How Take-Two Is Trying to Unmask the GTA 6 Leakers

Take-Two Interactive has moved its response to the latest Grand Theft Auto VI leaks from platform takedown requests into federal court. The strongest public evidence concerns subpoenas filed against Microsoft and Discord on August 20 in the U.S. District Court for the Southern District of New York. Reports of a second wave aimed at X and Google/YouTube name several accounts, but those claims should be treated as provisional until the underlying filings or stronger independent reporting are available.

What Take-Two has filed so far

The confirmed legal action consists of separate DMCA subpoena petitions directed at Microsoft and Discord. Take-Two says the requests are intended to identify the person or people behind the online persona CyberLeek, which was associated with the circulation of leaked GTA VI gameplay material. 15923

A DMCA subpoena in this setting is not the same as a criminal charge. It is a court-backed request for records that may help a copyright holder identify an alleged infringer and preserve evidence. Take-Two’s filings reportedly state that purpose directly. 39

What information the Microsoft and Discord requests seek

The reported requests go well beyond asking for the real name behind a screen handle. Depending on the platform and account, the requested material reportedly includes:

• account-registration information;
• email addresses and phone numbers;
• registration and last-login IP addresses;
• account and server membership records;
• linked Xbox, Google or other Microsoft-connected accounts;
• device identifiers, including Microsoft machine and account identifiers; and
• records connected to Microsoft services such as OneDrive or an allegedly related GitHub repository. 291023

The Discord request reportedly covers multiple servers and accounts associated with the leak’s distribution. That makes the inquiry potentially broader than a single posting profile: membership, communications and linked-account records could help investigators compare activity across a wider group of participants. 29

Reports say Microsoft and Discord were asked to produce the requested information by September 4. 59

The reported X and Google subpoenas are less firmly established

A newer report says Take-Two has filed additional DMCA subpoena requests aimed at X and Google. The reported targets include the X accounts CyberLeeks and Surfer24k, the CyberLeek_ar_io account, and a specific YouTube upload. The requests reportedly seek identifying information such as email addresses, phone numbers and IP records. 22

That development would represent a logical expansion of the investigation: instead of focusing mainly on the services and communities through which the files were allegedly shared, Take-Two would also be pursuing the identities behind named public accounts and a particular video upload.

However, the available evidence for this second wave is weaker than for the Microsoft and Discord petitions. The accessible record supplied for this report does not include the underlying X or Google filings, and the report itself is not independently corroborated by a public docket in the available sources. The account names should therefore be understood as subpoena targets reported by one outlet—not as confirmed identities or proof that every named account belonged to the original leaker.

Why the leaks can continue despite subpoenas

The subpoenas are designed mainly to obtain information and preserve an investigative trail. They do not automatically block every future post, seize the alleged source build, or remove all copies from the internet.

Leak material can continue circulating through:

• reposts and mirrors;
• replacement accounts;
• private Discord servers and direct messages; and
• other platforms or file-hosting services outside the scope of an initial request.

The continued circulation of GTA VI footage during the first Microsoft and Discord legal actions is documented in contemporaneous reporting. 19 That does not mean the court process is ineffective; it means identification and production of platform records can take time, while online copies move faster than a single subpoena can reach them.

What role could a CyberLeek crypto trail play?

The supplied reporting does not reliably establish that a cryptocurrency token using the CyberLeek name was created or controlled by the person behind the leaks. It also does not authenticate a connection between a particular wallet, the social-media accounts and a KuCoin account.

If investigators could prove that connection, blockchain transactions might provide a timeline or identify wallets that interacted with known accounts. An exchange’s identity-verification records could potentially offer another lead. But neither possibility is enough on its own: a token name or wallet association is not proof of ownership, and obtaining private customer information would require appropriate legal process and corroborating evidence.

For now, the crypto and KuCoin claims remain unverified rather than an established breakthrough in the investigation.

Has Rockstar identified or charged anyone?

Public reporting supports the existence of a Take-Two and Rockstar effort to identify those responsible for the leaks. 110 But the available evidence does not confirm that Rockstar has publicly identified the individual or group behind the latest leak wave.

There is also no publicly announced criminal charge or arrest tied to this episode in the supplied sources. That distinction matters: a subpoena names accounts or seeks records connected to alleged infringement; it does not itself establish who operated an account, prove criminal conduct or determine liability.

What this means for the GTA VI schedule

There is no announced delay attributed to the leaks. GTA VI remains scheduled for November 19, 2026, on PlayStation 5 and Xbox Series X|S. 3039

Rockstar’s planned Grand Theft Auto VI: An Extended Look also remains scheduled to premiere on Netflix on August 27 at 3 p.m. ET. The presentation is expected to become available later that day through Rockstar’s YouTube channel and GTA VI website. 3031

The legal campaign may help Take-Two protect the planned marketing rollout and identify the source of unauthorized material, but the current public record does not show that it has changed either date. The clearest conclusion is narrower: Take-Two is escalating its effort to connect online aliases with real-world account and network records, while the identity of the leaker—and the significance of the reported X, Google and crypto leads—remains unresolved.