Arion Kurtaj has reportedly been moved from a secure hospital to a regular prison while awaiting a conventional criminal trial in November.
He has not been freed.
That is the most important correction to the viral headlines spreading across gaming sites and Reddit. BBC cyber correspondent Joe Tidy says Kurtaj is out of the secure hospital where he had been held since 2023, but he remains in custody inside a normal prison.
The change is legal and medical.
It is not a release into the community.
What Joe Tidy reported
Tidy said he could finally report that Kurtaj had left the secure hospital and was now in a regular prison awaiting retrial.
He also said a conventional criminal trial is scheduled for November.
According to Tidy, photographs and videos that appeared to show Kurtaj posting from prison had circulated online before the update became public. He had spent weeks trying to establish what happened, while police would not confirm the situation and reporting restrictions prevented publication.
Tidy said a High Court judge later lifted those restrictions.
That makes his report the strongest available source for the transfer and November trial.
It does not answer every legal question.
The charges to be tried, the precise procedural order and the detailed reason for the transfer have not been fully explained in public reporting.
He was moved, not released
Several headlines use phrases such as “released from hospital.”
Technically, that describes leaving the hospital.
It does not describe his custody status.
Kurtaj is reportedly in prison. He has not returned home, been placed on ordinary bail or been declared free of the criminal proceedings.
The accurate sequence is:
- Kurtaj was detained in a secure hospital under an indefinite order.
- His situation was reviewed.
- He was transferred into ordinary prison custody.
- He is awaiting a conventional criminal trial scheduled for November.
That is very different from “GTA 6 hacker released.”
The word released creates an image of someone walking away from custody.
That is not what Tidy reported.
Why the 2023 case was unusual
Kurtaj did not go through a normal criminal trial in 2023.
The court found him unfit to plead, meaning he was not considered able to participate properly in the ordinary trial process at that time.
When a defendant is found unfit to plead in England and Wales, a jury can be asked to decide whether the person carried out the acts alleged by prosecutors.
That proceeding is sometimes described as a trial of the facts.
It does not ask the jury to decide criminal guilt in the usual way. The jury does not make the standard judgment about whether the defendant committed the offence with the required mental element.
In Kurtaj's case, the jury found that he had carried out the relevant hacking acts.
That finding supported the court's decision to impose a hospital order.
It was not the same as a normal conviction after a defendant had entered a plea and participated in a full criminal trial.
What the Court of Appeal later confirmed
A 2025 Court of Appeal decision gives the clearest legal summary of the earlier proceedings.
The court recorded that Kurtaj faced twelve charges connected with computer hacking. The trial judge found him unfit to plead under the Criminal Procedure (Insanity) Act 1964.
A jury then found that he had done the relevant acts.
Kurtaj challenged those findings, including the use of evidence about previous hacking convictions. The Court of Appeal accepted that admitting some of that evidence had caused unfairness, but decided it was not central enough to make the jury's findings unsafe.
His appeal was dismissed.
That means the findings that he carried out the acts remained in place.
The reported November trial raises a separate issue: whether criminal responsibility can now be determined through the conventional process that could not take place in 2023.
Why a normal trial may now be possible
English law provides a route for proceedings to resume if someone who was previously unfit to plead later becomes able to stand trial.
Government guidance describes how a prosecution can be resumed when a patient becomes fit to plead. A person can be moved back into prison and returned to court for the ordinary criminal process.
That appears consistent with what Tidy has reported.
Still, caution is needed.
Leaving a secure hospital, being considered safe enough for prison and being legally fit to participate in a trial are related questions, but they are not identical phrases.
Public reporting has not yet provided the fresh medical evidence, court order or full legal reasoning behind Kurtaj's transfer.
So the article should not invent a diagnosis update or claim a specific doctor made a specific finding unless that document becomes public.
The confirmed practical result is enough:
Kurtaj is in prison, and a conventional trial is scheduled.
What happened in the Rockstar breach
The Rockstar Games intrusion occurred in September 2022.
Around 90 videos from an unfinished GTA 6 development build appeared online. The footage showed early gameplay, test environments, animation work and the protagonists later officially identified as Jason and Lucia.
The leak became one of the largest unauthorized releases of material from an unfinished video game.
Rockstar confirmed that an unauthorized third party had accessed confidential information from its systems. The company said it did not expect the breach to cause a long-term delay to its live services or current projects.
During the later court proceedings, Rockstar said recovering from the incident cost approximately $5 million and required thousands of staff hours.
That figure referred to recovery work.
It did not mean the leaked videos had a market value of $5 million.
The hotel-room story remains extraordinary
The details surrounding the breach made Kurtaj's case famous beyond GTA fans.
He was already in police protection at a Travelodge and had restrictions on his access to technology after previous allegations involving other companies.
His laptop had been confiscated.
The court heard that he still used an Amazon Fire Stick, a television and a mobile phone to access Rockstar's systems.
After obtaining material, he entered the company's internal Slack and threatened to release source code unless Rockstar contacted him.
The GTA 6 footage then appeared online.
The story sounds like something written for a cybercrime film by someone worried the hacking scene was not dramatic enough.
It was also part of a wider set of allegations involving the Lapsus$ group and attacks against companies including Nvidia, Uber and BT.
Why the court ordered hospital detention
At the December 2023 hearing, the court received evidence about Kurtaj's condition, behavior and stated intention to return to cybercrime.
A mental health assessment said he remained highly motivated and continued to express the intention to resume cybercrime when possible.
The court imposed an indefinite hospital order.
Indefinite did not automatically mean he had received a conventional life prison sentence.
It meant there was no fixed release date. He could remain in the secure hospital unless the relevant medical and legal authorities decided he no longer met the conditions requiring that detention.
The possibility of a long stay was real.
The possibility of review was also built into the order.
His transfer to prison now shows that the hospital order was not simply a permanent prison sentence wearing medical language.
His legal case is continuing.
Do not confuse fitness with innocence
Some online comments treat the new trial as proof that the earlier court got everything wrong.
That does not follow.
A person's ability to understand and participate in a trial can change over time. A finding of unfitness concerns the fairness and practicality of the court process, not whether the alleged acts happened.
The 2023 jury found that Kurtaj carried out the relevant acts.
The 2025 Court of Appeal left those findings standing.
A conventional trial can now examine criminal guilt through the ordinary process, including any questions about intent, participation and legal responsibility that were not decided in the same way during the trial of the facts.
Kurtaj remains entitled to the presumption of innocence in that conventional trial.
The previous findings are part of the legal history, but they should not be rewritten as a normal conviction that already settled every issue.
What does “retrial” mean here?
Gaming coverage is using the word retrial because Kurtaj is returning to court for a conventional criminal case involving conduct already examined through the earlier special procedure.
That is understandable.
It can also create confusion.
The 2023 jury did not conduct the same type of trial that is now being reported. It determined whether he did the acts charged after he was found unfit to plead.
The November case is expected to be the normal criminal trial that could not proceed at that point.
The safest wording is:
Kurtaj is awaiting a conventional criminal trial, widely described as a retrial, in November.
The exact indictment, timetable and scope should be confirmed when the court publishes or reporters obtain more details.
Could he receive another sentence?
Possibly.
A conventional criminal trial can result in acquittal or conviction. If there is a conviction, the court would then decide the appropriate sentence using the offences, evidence, circumstances and applicable law.
It would be reckless to predict that sentence now.
The court may need to consider the time Kurtaj has already spent in custody and hospital care, his medical history, risk evidence and any change in circumstances.
Public reporting has not explained how those factors will be handled in this specific case.
Headlines promising another life sentence, immediate release or a brief punishment are guessing.
November comes first.
Why the story exploded again
The GTA 6 leak remains one of the most recognizable stories in modern gaming.
The legal update also arrived only months before the game is scheduled to launch on November 19, 2026.
That coincidence writes its own headline.
The person linked to the huge 2022 footage leak may face a conventional trial during the same month players finally receive the finished game.
A viral r/gaming post about the transfer attracted thousands of votes and hundreds of comments before being removed by moderators.
Much of the discussion focused on whether Kurtaj had been freed, whether the earlier order was a life sentence and how the legal system could try him now.
Those are reasonable questions.
They also show why accurate wording matters.
The GTA 6 release is not part of the court case
The timing is interesting, but there is no known legal connection between the trial month and Rockstar's release schedule.
Rockstar currently lists GTA 6 for November 19 on PlayStation 5 and Xbox Series X|S.
The court is not scheduling around a video game launch for dramatic effect.
There is also no evidence that Kurtaj's trial will alter the game's release, reveal new footage or force Rockstar to discuss development details publicly.
The prosecution concerns alleged cybercrime.
It is not a GTA 6 preview event.
Any evidence shown in court may be subject to reporting restrictions, redactions or limits designed to protect companies and ongoing proceedings.
Is he still considered dangerous?
Tidy's post says Kurtaj could remain in the secure hospital unless doctors judged him no longer a danger, and that he has now been moved out of that setting.
That suggests the assessment supporting hospital detention has changed.
It does not prove that authorities consider him to pose no risk at all.
He is in prison.
Risk can be managed differently in a prison environment, and the legal threshold for remaining in a secure hospital is not the same as the everyday meaning of harmless.
Without the updated medical and court documents, stronger claims would be speculation.
The responsible wording is that he no longer appears to be detained under the same secure-hospital arrangement.
What happens next
The next important information should come from court listings, accredited reporters and official legal documents.
Questions still needing answers include:
- The exact November trial date
- Which charges are included
- Whether every original allegation will be retried
- The legal order that moved him from hospital to prison
- Whether a fresh fitness-to-plead decision has been recorded
- What reporting restrictions remain
- How prior findings and time in detention will be treated
- Whether the trial timetable could change
Until those details appear, the headline update should remain narrow.
Kurtaj has moved.
He is still detained.
A normal criminal trial is expected in November.
The simple answer
What happened to the GTA 6 hacker?
Arion Kurtaj was not freed.
BBC cyber correspondent Joe Tidy reports that he was transferred from a secure hospital into a regular prison and is awaiting a conventional criminal trial in November.
The earlier 2023 proceeding took place after Kurtaj was found unfit to plead. A jury decided that he carried out the alleged acts, and the court imposed an indefinite hospital order based on medical and risk evidence.
The coming trial is expected to address criminal responsibility through the ordinary process that could not happen then.
The legal story has moved forward.
Kurtaj has not walked away from it.
