted on GTAForums about 90 videos of an early version of the next Grand Theft Auto. The material totaled approximately 50 minutes and showed development systems, incomplete animations, character tests and scenarios that would later be associated with Vice City.
The next day, Rockstar confirmed that it had suffered a network hack. In a statement to the market, Take-Two reported that an unauthorized third party accessed and downloaded sensitive information, including footage of the early development of the next GTA. The company said that the services continued to work and that it did not expect a long-term effect on the game's schedule.
At the time, the attacker also claimed to have source code and other internal files. This threat generated headlines saying that "the game had been leaked", but what was proven to be distributed to the public were the development videos. There was no confirmation that a complete and usable version of GTA 6 had been released in 2022.
Vice City in official image of GTA 6. Credit: Rockstar Games.
Who was blamed for the 2022 attack
British investigations linked the episode toArion Kurtaj, a member of the group Lapsus$. The case gained attention because Kurtaj was reportedly able to break into companies again even after the seizure of his equipment. Reports about the trial pointed out that he used a phone, a hotel television and an Amazon Fire TV Stick device while under police protection in a hotel.
In December 2023, the City of London Police reported that a jury found that Kurtaj had committed several crimes of computer misuse, fraud, and blackmail. As he had been deemed unable to participate in a conventional trial at that time, he was granted an indefinite restraining hospital order.
An update published in July 2026, based on information from the BBC's cybersecurity correspondent Joe Tidy, stated that Kurtaj has left the hospital safe, has been transferred to a regular prison and is awaiting a new trial scheduled for November. This is a separate situation from the current wave of leaks.
Cyberleek and the new wave of 2026
The current episode began inAugust 18, 2026. Cyberleek has gone on to release short videos that appear to show Jason, one of the protagonists, in common situations in the game. The recordings attributed to the leak include character interactions, combat, direction, flight, and parts of the interface.
One of the videos drew attention because the player controls the action and leaves the word "LEEK" marked on the stage. For specialized outlets such as PC Gamer and TechSpot, this is a strong sign that Cyberleek has or had access toA playable build, even though it may only be a part of the game. There is also the possibility that an employee or collaborator has recorded the content for the person responsible for the publications.
There are clues that the material did not come from the same old 2022 version. One of the recordings includes a song released in January 2025, which suggests a more recent compilation. Even so, internal versions are incomplete and may contain elements that will be modified or removed before release.
So far,there is no public proof that Cyberleek is Arion Kurtaj, nor that the two episodes have the same origin. Cyberleek remains unconfirmed.
The second official trailer combines cutscenes and gameplay snippets captured on PlayStation 5.
After all, did the hacker leak the entire GTA 6?
The most responsible answer depends on the meaning of "leaked the game":
Yes, real or seemingly authentic material from the game has been leaked.Unpublished videos and information attributed to the map are available on different platforms, despite the removals.
There are strong signs of access to a playable version.The direct interaction shown in the videos makes it less likely that the person in charge will only have a folder with old recordings.
It is not confirmed that the full game has been distributed.No reliable source has demonstrated that a full, installable, and functional build has been released to the public.
It is not confirmed that the current source code has been exposed.Allegations and threats are not a substitute for verifiable evidence.
Therefore, to say thatGTA 6 suffered a serious leakIt's correct. To say that anyone can already download and play the full version would be to go beyond what the evidence allows.
The stated motivation and promotion of cryptocurrency
Cyberleek claims to protest against practices considered anti-consumer, especially the advance sale of digital editions without a physical alternative. The speech also addresses game preservation, ownership of digital licenses, and server closures.
At the same time, the person in charge linked the choice of new leaks to the promotion of a cryptocurrency. Users were encouraged to buy the asset to vote for the next content. This mix between overt activism, intellectual property leakage, and financial interest requires caution. The existence of a manifesto does not prove the identity of the attacker or make the distribution of stolen material legitimate.
Take-Two's reaction
Rockstar and Take-Two haven't publicly confirmed every detail of the 2026 videos, but copyright takedown requests have taken down several posts. This response reinforced the perception of authenticity, although an isolated removal is not a technical validation of every shared file.
The most concrete measure came through the courts. InAugust 20, 2026, Take-Two has filed subpoena requests based on U.S. copyright law to obtain data from Microsoft and Discord that could identify Cyberleek and people related to the case.
The court documents request records such as email addresses, registration and last access IPs, phone numbers, connected accounts, device identifiers, and certain content stored on OneDrive. The companies were given the deadline indicated in the documents to submit the information. This shows that the publisher has started a legal and technical search for the person responsible, not just a campaign to remove the videos.
What the videos seem to reveal
The reports describe scenes with chases, combat, flight and exploration of the open world. Claims have also emerged about vehicle fueling, a dialogue system and an image of Leonida's map. These elements should be treated as provisional.
A development build can bring together tests, incomplete features, and configurations that will never make it to the final product. Compressed videos, out-of-context cuts, and AI-generated imitations make verification even more difficult. The absence of official confirmation means that specific details should not be presented as definitive features of GTA 6.
Lucia Caminos in official image of GTA 6. Credit: Rockstar Games.
Beware of fake downloads
The biggest immediate risk to the public is not receiving a spoiler, but installing a malicious file. The search for "leaked GTA 6" is already used to spread fake downloads. An unknown executable can steal passwords, cryptocurrency wallets, browser cookies, and personal data.
Do not download supposed builds, do not disable antivirus and do not run files received by Telegram, Discord, torrents or unknown websites.There is also no reason to buy a cryptocurrency to follow the story. Legitimate information can be verified in official statements and news outlets without installing anything.
What we know so far
Until August 23, 2026, the table is as follows:
Rockstar suffered a confirmed attack in 2022, when dozens of development videos were published.
Arion Kurtaj has been held legally responsible for a series of crimes linked to Lapsus$ and, according to a recent update, is awaiting a new trial.
Cyberleek began a new sequence of leaks in August 2026 and has not had his identity confirmed.
The current videos indicate access to a playable version or a working part of the game.
There is no confirmation that the full GTA 6 or its current source code has been made available for download.
Take-Two is trying to identify the person responsible through subpoenas addressed to Microsoft and Discord.
Downloads that promise the game before release should be considered dangerous.
The case is still ongoing. New videos, court decisions or an official statement from Rockstar can change what we know. Until then, the best way to follow the story is to separate what was demonstrated from what was just promised by an anonymous person.
Related Product
Transparency: some links may earn TecEdi a commission at no extra cost to you.