The order of events is the point
On-chain researchers report that the token contract was created in mid-August, that its trading pool went live on August 15, and that the domain behind the campaign was registered on August 14. The first widely reported GTA 6 clip did not appear until August 18.
That sequence does not prove intent by itself, and this desk will not treat it as a finding. It does change how the campaign should be read: the financial layer was in place before the attention it would need.
Where the money actually came from
The most consequential detail in the later on-chain reporting is the mechanism. The proceeds are described as coming from trading-volume and liquidity fees rather than from selling the creator's original allocation — and roughly 270 million tokens were reportedly burned in late August, cutting supply from about one billion to roughly 730 million.
That matters for language. A fee-funded exit is still an exit, and buyers who were told that higher volume would unlock more leaks still paid for it. But “rug pull” is a characterisation, not a finding: no regulator and no court has ruled on this token.
READ COINDESK'S ON-CHAIN REPORT -> PROTOS / OCTOBER TOKEN STATUS ->Why there is no single number
Anyone quoting one definitive total for this exit is rounding over a real disagreement. The published readings include:
- About $146,000 in wrapped SOL plus the sale of accumulated fee tokens for roughly $125,000 — the CoinDesk breakdown, which its own headline rounds to $270,000.
- A combined exit “above $250,000”, attributed to a community on-chain analyst and repeated across coverage.
- Around $350,000 described as coming entirely from liquidity fees and routed through over-the-counter providers.
- A later reconstruction that partially overlaps the first figure while stating a different total, which is itself a sign the accounting is unsettled.
Two of those readings appear to be measuring the same on-chain quantity. At least one published breakdown contradicts its own components. Treat the range — roughly $200,000 to $350,000 — as the honest summary, and treat any SOL-denominated total as unverified, because the implied exchange rate in some reconstructions does not match SOL's price.
What the wallet trail shows
September reporting reconstructed a peel chain: fee tokens sold in one block of trades, the proceeds split into several wallets created the same day, with endpoints routed toward a mixer-style address and toward a large exchange deposit address. That is a laundering-shaped pattern, not a proven laundering offence.
The October development is more interesting than the totals. Days before the new upload, tracking accounts reported that the operation-linked wallet had signed fresh transactions — including creating new token accounts for the same asset. Signing transactions requires private-key control, so this is reasonable evidence that whoever holds the keys was active again.
The quiet risk is liquidity, not just price
Early September analysis found the asset carrying well over a million dollars in daily volume against only a few thousand dollars of depth near the traded price across all venues — a ratio on the order of a hundred to one. In that condition, ordinary selling moves the price far more than the market cap suggests, and one venue carrying most of the volume concentrates the exit risk.
Automated token checkers also flagged that the creator retains the authority to change fees, mint additional supply or restrict selling. Whether or not that authority is ever used, it exists, and it is the reason to treat any “dev is safe now” argument as marketing.
What the October return did to the price
The new upload produced a sharp move: reporting on the day measured roughly a 50% gain, and a 24-hour reading later showed about 65%. Both are consistent with the same event, and a separate headline claiming a 200% two-day move could not be verified against an accessible source.
The more useful number is the distance from the top. Even after the pump, the asset trades around 93% below its August peak, with a market capitalisation in the low millions and tens of thousands of holders. A leak-driven bounce is attention, not recovery.
Lookalike tokens are now the main trap
At least three unrelated assets now trade under names close to this story, on contract addresses that do not match the original. One is a “justice” themed token with a handful of holders and effectively no volume or liquidity; another is a much larger supply listed elsewhere under the same name; a third is a confusion vector referencing a similarly spelled brand that has no verifiable official contract.
A matching first-and-last-four characters is not verification — that is exactly the gap address-poisoning attacks target. Verify the entire contract address against a primary tracker, character by character, before you treat any token as the one being discussed.
What the transactions do not prove
- The legal identity of the person controlling the wallets.
- That every public account using the Cyberleek name was involved.
- A criminal or civil judgment; no such ruling is cited here.
- That the October donations appeal was paid, or that anyone received the money.
- That a complete playable GTA VI build still exists in the wild.
Red flags to screenshot and report
- Promises that a higher market cap unlocks more leaks.
- Countdowns, private-sale pressure or “dev round” language.
- Wallet addresses pasted into replies by unverified accounts.
- Pages that ask for a “contact fee”, a Monero payment or a session ID to reach the operator.
- Downloads that require a browser extension, executable or disabled security setting — including huge files that are almost entirely empty.
- Claims that a takedown proves a coin is safe or an identity is known.
What this desk will not do
We will not embed a price chart, link to a wallet, print a contract address or host alleged build files. Publishing an address on a page like this one mainly creates a copy-paste target, so verification belongs on a primary tracker, not in our markup. Read the anti-scam guide for the practical steps, check the latest status ledger for the October sequence, then return to the leaks index for the evidence.