The CyberLeek group, behind a series of high-profile GTA 6 gameplay leaks, has ended its saga with a classic rug pull. My analysis of on-chain data shows that the attackers extracted approximately $286,000 from their own token, combining a direct dump with fee extraction. This is a rare case where hackers act not against a victim, but against their own community, leveraging the hype around one of the most anticipated games of the decade.
Anatomy of the Manipulation
The critical collapse of CYBERLEEK occurred on August 27 — just hours before the official gameplay showcase on Netflix. The coin, launched via PumpFun on Solana, had been actively promoted in viral leak videos since mid-August. The hackers embedded links to the token contract and donation addresses in the videos, which helped drive the market cap to a peak of $25 million amid the frenzy.
A key detail of the scheme was the burning of a reserve of 270 million CYBERLEEK (about $1.79 million at the time). This move was meant to convince the community of honest intentions. However, as it turned out, it was merely an element of psychological manipulation: all subsequent videos led to a website where token holders were asked to vote on new leaks, creating the illusion of decentralized governance.
Mechanics of the Dump
On-chain analysis conducted by independent researcher Vice Cit revealed the real picture. A wallet linked to CyberLeek accumulated $154,683 in wSOL and 15.4 million CYBERLEEK in the form of creator fees. Shortly before the Netflix premiere, the hackers converted the tokens into approximately $125,000, crashing the price by 40% within minutes. In total, the coin lost 90% of its value over several days — from $0.03 to $0.003.
The tracked funds were distributed among the exchanges KuCoin, CCE.Cash, and private wallets. However, Vice Cit rightly notes that not all of the group's addresses have likely been identified, and some funds may have been withdrawn in small transactions from unknown wallets.
Expert Assessment
In my view, CyberLeek did not operate according to the classic rug pull scheme, but rather a hybrid model: they bet on long-term fee collection, but the price drop and declining public interest forced them into an early exit. Panic notes in the latest videos confirm this hypothesis. The CYBERLEEK story is yet another reminder that meme tokens built on hype but without real utility are doomed to volatility, and their creators always hold an advantage over retail investors. Unlike the case of the Roaring Kitty account hack in May, here we observe not an external attack, but an internal insider dump, making this episode even more instructive for market participants.