Three days before the leak, the token already existed
A manifesto against the industry, a leak that held the world's attention, and, in every video, a QR code to buy the coin named after the manifesto. The order of events — all of it public — is what reveals the pattern: the token came before the cause.

▸In this article
The night of August 15, 2026: a token named after nobody gets its first trading pair on a decentralized exchange on the Solana network. August 18: clips from a game half the world is waiting for surface online carrying that name as a watermark and a QR code in the corner. August 19: the trade press is already asking whether the leak is the product or the advertisement.
Three dates, all of them a matter of public record, and the question answers itself.
This newsroom has written about the company's response to that leak and promised to return to the pattern left out of that piece: a cause dressed up as a manifesto, a coin named after the cause, urgency to buy, and attention-grabbing content doing the work of advertising. This article is about the pattern. The persona behind the leak is a pseudonym, no one has been identified, and nothing here attributes any wallet, token, or leak to any individual.
The packaging: what the manifesto says
The document accompanying the videos — which the persona itself calls an "Edict" — flies three flags. Against digital pre-orders, on the grounds that pre-ordering was born of physical disc scarcity and makes no sense for a download. Against selling campaign content separately when it already ships inside the game's files. Against games that stop working the moment the publisher shuts down the server.
None of the three is absurd. All three are genuine grievances among people who buy games, debated for years by players, press, and regulators. And that is precisely why they work as packaging: ideology nobody shares doesn't sell a token.
The product: what the token does
The coin carries the same name as the persona and the manifesto. Each of the fifteen clips went out with a watermark and a QR code to buy it, by Kotaku's count. On August 18, the day the videos went viral, trading volume ran to roughly US$ 11.8 million, according to Dexerto, citing trading records.
What the money funds has been stated three ways and explained none. "A secret project." "Protection against corporate counterattacks." "Infrastructure needed for new attacks." Who controls the funds and how they will be spent was never disclosed, and the outlets covering the case noted there is no independent confirmation of who is behind the persona.
There is one further mechanism that completes the design. According to EGamers, the persona began putting the choice of which clip to publish to a vote — and the ballot is the token: whoever wants to see a given scene sends coins to that option, and the option with the most coins wins. In one such round, the winning scene drew roughly 147,000 tokens, 64% of the total. The content becomes a product twice over: it attracts buyers, and it is released by those who have already bought.
Urgency is the engine. The clip circulates for a few hours, the price climbs while it circulates, and latecomers buy from those who got there first.
What the public blockchain shows, without naming anyone
The network is public, and the token's contract is published by market aggregators such as Solana Compass, the source Dexerto used. There are tokens sharing the same name under a different contract: names can be copied, contracts cannot, and the figures below come from the contract cited by the press. Anyone can read what follows. The numbers are as of the day they were read, and each carries its date.
When it was born. The token's first liquidity pair was created on August 15, 2026, at 21:07 UTC, per DexScreener's record. The first videos are from August 18. If the event came after the token, the event was planned as marketing.
Who was holding. On August 20, the ten largest wallets held 51.6% of the supply, according to EGamers. By September 12, 38.7%, according to Solana Compass, across roughly 51,000 wallets with a balance, per the aggregator consulted on that date. The top holders' share shrank as the price fell. That is consistent with selling into the peak. It is not proof of it, and this article does not say whose any of those wallets are: the largest, at 29.4%, could be a liquidity pool, a treasury, or a burn address.
The peak and the fall. The high was US$ 0.034 per token, with a market cap of US$ 23.39 million at the top, according to Kotaku, which by August 27 was already recording an 86% decline. On September 12, market cap stood at US$ 433,000. The curve is the curve of attention paid to the leak, not of anything being used.
Where it went. That is a question the network also answers, and answers permanently. It is not the subject of this article. It is the subject of the next one.
Two details tend to be offered as guarantees. The contract had its mint and freeze authorities revoked, which the promotional material touted as protection. And supply fell from roughly one billion to roughly 730 million tokens — part of it was burned. Revoking authority protects against future inflation. It protects no one from whoever already held most of the supply at the start.
Why this is a typology, not a case
The design doesn't need a leak. It shows up with an environmental cause and a "green" token, with an influencer "giving back to the community" through a coin of their own, with a political movement funding "the fight" by selling its own symbol. In every instance the sequence is the same: the token exists before the moment of attention, the cause supplies the name and the justification, the attention supplies the volume, and silence about the money supplies the rest.
It is a direct relative of what this newsroom described in Anatomy of the fake crypto investment scam, with one difference: there the bait is profit; here the bait is belonging. And that is why Blockchain is not anonymity matters more here than it might appear: the curve, the concentration, and the date of birth are recorded permanently, for anyone who wants to check once the cause has gone out of fashion.
What to check before buying
Five questions, and the answers are either public or nonexistent.
- When the token was created, relative to the event promoting it.
- Who controls the money raised.
- What it funds, with a name and a deadline.
- What happens to the price when the attention runs out.
- Who answers if none of it turns out to be true.
If three of them have no answer, you already have your answer.
In one line
When the cause and the token share a name and the token came first, the manifesto isn't the motive. It's the advertisement.
Sources
- Dexerto — Who is Cyberleek? GTA 6 leak motive and memecoin explained, Zackerie Fairfax, August 19, 2026
- Kotaku — GTA 6 Leaks Could Be Over As Leaker Cashes Out Memecoin, John Walker, August 27, 2026
- Incrypted — Cyberleek Leaks GTA 6 Data and Launches Eponymous Memecoin, Nazar Pyrih, August 19, 2026
- EGamers — CyberLeek, Explained: Inside The GTA 6 Leaks, The Manifesto And The Memecoin Votes, George Tsagkarakis, August 25, 2026, updated September 4
- Solana Compass — token page, accessed September 12, 2026
- DexScreener — token pairs, accessed September 12, 2026
- Solana network — contract account, read on September 12, 2026
- CyberX — To identify one leaker, Take-Two asked for the data of every member of three communities
About the author

Robert F.
request a secure channelRobert F. is the founder of CyberX, a digital intelligence operation applied to investigation, based in Brazil with cross-border reach.
He works in OSINT, on-chain tracing and antifraud for legal teams, corporate compliance, banking antifraud and public authorities.
In CyberX publications we write about what can be said in public — fraud and scam typologies, digital threats, on-chain tracing, regulation, and what separates an investigation from a database lookup. Never about a case we work on, clients, matters under judicial secrecy, or operational detail that would compromise an investigation in progress — ours or anyone else's. A third party's case enters through the public official act, and through what it teaches, not through what it exposed.
Related reading
CyberX works in digital intelligence applied to investigation — OSINT, on-chain tracing, and fraud prevention. The addresses cited are public on the blockchain. Nothing here attributes identity to whoever controls them.
how we write →Source: https://cyberx.to/en/analysis/three-days-before-the-leak-the-token-already-existed
Retrieved on