GTA 6 hacker CyberLeek wants six figures for access to its private ad channel

CyberLeek, the hacker behind the spate of recent GTA 6 gameplay leaks, has found a new monetisation opportunity, and this time, it involves more than peddling a meme coin. Their 'official' website (not linked here for obvious reasons) now offers advertising placements, branded watermarks and custom-made gameplay footage, including adult material, to prospective clients. The entry fee isn’t cheap, though. To get their foot in the door, interested parties must pay 400 XMR (about $169,000 at the time of writing). The payment guarantees that CyberLeek will initiate a private conversation through Session within 24 hours. 

When a visitor clicks the ‘Contact’ button on CyberLeek’s website, the page claims to generate a new Session account and recovery password. It then displays a unique Monero amount, with 12 digits after the decimal point acting as an identifier. Buyers are told to send the exact amount from a personal wallet because exchanges tend to round the transaction or deduct a fee. CyberLeeks has chosen Monero because it hides transaction amounts from public blockchain observers. Thus, the recipient’s wallet can privately identify and decrypt payments intended for it. Using a unique fractional amount as a private invoice number is a clever way to reconcile payments, allowing the sender and recipient to match the transaction without leaving much of a forensic trail. With Take-Two going full best mode on CyberLeeks, it is only a matter of time before the hacker is forced to abandon the above pathway and construct something more labyrinthine. 

CyberLeek can apparently use those 12 digits to reconstruct the buyer’s Session identity without storing a record on a server. That is where the scheme fails the smell test. Twelve decimal digits represent about one trillion possible values, or roughly 40 bits of information. A normal Session account is derived from a random 128-bit seed. If the 12-digit value alone deterministically generates the account, the resulting identity has no more than about 40 bits of effective entropy. If the account instead uses a full-strength random seed, it cannot be recovered from only 12 decimal digits. The implementation may use workarounds, but at the time of writing, there's no proof that it even works, and the only way to find out is rather...expensive. 

While the system is undoubtedly creative, it has its share of shortcomings. For starters, paying to associate a brand with allegedly stolen game footage would create an obvious legal and reputational liability- not a problem for already shady operations, only legitimate ones. Anyone with $169,000 to spend also has plenty of legitimate (or less than legitimate) advertising options. Recouping that amount, plus whatever CyberLeek actually charges for an advert, would be a separate challenge. GTA 6 fans are here for gameplay footage, not unsolicited advertising from unscrupulous third parties.