For business
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
AML certification
How industry players can get up-to-date knowledge and professional certification.
AML certification
How industry players can get up-to-date knowledge and professional certification.
Comprehensive transaction analytics that helps to build graphs and trace funds.
Graph
Travel rule
(soon)
For personal use
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Crypto recovery
Services are focused on tracking
and recovering crypto assets.
and recovering crypto assets.
Сrypto recovery
Services are focused on tracking
and recovery crypto assets.
and recovery crypto assets.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Portfolio tracker
Information about all assets and risk assessment in one place.
Portfolio tracker
Information about all assets and risk assessment in one place.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
Для себя
Для Бизнеса
Travel rule
(Cкоро)
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
In August 2026, a website called Cyberleek appeared online. Its operators claimed to have stolen files from the unreleased GTA 6 and offered several ways to pay for access: buy their token, use it to “vote” on which piece of the game would be released next, or send cryptocurrency directly in exchange for a playable build. Nobody has established whether the files were authentic. The money, however, left a trail. The payments ran through the Solana blockchain, where transactions are permanently recorded and publicly visible.
Using BitOK's Graph tool, BitOK analysts examined 3,784 transactions to establish who created the tokens, how much money was collected, where it went, and where the trail runs cold.
This investigation has two parts. The first explains what happened and presents the key figures. The second lays out the technical evidence: addresses, transactions, tables, and calculations.
Using BitOK's Graph tool, BitOK analysts examined 3,784 transactions to establish who created the tokens, how much money was collected, where it went, and where the trail runs cold.
This investigation has two parts. The first explains what happened and presents the key figures. The second lays out the technical evidence: addresses, transactions, tables, and calculations.
Contents:
- A Quick Glossary
- Part 1. What Happened: Four Ways Cyberleek Collected Money
- Method 1. The Original Token
- Method 2. “Voting”
- Method 3. The Websites
- Method 4. The Second Token: Grand Theft Leek / CYBER
- Part 2. Evidence and Technical Details
A Quick Glossary
A Quick Glossary
- Solana blockchain — a public ledger of transactions. Anyone can inspect its records, which cannot be deleted or altered.
- SOL — Solana's native cryptocurrency. A lamport is its smallest unit, equal to one billionth of a SOL. When balances “reconcile to the last lamport,” every smallest unit has been accounted for.
- Token — a digital asset that anyone can issue on Solana. A mint is the on-chain record that identifies a token and governs its issuance.
- USDC — a token designed to track the US dollar at a one-to-one ratio. Proceeds can be converted into USDC to reduce exposure to price fluctuations.
- Key — the cryptographic credential used to authorize transactions. The blockchain does not reveal who actually holds it. When a table says “address X sent funds to address Y,” it means the transaction was authorized by the relevant key; the owner's identity remains unknown.
- Transaction — a single operation recorded on a blockchain, such as a transfer, swap, or token creation.
- Liquidity pool — a pool of assets used on an exchange to swap a token for SOL. Swaps generate fees.
- LP (liquidity provider position) — a record of someone's contribution to a pool. A Fee Key grants the right to claim the pool's fees and is issued when the liquidity position is locked.
- Creator fees — payments made to a token creator when the token is traded on certain platforms.
- Bridge — a service for moving assets between blockchains, for example from Solana to NEAR.
- Arweave — a network designed for permanent file storage. ArNS is its naming system; ARIO is the associated token.
- Snapshot — a record of blockchain balances and activity at a specified point in time.
Part 1. What Happened: Four Ways Cyberleek Collected Money
Part 1. What Happened: Four Ways Cyberleek Collected Money
The people behind Cyberleek did not demonstrably make money by selling actual GTA 6 files: the data contains no verified purchase of game files. Instead, funds moved through four channels: swap fees from the original CYBERLEEK token, token-based “voting,” direct payments through websites, and a second token, CYBER, launched two weeks later.
The largest payout came from the first token's swap fees. The wallet that created the token collected fees worth 2,676 SOL in a single operation and moved the proceeds out within five minutes. The voting system and websites were still accepting payments on October 13, the date of the final snapshot.
Here is how each channel worked, who received the money, how much came in, and where it went.
The largest payout came from the first token's swap fees. The wallet that created the token collected fees worth 2,676 SOL in a single operation and moved the proceeds out within five minutes. The voting system and websites were still accepting payments on October 13, the date of the final snapshot.
Here is how each channel worked, who received the money, how much came in, and where it went.
Method 1. The Original Token
Method 1. The Original Token
On August 15, 2026, the owner of wallet Hok9…H3Np created a token, minted one billion units, revoked the ability to mint more, deposited tokens and SOL into a liquidity pool, and locked the position so that fees from each swap would flow back to the creator—all in a single day.
How Locked Liquidity Can Still Generate Income
Raydium offers a feature called Burn & Earn. A token creator permanently locks a liquidity position in exchange for a Fee Key—the right to collect fees from swaps (see the Raydium documentation). To buyers, this can look reassuring: “The liquidity is locked, so the creator can't run off with it.” But locking the liquidity does not prevent the creator from making money. It simply changes the revenue stream from selling tokens to collecting trading fees. That is exactly what happened on August 27, when the wallet claimed fees using the CollectCpFees instruction. This mechanism is separate from the creator fees charged on other platforms, discussed later.
How Many Tokens Are in Circulation?
At the final snapshot, the circulating supply stood at 729,888,774.100812848 CYBERLEEK. On August 22 at 18:27:59, the holder of key Cbfb…RMPo burned 270,000,000 CYBERLEEK from account HLqFaqWkCN3sN3K8gNqtcJt3V2tyg2WBrNh7RqA6KFxa (V01). That accounts for most of the supply reduction. Another 45.356205333 CYBERLEEK disappeared from circulation between two morning snapshots. The transactions responsible were not identified, so this amount has not been added to the 270 million burn.
These figures should not be confused: the original issuance, current supply, size of the LP position, and creator's balance measure different things. None substitutes for calculating the money actually received.
Where the Launch Funding Came From
Before the liquidity pool was created, Hok received 331.66 SOL: 321.42 SOL in two transfers from Ec2q…zYC7 and 10.24 SOL from 9Ve5…xxVg.
That same day at 17:14:33, address 3YLN…vuNA4 sent 4.61 SOL to the publication key 6Nq6 (T09). Another eight transfers from the same 3YLND address sent 39.693 SOL to Ec2. This places two operational keys—the token creator's and the site's publication key—within the same funding network. It establishes a financial connection, not the identity of their owner.
August 27: Collecting the Fees and Cashing Out in Five Minutes
At 07:27:33, Hok claimed liquidity-pool fees for the only time in the wallet's recorded history, using CollectCpFees: 1,442.434206187 SOL and 15,487,189.424338940 CYBERLEEK (T21). At 07:28:16, the tokens were sold for 1,234.234022008 SOL before network fees (T22). Combined, the proceeds amounted to 2,676.668228195 SOL. The tokens and the proceeds from selling them must not be counted twice. The wallet already held 28.455488229 SOL, so its four outgoing transfers totaling 2,705.074 SOL included an earlier balance and cannot independently be treated as net profit.
How Locked Liquidity Can Still Generate Income
Raydium offers a feature called Burn & Earn. A token creator permanently locks a liquidity position in exchange for a Fee Key—the right to collect fees from swaps (see the Raydium documentation). To buyers, this can look reassuring: “The liquidity is locked, so the creator can't run off with it.” But locking the liquidity does not prevent the creator from making money. It simply changes the revenue stream from selling tokens to collecting trading fees. That is exactly what happened on August 27, when the wallet claimed fees using the CollectCpFees instruction. This mechanism is separate from the creator fees charged on other platforms, discussed later.
How Many Tokens Are in Circulation?
At the final snapshot, the circulating supply stood at 729,888,774.100812848 CYBERLEEK. On August 22 at 18:27:59, the holder of key Cbfb…RMPo burned 270,000,000 CYBERLEEK from account HLqFaqWkCN3sN3K8gNqtcJt3V2tyg2WBrNh7RqA6KFxa (V01). That accounts for most of the supply reduction. Another 45.356205333 CYBERLEEK disappeared from circulation between two morning snapshots. The transactions responsible were not identified, so this amount has not been added to the 270 million burn.
These figures should not be confused: the original issuance, current supply, size of the LP position, and creator's balance measure different things. None substitutes for calculating the money actually received.
Where the Launch Funding Came From
Before the liquidity pool was created, Hok received 331.66 SOL: 321.42 SOL in two transfers from Ec2q…zYC7 and 10.24 SOL from 9Ve5…xxVg.
That same day at 17:14:33, address 3YLN…vuNA4 sent 4.61 SOL to the publication key 6Nq6 (T09). Another eight transfers from the same 3YLND address sent 39.693 SOL to Ec2. This places two operational keys—the token creator's and the site's publication key—within the same funding network. It establishes a financial connection, not the identity of their owner.
August 27: Collecting the Fees and Cashing Out in Five Minutes
At 07:27:33, Hok claimed liquidity-pool fees for the only time in the wallet's recorded history, using CollectCpFees: 1,442.434206187 SOL and 15,487,189.424338940 CYBERLEEK (T21). At 07:28:16, the tokens were sold for 1,234.234022008 SOL before network fees (T22). Combined, the proceeds amounted to 2,676.668228195 SOL. The tokens and the proceeds from selling them must not be counted twice. The wallet already held 28.455488229 SOL, so its four outgoing transfers totaling 2,705.074 SOL included an earlier balance and cannot independently be treated as net profit.
Method 2. “Voting”
Method 2. “Voting”
The website program 7rAg…7w3a was deployed by the holder of key 6Nq6…FaF3 on August 15 at 18:46:56 (T31), four hours after the token was issued. The same key also holds the program's upgrade authority. That establishes control over the program, not the identity of the person publishing the content.
The campaign remained active through the latest snapshot. On October 12 at 10:34:50, the publication key posted a Roadmap v2 announcement to BsAY…kJxt (T32). At 12:12:36, it signed the creation of another vote at Es4y…rJEJ (T33). Both transactions succeeded and were recorded in the website's program.
What Visitors See
The website promises to “unlock” material when the token reaches successive market-cap milestones of $5 million, $7 million, $9 million, $11 million, $13 million, $17 million, $21 million, $25 million, and $30 million. A full game build is promised at $30 million. One crucial distinction: market capitalization is the price multiplied by a calculated supply. It is not money paid to the operator.
How the Operator Gets Paid
The mechanism is straightforward:
The campaign remained active through the latest snapshot. On October 12 at 10:34:50, the publication key posted a Roadmap v2 announcement to BsAY…kJxt (T32). At 12:12:36, it signed the creation of another vote at Es4y…rJEJ (T33). Both transactions succeeded and were recorded in the website's program.
What Visitors See
The website promises to “unlock” material when the token reaches successive market-cap milestones of $5 million, $7 million, $9 million, $11 million, $13 million, $17 million, $21 million, $25 million, and $30 million. A full game build is promised at $30 million. One crucial distinction: market capitalization is the price multiplied by a calculated supply. It is not money paid to the operator.
How the Operator Gets Paid
The mechanism is straightforward:
- Visitors transfer CYBERLEEK to accounts representing voting options, such as “Barbershop” and “Race track.”
- When a vote closes, the ProcessResults instruction transfers the collected tokens to account 2yvW…neLh.
- That account is controlled by the publication key 6Nq6.
Six completed votes generated 17 such payouts totaling 821,532.975326094 CYBERLEEK. The publication key paid the network fees for 16 of the transactions. One was initiated by a different key, but the recipient was the same.
Method 3. The Websites
Method 3. The Websites
In the saved source code for cyberleek.cc, the actual voting-option accounts are still CYBERLEEK token accounts. Visitors, however, are shown something different:
- The label has been changed to “SOL donated,” displaying the wrong asset.
- The “copy address” button copies the shared payment wallet 2hqv…zoyH rather than the selected voting-option account.
- A local announcement advertises a Development Build for $40 per download, with both payment links pointing to the same solana: address.
The five options show a combined 8,942.546527361 CYBERLEEK in the captured interface. Sending funds to the shared wallet is not the same as transferring tokens to the chosen voting account: visitors may believe they are voting when they are actually just making a payment.
This substitution appeared in October. Archived HTML from October 5 at 23:35:05 and October 8 at 11:37:44 still displayed CYBERLEEK and contained neither the shared payment address nor the local build-sale offer. The interface changed between October 8 and the latest snapshot. The archives establish that the page changed, not who changed it. The build-sale entries were marked local and do not appear in the program's current on-chain accounts; that does not rule out their existence in an earlier state or another channel.
The program settings also contain a Monero (XMR) contact address, 83YZnx7AjFL5NTVCbwDYnKfqzB7WNaPdZ93c7UDyffkcJ4hHZrkj7AnX3WKWKU4Bfg3CZrAQVyHHmcWhrV89W1g33vkokmd, and a parameter set to “400.” This describes a contact offer. Neither a payment of 400 XMR nor the identity of the person behind the address was established. The evidence package contains no Monero view key with which to inspect the address's transaction history.
.cc: What Actually Arrived, and How It Was Converted to USDC
The combined transaction history of the wallet owner and its token accounts contained 18 successful operations as of 08:14:15. The updated dataset contains 24, including token-account transactions in which the owner's key does not appear directly. Inflows included:
This substitution appeared in October. Archived HTML from October 5 at 23:35:05 and October 8 at 11:37:44 still displayed CYBERLEEK and contained neither the shared payment address nor the local build-sale offer. The interface changed between October 8 and the latest snapshot. The archives establish that the page changed, not who changed it. The build-sale entries were marked local and do not appear in the program's current on-chain accounts; that does not rule out their existence in an earlier state or another channel.
The program settings also contain a Monero (XMR) contact address, 83YZnx7AjFL5NTVCbwDYnKfqzB7WNaPdZ93c7UDyffkcJ4hHZrkj7AnX3WKWKU4Bfg3CZrAQVyHHmcWhrV89W1g33vkokmd, and a parameter set to “400.” This describes a contact offer. Neither a payment of 400 XMR nor the identity of the person behind the address was established. The evidence package contains no Monero view key with which to inspect the address's transaction history.
.cc: What Actually Arrived, and How It Was Converted to USDC
The combined transaction history of the wallet owner and its token accounts contained 18 successful operations as of 08:14:15. The updated dataset contains 24, including token-account transactions in which the owner's key does not appear directly. Inflows included:
- Six substantial SOL deposits totaling 2.231410800 SOL, plus a tiny additional flow of 0.000001002 SOL.
- A direct payment of 40.5 USDC, plus a separate 0.0001 USDC deposit.
Those amounts alone do not prove that anyone purchased or downloaded a game build.
On October 11, wallet 9mp5…hp7B sent 5,607.063064356 and 7,160.296744978 CYBERLEEK to .cc, a total of 12,767.359809334 (T35, T36). Both deposits were converted to USDC. Further upstream, the tokens passed through transactions authorized by key 8Fts…zjvg, which granted permission for the transfers. The records do not identify the owner of the original account, and the analysts did not speculate. No connection between the sender and the website operator was established. Another wallet sending dust amounts, 9mp5PwyYXJUNFyCGwJG6mDnQjpev489VK9CeQKMr1p7B, has a different full address and has not been grouped with 9mp5B1B.
On October 13 at 07:22:37, another 0.369975 SOL arrived at the shared address from 3Tn4…tdPE (T42). Balances at the primary snapshot were 0.384838069 SOL and 323.275015 USDC, with zero CYBERLEEK.
.org: A Separate Payment Wallet and Cash-Out Route
On cyberleek.org, the voting figures are hard-coded into the webpage and do not update, while copying a voting-option address returns CBCv…Phje. The displayed total of 4,644.452782123 CYBERLEEK does not match the on-chain program data. The build-purchase pop-up quotes $40, converts the price into SOL using a script called get_sol_price.php, and lists payment details for several blockchains.
The SOL address had 16 transactions at the first snapshot and 19 after the update. Seven material incoming transfers totaled 2.971202866 SOL, including 0.036035321 SOL supplied to cover network fees. On October 12, the token account received 1,800 CYBERLEEK. Without verifiable orders or receipts tied to these transfers, not every incoming payment can be counted as a sale.
Funds left along two routes. Five direct transfers to BM2v…ZFy8 totaled 2.600632318 SOL. Another 0.369200066 SOL went to B3sf…dqRs. On October 13 at 07:05:31, B3 sent 0.092344630 SOL to AJ3f…wr2J and, at 07:05:37, another 0.276842736 SOL to BM2. The .org branch contributed 2.877475054 SOL to BM2 through the two routes combined.
At the primary snapshot, the shared .org SOL address held 0.000890880 SOL and 1,800 CYBERLEEK. More funds arrived later on October 13:
On October 11, wallet 9mp5…hp7B sent 5,607.063064356 and 7,160.296744978 CYBERLEEK to .cc, a total of 12,767.359809334 (T35, T36). Both deposits were converted to USDC. Further upstream, the tokens passed through transactions authorized by key 8Fts…zjvg, which granted permission for the transfers. The records do not identify the owner of the original account, and the analysts did not speculate. No connection between the sender and the website operator was established. Another wallet sending dust amounts, 9mp5PwyYXJUNFyCGwJG6mDnQjpev489VK9CeQKMr1p7B, has a different full address and has not been grouped with 9mp5B1B.
On October 13 at 07:22:37, another 0.369975 SOL arrived at the shared address from 3Tn4…tdPE (T42). Balances at the primary snapshot were 0.384838069 SOL and 323.275015 USDC, with zero CYBERLEEK.
.org: A Separate Payment Wallet and Cash-Out Route
On cyberleek.org, the voting figures are hard-coded into the webpage and do not update, while copying a voting-option address returns CBCv…Phje. The displayed total of 4,644.452782123 CYBERLEEK does not match the on-chain program data. The build-purchase pop-up quotes $40, converts the price into SOL using a script called get_sol_price.php, and lists payment details for several blockchains.
The SOL address had 16 transactions at the first snapshot and 19 after the update. Seven material incoming transfers totaled 2.971202866 SOL, including 0.036035321 SOL supplied to cover network fees. On October 12, the token account received 1,800 CYBERLEEK. Without verifiable orders or receipts tied to these transfers, not every incoming payment can be counted as a sale.
Funds left along two routes. Five direct transfers to BM2v…ZFy8 totaled 2.600632318 SOL. Another 0.369200066 SOL went to B3sf…dqRs. On October 13 at 07:05:31, B3 sent 0.092344630 SOL to AJ3f…wr2J and, at 07:05:37, another 0.276842736 SOL to BM2. The .org branch contributed 2.877475054 SOL to BM2 through the two routes combined.
At the primary snapshot, the shared .org SOL address held 0.000890880 SOL and 1,800 CYBERLEEK. More funds arrived later on October 13:
Updated balances were 0.584944575 SOL, 40 USDC, and 1,800 CYBERLEEK, with no new outgoing transfers. Common control of the .org payment key and the keys behind the first token, publication program, or .cc has not been established.
Method 4. The Second Token: Grand Theft Leek / CYBER
Method 4. The Second Token: Grand Theft Leek / CYBER
On August 29 at 19:14:38, the holder of key GLf2…9uCJ created a new token, GPx5…pump, called Grand Theft Leek / CYBER (T48). It is a separate Token-2022 asset, not a rebranding of the original CYBERLEEK token. Its circulating supply stands at 972,287,665.592870 CYBER. No one can mint additional tokens, freeze them, or change the token metadata.
Seven Fee Payouts, Two Recipients
Between August 29 at 19:20:21 and August 30 at 02:43:39, seven creator-fee distributions were completed using the DistributeCreatorFees instruction. Each names the second token's mint and the fee source GN1ZMKUehXvRNwpUWbUSo5a8kvz6j9D7WpMiiJZjn5Xo. The transaction records identify two recipients with equal shares: 5,000 bps each, or 50% apiece.
No direct link was found between the second token and the first. Its name and the public campaign associate it with Cyberleek, but the reviewed transactions did not reveal a shared controlling key between the two token launches. Similar branding, promotion dates, and audiences are not proof of common ownership.
Where the Funds Went: Short-Lived Stake Accounts and a Bridge to NEAR
On August 29, the creator sent 44.214047680 SOL to 6smz…3EDJ and 0.999995 SOL to J2bJ…LmJc (T49, T50). In the same time window, both recipients created temporary stake accounts through Solana's Stake Program and immediately withdrew the funds to 8ru6…44vr: 44.214037680 SOL and 0.999585 SOL, respectively (T51, T52). The accounts were opened and emptied within single transactions. This was not staking income; it was a way of routing funds through intermediate accounts.
The more revealing trail begins with the second recipient, 6eh. Here is the route, step by step:
Seven Fee Payouts, Two Recipients
Between August 29 at 19:20:21 and August 30 at 02:43:39, seven creator-fee distributions were completed using the DistributeCreatorFees instruction. Each names the second token's mint and the fee source GN1ZMKUehXvRNwpUWbUSo5a8kvz6j9D7WpMiiJZjn5Xo. The transaction records identify two recipients with equal shares: 5,000 bps each, or 50% apiece.
No direct link was found between the second token and the first. Its name and the public campaign associate it with Cyberleek, but the reviewed transactions did not reveal a shared controlling key between the two token launches. Similar branding, promotion dates, and audiences are not proof of common ownership.
Where the Funds Went: Short-Lived Stake Accounts and a Bridge to NEAR
On August 29, the creator sent 44.214047680 SOL to 6smz…3EDJ and 0.999995 SOL to J2bJ…LmJc (T49, T50). In the same time window, both recipients created temporary stake accounts through Solana's Stake Program and immediately withdrew the funds to 8ru6…44vr: 44.214037680 SOL and 0.999585 SOL, respectively (T51, T52). The accounts were opened and emptied within single transactions. This was not staking income; it was a way of routing funds through intermediate accounts.
The more revealing trail begins with the second recipient, 6eh. Here is the route, step by step:
- September 12, 03:13:32 — 6eh transferred 149.423911935 SOL to 7fpx…XW1p (T55). The originating wallet held funds before CYBER launched and received other deposits, so this entire outgoing amount cannot be attributed to fees from the second token.
- Twelve seconds later, 7fpx sent the same 149.423911935 SOL through Omni Bridge to near:intents.near, using origin nonce 627069 (T56). Transaction EtZMZM22ViKMo4r5y4Anovs3wKQ2owUmDpjygnMMcdEX contains the Wormhole bridge component that carries the message. The SOL itself entered bridge vault 6tckHFBpiJ8YgYN8FUskvtvTpXQZ55g5LHeo1kvELoDQ, belonging to Omni program dahPEoZGXfyV58JqqH85okdHmpN8U2q8owgPUXSCPxe. The analysts independently derived that vault address using Solana's rules (seed sol_vault, bump 255), and it matched. They found no indication of a mixer, a service designed to obscure fund flows.
- On NEAR, transaction 5twK…hfGd completed successfully. The ft_transfer and mt_mint events confirm that 149.423911935 wrapped SOL was credited to intents.near under internal account 6f3d595d021ae32f1c2934e27410f8db2d91ea1afebf26a2a75c006da94fe7d3.
- After 09:00 UTC on October 13, the account's nep141:sol.omft.near balance was zero. Nothing remained in that particular asset, but the next destination address and asset could not be reconstructed from the available data. A search for an order in the 1Click service using the deposit address returned no result (HTTP 404).
intents.near is a settlement contract operated by the service, not a personal wallet belonging to the people behind Cyberleek.
Run your own investigation with BitOK Graph. Becoming an on-chain investigator is easier than you might think.
Run your own investigation with BitOK Graph. Becoming an on-chain investigator is easier than you might think.
Part 2. Evidence and Technical Details
Part 2. Evidence and Technical Details
This section contains the addresses, transactions, tables, and calculations underlying Part 1. Every linked entry takes you to an on-chain record.
Method 1: Transactions, Launch Funding, and Withdrawal Routes
The August 15 launch timeline, token identifiers, pre-launch funding chain, a 75-address network, and four August 27 withdrawals with their downstream nodes.
Method 1: Transactions, Launch Funding, and Withdrawal Routes
The August 15 launch timeline, token identifiers, pre-launch funding chain, a 75-address network, and four August 27 withdrawals with their downstream nodes.
Date (UTC) | Action | Evidence |
15.08 · 14:20:54 | Token created (InitializeMint); Hok holds mint authority | |
15.08 · 14:23:38 | 1,000,000,000 CYBERLEEK minted | |
15.08 · 17:05:19 | Additional minting authority revoked | |
15.08 · 21:07:26 | Liquidity pool created and supplied with 730,000,000 CYBERLEEK | |
15.08 · 21:19:37 | Liquidity position locked (490,815.647672221 LP); Fee Key issued, granting the right to collect fees |
Token details:
- CYBERLEEK mint — ApZu…pbKg. Additional minting and freezing are no longer possible.
- Raydium liquidity pool — G8kg…iMGh; its LP shares are tracked under 3fmG…GiSH.
- The Fee Key was issued as NFT 44is…FttrS.
- Creating the pool reduced Hok's balance by 330.192176720 SOL, including network fees and account-related costs. This was the sum of several debits, not a single transfer into the pool.
The analysts reconstructed the following upstream network. Each amount applies to the specified pair of addresses; where other deposits exist, it does not establish the source of every SOL in a subsequent payment.
From / to | SOL / number of transfers | Example |
26sZ…PMQ9 sent to EjsB…3KGB2 | 156.02534747 / 1 | |
EjsB…3KGB2 sent to 2ZdU…vJhD | 156 / 2 | |
171.344284793 / 1 | ||
171.12 / 1 | ||
734t…72Sb sent to 3YLN…vuNA4 | 30.9101 / 8 | |
17.8683 / 4 | ||
2ZdU…vJhD sent to 3YLN…vuNA4 | 1.401803 / 8 | |
15.8726 / 4 | ||
11.4626 / 5 |
The Pre-Launch Funding Network: 75 Addresses Reconciled to the Last Lamport
The Pre-Launch Funding Network: 75 Addresses Reconciled to the Last Lamport
On August 13, 26sZ distributed 440.879522103 SOL across three nodes. The transfers contained short memo fields; whether these were order numbers could not be established.
Эти три ключа работали как «кассиры»: они оплачивали сетевые комиссии за переводы других отправителей — 307 операций от 19 разных отправителей, где отправитель подписывал сам перевод, а один из этих трех ключей — оплату комиссии сети. Повторяемость говорит о скоординированном финансировании; число людей и юридический владелец ключей не определены.
В расчетную выборку вошли 75 адресов — известные узлы и временные контрагенты, возвращавшие средства внутрь сети (перечень и критерий — в funding_boundary_v2.json). Это граница расчета, а не доказанный кластер одного владельца. Что показала сверка:
В расчетную выборку вошли 75 адресов — известные узлы и временные контрагенты, возвращавшие средства внутрь сети (перечень и критерий — в funding_boundary_v2.json). Это граница расчета, а не доказанный кластер одного владельца. Что показала сверка:
- SOL balances across all 75 addresses reconciled to the last lamport, with no gaps in the retrieved histories.
- At the snapshot (slot 456408708), the addresses held a combined 1.509796036 SOL.
- External transfers accounted for 440.880958189 SOL in inflows (including 0.001436086 SOL beyond the three main deposits) and 439.288320980 SOL in outflows.
- Network fees totaled 0.004418773 SOL. Another net 0.078422400 SOL went toward creating service accounts after accounting for funds returned when they were closed.
- The principal external expenses were 331.66 SOL to launch Hok, 4.61 SOL to the publication key, 5.87 SOL to purchase ARIO, and 96.221 SOL to JCRM. Transfers within the network were not counted again.
The calculation reconciles for the selected addresses, but it does not guarantee that every address in the network or every unobserved counterflow has been found.
The same network funded the purchaser of ArNS names and the file-upload key. On August 14 at 09:42:10, 52yK…wDHZ received 1 SOL from 3YLND. Key 4wzw paid the fee, and both keys signed the transaction (V05). Another 5 SOL arrived from 8xigoERqJF5KYXLhf7NAPsWYMtarE5iXGZLDfCgptbEp.
On August 27, five addresses sent a combined 96.221 SOL to JCRM…Sdfe, including 0.89 SOL from the Arweave upload key. JCRM sent 96.220 SOL to GMTs…zqeS, which forwarded 96.218994750 SOL to 3Afn…J2rH at 14:05:17 (V06). That 3Afn address matters: it later received the largest share of the token's fee proceeds. The infrastructure funding and fee withdrawals converge at the same node, but the final address has not been tied to a specific customer of the service.
The same network funded the purchaser of ArNS names and the file-upload key. On August 14 at 09:42:10, 52yK…wDHZ received 1 SOL from 3YLND. Key 4wzw paid the fee, and both keys signed the transaction (V05). Another 5 SOL arrived from 8xigoERqJF5KYXLhf7NAPsWYMtarE5iXGZLDfCgptbEp.
On August 27, five addresses sent a combined 96.221 SOL to JCRM…Sdfe, including 0.89 SOL from the Arweave upload key. JCRM sent 96.220 SOL to GMTs…zqeS, which forwarded 96.218994750 SOL to 3Afn…J2rH at 14:05:17 (V06). That 3Afn address matters: it later received the largest share of the token's fee proceeds. The infrastructure funding and fee withdrawals converge at the same node, but the final address has not been tied to a specific customer of the service.
From there, the money was split across intermediary addresses. The confirmed branch reached the following nodes. These figures describe successive stages of the same flow and must not be added to the initial withdrawals.
The trail cannot be followed to a definitive endpoint because the funds are commingled with unrelated deposits. Ece received 391.027965123 SOL from this branch, added other incoming funds, then sent 2,978.540001502 SOL to 66ZQ…3H1o across nine transfers. That is more than the amount linked to this case, so the entire outgoing total cannot be classified as Cyberleek revenue. Ece now holds zero SOL. The next node recorded 192 incoming transactions and has numerous counterparties; its payouts are shown in the tables as movements of pooled funds. No documentary evidence establishes that 3Afn or eS4 belongs to a particular exchange. GPscf, Ece, and 66Z all combine funds from different sources. The shared downstream route can be traced, but the portion attributable specifically to this case can no longer be isolated in each subsequent payment.
Method 2: Program Records and Voting Payouts
Method 2: Program Records and Voting Payouts
What the website's program stores, how its records were checked against the site, and the dates of every voting payout.
The program stores content, announcements, votes, and site settings. BitOK analysts independently decoded 37 of its current records:
The program stores content, announcements, votes, and site settings. BitOK analysts independently decoded 37 of its current records:
- 24 content entries;
- 7 votes;
- 4 announcements;
- program state and configuration.
The settings addresses and the accounts for all five voting options were independently derived using Solana's address rules. Every one matched the website. In the website-to-chain comparison, 28 records matched the program data, while two local build-sale entries did not.
Date | CYBERLEEK transferred to publication key |
20.08.2026 | 228 630,959061841 |
24.08.2026 | 67 951,772645367 |
26.08.2026 | 274 854,177140217 |
08.10.2026 | 204 976,973596189 |
11.10.2026 | 25 393,817627846 |
12.10.2026 | 19 725,275254634 |
There was one exception. On August 26 at 13:10:10, key DESB…XzNR initiated a payment of 1,004.524589386 CYBERLEEK to the account controlled by 6Nq6 (T34). Here, the initiator, fee payer, and recipient were three distinct roles. Common control of DES and 6Nq6 was not established.
The complete set of 17 transaction signatures, with amounts, timestamps, and initiators, is preserved in vote_claims.csv. Account 6Nq6 now holds 821,533.195858644 CYBERLEEK: the voting payouts plus two small additional deposits of 0.110266275 each. In the retrieved account history, these tokens have neither been withdrawn nor sold. Later transfers to voting options that had already been processed are tracked separately and excluded from the payout total.
The complete set of 17 transaction signatures, with amounts, timestamps, and initiators, is preserved in vote_claims.csv. Account 6Nq6 now holds 821,533.195858644 CYBERLEEK: the voting payouts plus two small additional deposits of 0.110266275 each. In the retrieved account history, these tokens have neither been withdrawn nor sold. Later transfers to voting options that had already been processed are tracked separately and excluded from the payout total.
Method 3: Website Accounts and Fund Flows
Method 3: Website Accounts and Fund Flows
Voting-option accounts on .cc, conversions into USDC, cash-out routes from .org, and the payment addresses published by the websites on other blockchains.
This wallet has a USDC token account, 4MDN…whPp, and a CYBERLEEK token account, FJPs…4yUT. The evidence appendices document the match between the website code and the on-chain accounts; see also the saved site snapshot.
This wallet has a USDC token account, 4MDN…whPp, and a CYBERLEEK token account, FJPs…4yUT. The evidence appendices document the match between the website code and the on-chain accounts; see also the saved site snapshot.
Four of these transactions also sent 1.730069 USDC to account 8Wsu…Vx8A, owned by Gzm9…qQvd. This resembles a swap fee or referral payout and does not establish ownership of the website. The table reports the net increase after these outgoing payments. No other withdrawals from the USDC account were found.
After the primary snapshot, .cc received 0.368790000 SOL at 08:20:50 and 41.841111 units of the token CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH at 09:59:04. At 10:07:39, CASH was swapped, resulting in a net credit of 41.539119 USDC (V17). A short chain of transactions followed over the next nine seconds:
After the primary snapshot, .cc received 0.368790000 SOL at 08:20:50 and 41.841111 units of the token CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH at 09:59:04. At 10:07:39, CASH was swapped, resulting in a net credit of 41.539119 USDC (V17). A short chain of transactions followed over the next nine seconds:
- 10:07:58 — .cc sent 0.738732009 SOL to 8ofX…twM1 (V18).
- 10:08:05 — 8ofX swapped the amount for 79.087366 USDC (V19).
- 10:08:06 — 78.533895 USDC returned to the .cc USDC account (V20). The remaining 0.553471 USDC went to account A9cjW2ttReS2mHDr2CpTBb4MyokrknhfGKmFNcMPWVj1, owned by EBk7pSomiBbHe21WFEWGN6UvkXPrAyymNm95gjiEAKwq.
The sequence establishes 8ofX's role as a conversion intermediary, but not whether it is controlled by the website operator. At 10:10:24, a tiny 0.000010000 SOL transfer came from the similar-looking but different address 8ofyYraDqxdaThe3eErTZYtDhiARaLGQLE2b7rR6twM1. At the final snapshot, balances were 0.014895805 SOL, 443.348029 USDC, and zero CYBERLEEK, consistent with the transaction-by-transaction reconciliation.
A different key, DSc, paid for and signed the final transaction. Such infrastructure can serve multiple customers, and the address has not been conclusively attributed to any specific exchange service. BM2 has other deposits and a history extending back to June, so its 10.135655296 SOL balance cannot all be attributed to .org. No outgoing payments from BM2 were found after the October inflows began.
.org: Payment Details on Other Blockchains
.org: Payment Details on Other Blockchains
Network | Address from current website code | Verification result |
BTC | bc1qjfj8v82a50cvxjpjvluqdvvlv9av7mp06q5y6t | 325,608 sat received and fully spent; balance zero |
ETH / USDT ERC-20 | 0xFe6cF2c2c33cBC0784a6D810D3Fc1523Ef3eA9C4 | Zero ETH and no transfers, including ERC-20 tokens |
LTC | LUehzypgaWcVTvnQjiTGKFq86jfhNmmA5j | Provider reported zero transactions and zero LTC |
TRON / USDT | TY9EfkSvED6qxdJjBdAnrUshx6bkfJGUZX | No transactions, including TRC-20 token transfers |
XMR | 43hhxBhDAxnYhthxsv66KCWBioLDyvNN2gFMhRqqyp9HhXEwoNqcyGyRRcFHt5p1PqNu7YYpzDwkGMVt1QN2zac34K3QvUz | Monero transaction history is unavailable without a view key |
The BTC address received 0.00325608 BTC in two transfers on August 26 and September 5, which the sender combined with other payments in a single transaction. Both deposits predate the October build-sale offer and cannot establish payment for that particular offer.
After fees, the first outgoing transaction sent 163,321 sat to bc1qs98dxp6ghux5ujnwx83ngvurjkhz387gt8dh5n; the second sent 161,645 sat to bc1qqsn3hpwwkw8h4rj93qyt85zte9ehvfvpgjtq55. There is no proof that these recipients share an owner with the .org SOL key. The only established connection is that the addresses appeared together in the website's code.
Other Domains: Payment Addresses in Older Snapshots
Other Domains: Payment Addresses in Older Snapshots
BTC address bc1qf62q2t49lzwfp8y0lek62m54urlm8h6feqadcu appears in snapshots of .space, .press, and cyberieek.space. Blockstream shows eight transactions: four incoming and four outgoing, totaling 235,574 sat (0.00235574 BTC) received, with a current balance of zero. The first three deposits—on June 27, June 29, and August 9—predate the main token's launch. The mere presence of the address on a website does not make those transfers donations to the August campaign.
Address | Finding |
BTC .world: bc1qg5s0x22cwlztvdqgl3pnh63fxv9remk44lkje8 | Blockstream reports zero transactions and zero sat received, including unconfirmed transactions |
ETH .world: 0x73Ec78555FC688Ab67A7C9cEFA29fCC90b166A24 | Zero ETH and no transfers, including ERC-20 tokens |
ETH .press: 0x56091EA8919Cd446Efe072e59c1F49ba9C382CB7 | Zero ETH and no transfers, including ERC-20 tokens |
LTC .press: ltc1q7jvtyv4cmu2zva9fu9qfwr4jarxkjr072ffpw4 | Provider reports zero transactions and zero LTC |
TRON: TQViyWp5vLQ4WBisiSPb7rJSYzZMYp6y2Y | Invalid address: checksum verification failed |
TON: UQBvWiFOx5DxN5vKGJGJvGnITvT8qBPQzqCMqvVY0bN4w3w5 | Invalid address: checksum verification failed |
BCH: qpewu2khr9ysfz6c6ejdxh4tg8xr8ekykg959c5dhl | The address is valid, but its transaction history could not be retrieved |
The researchers did not attempt to “repair” invalid addresses by guessing characters. The missing BCH response does not mean no payments took place. Fresh, complete HTML copies of .press and .space were unavailable, so claims about the addresses on those pages refer to the supplied snapshots. SOL addresses for .world and .press from the older evidence package were not refreshed in this review and are not used as current balances. Ethereum addresses were checked on Ethereum mainnet only, not on other compatible chains such as BNB Chain or Polygon.
Method 4: Fee Distributions, Other Tokens, and Commingled Funds
Method 4: Fee Distributions, Other Tokens, and Commingled Funds
CYBER creator-fee distributions, three additional tokens launched by the same creator key, and the addresses where proceeds were mixed with unrelated funds.
In the same transactions, GLf2 also sent 2.699340023 SOL to 8Ner…SCcS in separate transfers. Here is how the creator's balance reconciles:
- Small payments to other addresses: 0.002800000 SOL.
- Network fees: 0.000035980 SOL.
- Net balance increase at GLf2: 51.287521366 SOL.
Together, GLf2, 6eh, and 8Ner recorded a net balance increase of 107.976558758 SOL—0.002835980 SOL less than the gross distributions. The net amount must not be described as the gross protocol fee. 8Ner received a transfer from GLf2; it was not a third participant in the 50/50 split. The instructions, events, and reconciliation are documented in creator_fee_ledger.json and creator_fee_events.json.
Three More Tokens Created With the Same Key
Three More Tokens Created With the Same Key
Key GLf2 also signed the creation of three other tokens with CyberLeek-themed names. This establishes reuse of the same creator key within this branch of activity.
Across 32 successful fee-collection and distribution transactions, GLf2 received 279.452241637 SOL, including wrapped SOL (WSOL) converted into native SOL. In those same transactions, it sent 13.982025311 SOL to other addresses and paid 0.000163940 SOL in network fees, leaving a net balance increase of 265.470052386 SOL. Every transaction reconciled to the last lamport, with no unexplained remainder. Fees can be withdrawn from a shared creator-fee vault without specifying the token that generated them, so the 279.452241637 SOL cannot automatically be allocated among the four tokens. The seven CYBER distributions are already included here to the extent of GLf2's share and must not be added again.
Hok has a separate creator-fee history: it received 26.999143438 SOL across 66 creator-fee operations identifying 64 different mints. That proves its role as a recipient, not that it created each of those tokens. These proceeds are kept separate from the 1,442.434206187 SOL in Raydium liquidity-pool fees.
Even before the launches under investigation, on July 16, 2YbEKjjT7tfj9jsmZbKyjKiTL2DE3eVzRybA1VEmLZKj sent 65.629791260 SOL to the second recipient, 6eh (V16). That July payment cannot have originated from CYBER fees earned in August. Similar downstream routes do not justify treating the July transfer as if it came from the same source.
On August 30 at 21:33:55, the third recipient, 8Ner, sent 2.699335023 SOL to Chqt…cJof (T53). Chqt combined that transfer with other funds, then sent 14.834228878 SOL to B8XF…Q3aw and 2.617805095 SOL to 99Gc…NtTm (T54). These combined outflows cannot be attributed entirely to CYBER; only the 2.699335023 SOL received from the third recipient is directly established.
Downstream recipients were examined separately. For 8ru, the analysts retrieved 396 transactions and decoded 361 in the selected period; this address distributes mixed funds to numerous recipients. For B8XF, they retrieved 108 transactions and decoded 84 successful ones; all 51 successful transactions for 99Gc were decoded. Subsequent transfers of the combined flow included 240.833102641 SOL from 8ru to ACKN…JzuN, 139.383404228 SOL from B8XF to Gj7p…e6Q7, and 7.048575883 SOL from 99Gc to 71d8…W7iF. These figures describe the wider flow after commingling. The portion of CYBER proceeds carried into those later transfers could not be isolated.
Hok has a separate creator-fee history: it received 26.999143438 SOL across 66 creator-fee operations identifying 64 different mints. That proves its role as a recipient, not that it created each of those tokens. These proceeds are kept separate from the 1,442.434206187 SOL in Raydium liquidity-pool fees.
Even before the launches under investigation, on July 16, 2YbEKjjT7tfj9jsmZbKyjKiTL2DE3eVzRybA1VEmLZKj sent 65.629791260 SOL to the second recipient, 6eh (V16). That July payment cannot have originated from CYBER fees earned in August. Similar downstream routes do not justify treating the July transfer as if it came from the same source.
On August 30 at 21:33:55, the third recipient, 8Ner, sent 2.699335023 SOL to Chqt…cJof (T53). Chqt combined that transfer with other funds, then sent 14.834228878 SOL to B8XF…Q3aw and 2.617805095 SOL to 99Gc…NtTm (T54). These combined outflows cannot be attributed entirely to CYBER; only the 2.699335023 SOL received from the third recipient is directly established.
Downstream recipients were examined separately. For 8ru, the analysts retrieved 396 transactions and decoded 361 in the selected period; this address distributes mixed funds to numerous recipients. For B8XF, they retrieved 108 transactions and decoded 84 successful ones; all 51 successful transactions for 99Gc were decoded. Subsequent transfers of the combined flow included 240.833102641 SOL from 8ru to ACKN…JzuN, 139.383404228 SOL from B8XF to Gj7p…e6Q7, and 7.048575883 SOL from 99Gc to 71d8…W7iF. These figures describe the wider flow after commingling. The portion of CYBER proceeds carried into those later transfers could not be isolated.
Infrastructure: Domains, Files, and Telegram
Infrastructure: Domains, Files, and Telegram
The campaign involved websites, files, and a communications channel as well as wallets. All were funded through the same financial network as the token. Here is what the analysts were able to verify.
Five Domain Names Purchased the Day Before Launch
ArNS is a naming system built on Arweave, a network for permanent file storage. On August 14, one day before the token launch, the holder of key 52yK…wDHZ bought five names for a total of 388,584.392 ARIO, the network's token. Purchase records were verified against the name status and token transfers. The transactions identify the buyer at that point in time, but not the complete subsequent ownership history.
Five Domain Names Purchased the Day Before Launch
ArNS is a naming system built on Arweave, a network for permanent file storage. On August 14, one day before the token launch, the holder of key 52yK…wDHZ bought five names for a total of 388,584.392 ARIO, the network's token. Purchase records were verified against the name status and token transfers. The transactions identify the buyer at that point in time, but not the complete subsequent ownership history.
Files on Arweave: Valid Signatures, Unknown Origins
On August 15 at 12:23:37, the file-upload key 667G…L33D received 1 SOL from 3YLND (V12), part of the same network that funded the other infrastructure. Five files were signed with this key. The analysts checked the contents, tags, public key, and digital signatures of each file (Ed25519, ANS-104 format, type 4). All five signatures were valid, and the data sizes and file identifiers matched.
On August 15 at 12:23:37, the file-upload key 667G…L33D received 1 SOL from 3YLND (V12), part of the same network that funded the other infrastructure. Five files were signed with this key. The analysts checked the contents, tags, public key, and digital signatures of each file (Ed25519, ANS-104 format, type 4). All five signatures were valid, and the data sizes and file identifiers matched.
Arweave file | Format / size (bytes) | Result |
video/mp4 / 36,399,611 | Signature by key 667Gfn verified | |
image/png / 3,712,210 | Signature by key 667Gfn verified | |
video/mp4 / 35,748,783 | Signature by key 667Gfn verified | |
image/png / 922,561 | Signature by key 667Gfn verified | |
image/png / 787,106 | Signature by key 667Gfn verified |
In total, one key uploaded three images and two videos. The App-Name=sol-arweave-ipfs-uploader tag is part of the signed data, but it does not identify a person. Verification cannot establish who created the original content, whether it was stolen, or whether the files are connected to a real incident involving Rockstar. The verification method follows Solana's reference signature implementation; file checksums and verification results are included in the evidence appendix.
Eight Domains, Six Registrars
Registration (RDAP) and DNS data were retrieved on October 13. A domain's registration date is not necessarily the date a token was created, content first appeared, or a payment offer went live. Registrars and CDNs serve many unrelated customers.
Eight Domains, Six Registrars
Registration (RDAP) and DNS data were retrieved on October 13. A domain's registration date is not necessarily the date a token was created, content first appeared, or a payment offer went live. Registrars and CDNs serve many unrelated customers.
Domain | Registration (UTC) | A record | NS |
22.08 · 03:03:11 | 188.114.97.1, 188.114.96.1 | AMIR / BRENDA .ns.cloudflare.com | |
20.08 · 23:15:35 | 172.67.166.158, 104.21.33.206 | ken / vera .ns.cloudflare.com | |
26.08 · 18:15:44 | 104.21.47.166, 172.67.171.173 | albert / naya .ns.cloudflare.com | |
22.08 · 16:32:18 | 212.2.234.152 | ns1–ns4.fornex.com | |
29.08 · 14:40:16 | 91.236.136.29 | ns1–ns2.webhost1.com, ns3–ns4.webhost1.org | |
26.08 · 00:23:36 | 80.97.124.250 | alpha / beta .alexhost.com | |
09.10 · 18:48:05 | 31.31.196.3 | ns1–ns2.hosting.reg.ru | |
22.08 · 06:36:48 | 162.35.101.236 | CRYSTAL / NASH .ns.cloudflare.com | |
— | 49.13.45.141, 162.55.156.39 | Gateway / subdomain | |
— | 49.13.45.141, 162.55.156.39 | Gateway / subdomain |
Registrars: www.cyberleek.cc — Cloudflare, Inc.; cyberleek.org — NameCheap, Inc.; cyberleek.wtf — Tucows Domains Inc.; cyberleek.space and cyberieek.space — NameSilo, LLC; cyberleek.world — Global Domain Group LLC; cyberleek.press — REG.RU LLC; www.cyber-leek.com — Cloudflare, Inc. Full responses and IANA identifiers are preserved in domains.json.
What the records show:
What the records show:
- .cc, .org, and .wtf use different pairs of Cloudflare name servers. Sharing a security provider does not establish common ownership.
- cyberieek.space uses an i in place of the l; it is a separate domain.
- .space, .world, and .press are hosted by different providers.
- Server IP addresses and locations say nothing about the owner's country or citizenship.
- leek.ar.io and cyberleek.turbo-gateway.com are gateway URLs with identical A records. The registration dates of the gateways' root domains do not establish when Cyberleek content was hosted or who controlled it. In the supplied evidence package, one gateway returned HTTP 451 and the other an unavailable-page response; the content they currently serve could not be confirmed.
- SSL certificate history was unavailable because of errors at the source, so earlier subdomains may be missing from the list.
Telegram, a Dead Man's Switch, and a $376,750 Counter
Telegram, a Dead Man's Switch, and a $376,750 Counter
The public @cyberleak channel regularly links to .wtf, and the .wtf site links back to the channel. This confirmed cross-linking does not identify the channel's administrator or establish control of any Solana keys. Twenty accessible messages were archived, not the full channel history.
Post | Date (UTC) | Content |
28.08 · 12:50:43 | Links to .wtf and gives the promised August 29 release window | |
29.08 · 20:57:46 | Market-cap claim; not evidence of funds actually received | |
01.09 · 12:33:48 | Offer of rewards for TikTok promotion | |
04.09 · 21:51:30 | Promise to release the build if the dead man's switch is triggered | |
18.09 · 23:16:54 | Claim that a server was being prepared |
A dead man's switch is a mechanism that automatically releases files if its operator stops checking in. The current .wtf website says the switch has been triggered, the release is free, and there are no token sales or presales. That conflicts with the payment offers on .cc and .org. The discrepancy helps track how the campaign and its mirror sites changed, but it does not, by itself, prove a site takeover or common ownership.
The .wtf source code contains a form for submitting contact information and links to materials. Submissions are routed through the Cloudflare Worker bold-sunset-fe9d.addict0184.workers.dev to Telegram. The addict0184 subdomain is a specific lead for comparing public accounts, but a matching username does not identify a person. On .world, the form posts to /send.php. The researchers did not submit the forms or execute any files. The code identifies an intended channel for transmitting data, but does not prove that visitors' information was stolen.
The $376,750 counter on .world is hard-coded in the HTML; there is no evidence of payments totaling that amount. Independent GitHub mirrors describe themselves as unofficial. Their code was used only to compare interfaces and data formats; no proof connects their operators to the token creator. Repositories with similar names or tickers were not included in the proven cluster unless token mints and keys matched.
The .wtf source code contains a form for submitting contact information and links to materials. Submissions are routed through the Cloudflare Worker bold-sunset-fe9d.addict0184.workers.dev to Telegram. The addict0184 subdomain is a specific lead for comparing public accounts, but a matching username does not identify a person. On .world, the form posts to /send.php. The researchers did not submit the forms or execute any files. The code identifies an intended channel for transmitting data, but does not prove that visitors' information was stolen.
The $376,750 counter on .world is hard-coded in the HTML; there is no evidence of payments totaling that amount. Independent GitHub mirrors describe themselves as unofficial. Their code was used only to compare interfaces and data formats; no proof connects their operators to the token creator. Repositories with similar names or tickers were not included in the proven cluster unless token mints and keys matched.
What Is Proven—and What Is Not
What Is Proven—and What Is Not
Blockchain records show which key signed each transaction. They do not show who holds that key. The table below summarizes the identified actors, their verified roles, and the limits of the evidence.
Address / entity | Verified role |
Created the first token; supplied liquidity; held the Fee Key; collected fees and distributed SOL | |
Deployed and controlled the website program; published content; received voting proceeds | |
Program storing content, announcements, voting records, and settings | |
CYBERLEEK token; no further minting or freezing is possible | |
Shared payment wallet currently displayed on .cc | |
Shared payment wallet displayed on .org | |
Grand Theft Leek / CYBER token (Token-2022 standard) | |
Created the second token; one of two recipients of its fee distributions |
Roles were established through signatures, instruction types, authority records, and payment addresses in saved website code. A transfer between two addresses establishes only a financial link. A claim of common control requires at least one of three forms of evidence: reuse of the same key, demonstrable control over both accounts, or a verified link between an operator and a service account.
Exchanges and Services Along the Money Trail
Exchanges and Services Along the Money Trail
Some transfers originated from addresses associated with major services. This does not mean the organizers were direct customers of those services: a single service address can serve thousands of users.
Address | Basis for label | Limit of inference |
Solscan Public Name: Robinhood Hot Wallet | Paid transaction fees for .org and 9mp; use of the same service does not establish the same customer | |
Solscan Public Name: Revolut Hot Wallet | SOL and USDC payouts to .cc; the sending customer is unknown | |
Address listed in Bybit's official proof-of-reserves report dated February 26, 2026 | Historical inclusion in Bybit's list; an October transfer does not identify the customer |
The full iGd address was located in Bybit's official PoR report, page 19. Dwdr and Biw were identified using the Dwdr page on Solscan and the Biw page on Solscan. Each label applies only to the specified address and cannot automatically be extended to connected wallets.
What Remained in the Wallets
What Remained in the Wallets
The bottom line is straightforward. The token creator who collected 2,676 SOL has only 0.052 SOL left in the wallet: the proceeds were moved out. The publication key still holds roughly 821,000 CYBERLEEK, with no recorded sales. The two websites hold just over 480 USDC between them. The available evidence does not establish anyone's country, citizenship, personal profit, or criminal role.
Methodology and Data Limitations
Methodology and Data Limitations
The initial dataset contained 2,506 unique successful Solana transactions and 15 failed ones. The combined version 2 ledger contains 3,784 successful transactions and 69 failed ones. Failed transactions were excluded from transfer totals, but their fees were included in the balance reconciliations. All amounts were calculated in lamports and base token units, without rounding. Thirty-three baseline numerical checks passed; the NEAR branch and relationship graph were reviewed in separate QA files.
All successful transactions were decoded from the retrieved histories of Hok, 6Nq6, .cc, .org, 9mp, Ec2, 3YLND, Ece, the main intermediate funding sources, the second token's three fee recipients, and their token accounts. For each address, the history was collected to the endpoint returned by the data provider. That does not guarantee coverage of previously closed accounts or unknown addresses.
The dataset has the following limits:
All successful transactions were decoded from the retrieved histories of Hok, 6Nq6, .cc, .org, 9mp, Ec2, 3YLND, Ece, the main intermediate funding sources, the second token's three fee recipients, and their token accounts. For each address, the history was collected to the endpoint returned by the data provider. That does not guarantee coverage of previously closed accounts or unknown addresses.
The dataset has the following limits:
- Histories of major service addresses iGd and Biw were limited to 3,000 signatures; J4zo and the second token's fee source were limited to 1,000.
- Only selected funding transactions were decoded for 26sZ and 9WwE; no claim is made to have reconstructed all their activity.
- For 8ru, the selected period begins after the large payouts.
- During the update, one provider returned only seven signatures for .cc and .org, while an independent provider returned 22 and 19, respectively. The shorter result was not treated as proof that earlier transactions did not exist.
- A token-mint history accidentally truncated at 2,000 signatures during the update was not used as a complete record of all token burns.
The signature counts, decoded operations, missing records, and reason for stopping the search at each address are documented in coverage.csv. Unknown owners and service boundaries remain explicitly marked in the relationship graph.
Further progress would require:
Further progress would require:
- Customer-level records for service payments involving Ec2 and 3YLND;
- Change logs and hosting payment-account records for .cc and .org;
- Confirmation of the owners of 3Afn, eS4, and 66Z;
- Records showing what happened to the internal NEAR Intents account after the deposit;
- Evidence of where the offered files came from and whether the publications relate to a real incident.
Each would require new primary-source evidence.
Evidence Appendices
Evidence Appendices
The package preserves the original case materials and a separate verification directory. The original 380 files listed in the supplied SHA256SUMS were left unchanged; the final integrity check is recorded in PACKAGE_QA.json. For newly retrieved responses, the URL, method, parameters, UTC timestamp, status, original response body, and SHA-256 hash were saved. The provenance of external leads is retained in working materials; the findings rest on the primary evidence listed below.
File | Contents |
coverage.csv | Transaction histories and actual data coverage by address |
transactions.csv | Unique successful transactions; signer roles and balance changes |
native_transfers.csv | SOL transfers; separate instruction path |
spl_transfers.csv | Token transfers, mints, token-account owners, and authority |
vote_claims.csv | 17 ProcessResults payouts, amounts, and UTC timestamps |
creator_fee_ledger.json | Gross fees, subsequent payments, and reconciliation of 98 fee-related operations |
site_ledgers_v2.json | Updated .cc/.org transactions and balance reconciliations |
org_ledger.csv | Operations of the .org payment recipient |
CYBERLEEK_VERIFIED_GRAPH_V2_2026-10-13.graphml | Verified routes, signatures, assets, and limits of common-control attribution |
stake_withdrawals.csv | Stake Program withdrawals: separate instruction path and amount |
round2_NEAR_proof.json | NEAR Intents deposit-credit events and current balance |
program_accounts_verified.json | Independent decoding of 37 program accounts |
site_chain_comparison.json | Matching on-chain and local website records |
domains.json | Domain registration data, DNS, URLs, and UTC times of primary responses |
creator_fee_events.json | Distribution events decoded according to the official interface description (IDL) |
creator_fee_summary.json | Gross and net totals without double-counting |
arweave_signature_verification.json | Five verified signatures and content SHA-256 hashes |
funding_boundary_v2.json | 75 addresses: inclusion criteria, external inflows, and outflows |
funding_balance_checks.json | Balance reconciliations and history gaps for each address |
transaction_index.json | Unified register of primary-source transactions |
QA_V2.json | Version 2 QA checks |
All transactions referenced in this article (T01–T56 and V01–V23) are linked to Solscan, Blockstream, NearBlocks, and Arweave in the relevant sections. Full transaction signatures are preserved in the source report.
All figures are current as of October 13, 2026. At 08:14:15 that morning, analysts captured the blockchain state at slot 456372231 and used it to calculate wallet balances. Data for the .cc and .org payment addresses and the original token was refreshed later, at 10:26:38 (slot 456408707). All times throughout this article are in UTC.
