Key takeaways
- Discord user stayonthegrindd emerged as the top suspect after community investigators traced blockchain activity and Discord timestamps to the Cyberleek leak operation.
- Evidence shows stayonthegrindd posted leaked GTA 6 content on August 18 with foreknowledge of what Cyberleek would upload hours later, suggesting direct involvement or inside access.
- Take-Two's legal team and law enforcement likely identified these connections independently and may already be investigating stayonthegrindd.
The hunt for whoever is behind the GTA 6 leaks has reached a critical juncture. Since August 18, a user or group operating under the name Cyberleek has been releasing gameplay footage online, and community investigators believe they may have identified a key suspect: a Discord user named stayonthegrindd. On August 25, GTA Forums user Vice Cit, who has gained recognition within the community for their digital forensic work, published a detailed report presenting evidence that links the Discord account to the leak operation.
The Investigation Takes Shape
The breakthrough came from evidence originally shared on Reddit, though the thread was deleted by moderators shortly after posting. Despite the removal, the community preserved and continued analyzing the original post, which contained timestamps and activity data pointing to stayonthegrindd as a potential connection to Cyberleek. Vice Cit built upon this foundation, cross-referencing Discord activity with blockchain records to construct what amounts to a forensic timeline of the leak operation.
How the Evidence Emerged
The Reddit investigation that sparked Vice Cit’s report suggested the Discord user might be connected to the broader leak network. Though the original thread disappeared, digital copies survived and circulated through the community. Vice Cit, who studied digital forensics in college, used this preserved information alongside publicly available blockchain data to piece together a coherent narrative of events.
The Forensic Approach
Rather than relying on speculation, Vice Cit’s report documents specific timestamps and account activities, creating a chain of evidence that traces the path of leaked content from its initial appearance to broader distribution. The methodology focuses on correlating Discord activity with known leak uploads, establishing patterns that suggest coordinated action or direct access to the source material.
The Timeline That Changed Everything
The evidence presented by Vice Cit spans several days in August, beginning well before the leaks became public knowledge. The sequence of events reveals how the footage moved from initial leak to Discord circulation to blockchain distribution, with stayonthegrindd appearing at multiple critical junctures.
From Map Reveal to Basketball Footage
On August 16, Cyberleek shared what appeared to be a sneak peek of the GTA 6 map. The next day, August 17, basketball gameplay was uploaded to the dark web. Early on August 18, a user called Cyberleeker (operating on Dread, a dark web forum similar to Reddit) posted this basketball footage through hosting sites. The timing of these initial uploads established a baseline for the leak operation’s activity level.
The Discord Turning Point
Approximately eight hours after the Dread posting, stayonthegrindd joined a GTA 6 Discord server. Within minutes of joining, the user posted the identical basketball footage, then immediately deleted it. When asked what leaked content the server wanted to see next, someone suggested driving gameplay. Stayonthegrindd responded with a specific promise: “I will be back with driving gameplay.” The user also mentioned that while video compression was ongoing, they could share the full map quickly—a statement that proved prophetic.
The Blockchain Uploads
About ninety minutes after this exchange, the leaked map appeared on the blockchain. Two hours later, Cyberleek uploaded the first driving footage featuring a character named Jason to the blockchain. These uploads followed the exact pattern stayonthegrindd had described in Discord, suggesting either direct involvement or exceptional foreknowledge of what Cyberleek would post next.
The stayonthegrindd Connection
The evidence extends beyond the coordinated uploads. On August 18, another Discord user reported receiving a direct message from stayonthegrindd containing GTA 6 gameplay involving a black car. The recipient began watching but the video was deleted before completion. This footage later emerged publicly as the “Gas” gameplay clip, which did not appear on the blockchain until August 23—five days after the initial Discord exchange.
The delayed public release of content that stayonthegrindd possessed days earlier represents one of the most compelling pieces of evidence in Vice Cit’s analysis. It suggests the Discord user had access to materials before they were shared with the broader public, a detail that points toward either direct possession of the leak or a close relationship with whoever possesses it.
What the Evidence Suggests
Vice Cit’s assessment of the situation focuses on two primary possibilities. The first scenario posits that stayonthegrindd obtained the leaked material independently and deliberately shared it in Discord because that community would spread the content widely and rapidly. The second suggests stayonthegrindd is a friend or associate of the original leaker and gained access to the materials before any public release.
In Vice Cit’s words: “This person either had this material and was trying to get this whole thing to blow up by posting it in a place they knew would spread the leaks like wildfire, or this person is a friend of the person who has this leaked material and was able to see the leaks before they ever got uploaded onto Arweave.” Both scenarios, according to Vice Cit, represent “a huge leap in this case” regarding the investigation’s progress. The analyst added, “I do believe stayonthegrindd is CyberLeek (or at least a member of the group), and I think this was a huge opsec misstep.”
The operational security failure—assuming it occurred—would be the Discord user’s direct participation in the leak community despite being potentially identifiable. By posting, deleting, and then discussing leaked content in a server full of witnesses, stayonthegrindd created a documented record of involvement that digital forensicists could trace.
The Legal Machinery Turns
Take-Two, the publisher behind Grand Theft Auto 6, maintains dedicated legal teams and cybersecurity infrastructure. Vice Cit believes the company’s lawyers and investigators likely obtained this same evidence days before the August 25 report. If Vice Cit could connect the Discord activity to Cyberleek through publicly available data, it stands to reason that Take-Two’s resources—significantly greater than any community investigator’s—would have identified these connections earlier.
Law enforcement agencies may also be involved. Depending on the investigation’s classification and jurisdiction, authorities could be pursuing stayonthegrindd independently or in coordination with Take-Two’s legal department. The leaked material involves confidential business information worth millions of dollars, elevating the case beyond simple copyright infringement into potential trade secret theft.
The Investigation Continues
The current status of stayonthegrindd remains unknown. The Discord user may have already been identified, contacted, and compelled to cooperate with investigators. Alternatively, the suspect could be actively evading detection. Vice Cit’s public analysis may accelerate official investigations or, conversely, alert potential subjects that their activities have been scrutinized.
The core question driving the investigation remains open: will identifying stayonthegrindd lead authorities to Cyberleek, or is the Discord user merely a peripheral figure in a larger operation? If stayonthegrindd is indeed Cyberleek or a core member of the leak group, the timeline evidence suggests a significant operational security failure that may have compromised the entire operation. If the user is only a secondary distributor or friend of the actual leaker, locating them might provide the first genuine lead in a chain that extends to whoever originally accessed GTA 6’s source material.
Frequently Asked Questions
Who is Cyberleek and what have they leaked?
Cyberleek is a user or group that began leaking GTA 6 gameplay clips on August 18. The leaks include a basketball gameplay clip, map footage, driving sequences featuring a character named Jason, and a "Gas" gameplay clip involving a black car. The content has been distributed on the dark web and blockchain.
How did investigators connect stayonthegrindd to Cyberleek?
GTA Forums user Vice Cit analyzed a timeline of events using Discord timestamps and blockchain records. On August 18, stayonthegrindd joined a GTA 6 Discord server and posted the same basketball footage Cyberleek had shared hours earlier on the dark web, then deleted it. The user also possessed footage before it appeared publicly, suggesting foreknowledge of the leak operation.
What does stayonthegrindd being a suspect mean for Take-Two?
If Take-Two or law enforcement can identify and locate stayonthegrindd through Discord's records, it may provide the first genuine lead to whoever originally accessed GTA 6's source material. Vice Cit believes Take-Two's investigators likely obtained this evidence independently and have been investigating for several days.
