The leaks just do not stop coming. With the sheer amount of Nintendo source code, games, and information being leaked online over the past few days, we decided to do some sleuthing to see if we could track down the original leaker(s) who set this whole Nintendo leak extravaganza in motion. What we found appears to be much greater than that – while searching for the originator of the leaks, we inadvertently stumbled upon freshly leaked info as it was unfolding.
We found a group of users who had just recently posted photos of what appear to be an early prototype Wiimote, along with the entire Wii startup disc code, unreleased Wii games, and much more. In this article, we will explain exactly how we stumbled upon all of this info and what other leaks appear to be coming in the future.
As previously mentioned, we originally started out in search of finding the source who first leaked these files onto 4chan. Since 4chan is primarily intended to be “anonymous”, that made this a fairly difficult task. We had originally speculated that all of the leaks might in some way be connected with Ryan Hernandez, aka RyanRocks462 – the guy who was arrested and pleaded guilty to federal crimes related to his computer hacking scheme.
In Wired’s coverage of the original story from back on February 25, 2020, they explain that according to court documents, Hernandez signed up for a Nintendo Developer account which granted him access to proprietary information after accepting a nondisclosure agreement. Wired then goes on to say that this information then began appearing on a Twitter account linked to Hernandez, and when asked by Nintendo to stop via a cease and desist, Hernandez then went a step further.
Wired states that Ryan Hernandez asked for technical assistance on the Nintendo developer portal, which included him sharing a malicious link, which when clicked on by the Nintendo employee, allowed Hernandez to hijack the employee’s credentials and upload malware onto the portal (getting even more credentials). Wired then goes on to say that Hernandez worked his way into several privileged servers and continued his leaking spree, even after promising the FBI that he would stop.
Hernandez became the hot-spot for his own Nintendo leaks and those of other leakers as well. “Basically if you needed anything to leak and did not want to be associated with the leak, you gave it to Ryan,” said Gary.
Allegedly, legend says that Ryan Hernandez even went to E3 2016 and tried to steal the Breath of the Wild demo from the Wii U kiosks over the network.
So clearly, Ryan Hernandez was a prominent figure in the Nintendo leaking community at the time, with his now deleted twitter account RyanRocks462 and seemingly removed Discord server “Ryan’s Underground Hangout” both being a hot spot for Nintendo leaks. With this in mind, we began searching online for any profiles we could find which were still available and tied to Hernandez.
Through our sleuthing, we found this Github account which appeared to be Ryan’s. We combed through the Github account’s repositories and its followers. At the time, nothing exactly jumped out at us, but it was this list of followers that later helped us piece things together just a bit more.
We later took to Twitter to do some more research and see if we could narrow down our search. We were able to track down a user who had tweeted that they knew Ryan, claiming to be an acquaintance of him. In this Twitter user’s profile, we found that they had recently tweeted to a user named “ecumber”. After looking through ecumber’s recent tweets, we stumbled upon a tweet that they had made regarding the leaks. And in the replies of their “L is real” tweet, they gave us a clue of where to search next.
After a quick google search, we found the website. From here, we located the associated Discord server. After joining, we were able to quickly gather information using Discord search. In this Discord server, we found some of the very same usernames for members that were listed in the followers section of RyanRock’s Github. Further searching led to evidence that a few of the members not only knew of RyanRocks, but also used to be friendly with him (before news surfaced of his nefarious acts regarding children). To be clear, we are not saying that this is irrefutable evidence that all of the original leaks trail back to RyanRocks, but the connection was important to note.
We will not be sharing links to any of the files mentioned in this article for obvious reasons.
We found an entire Google doc which has effectively cataloged every single bit of information found so far in the first rounds of leaks from July 24 – 25, 2020. This doc is updated often and is quite thorough. At the bottom of the doc, there is what appears to be an…interesting Argonaut Games (the company who made Croc) internal email from 1994. The email is pretty explicit, with the first line reading “Wow, some justification for distributing porn around the office.” The email then goes on to list some very intense stuff – it appears to be a pretty angry email exchange.
The doc also has a link to a Pastebin which contains code for a tool to decode internal Nintendo emails – this is pretty heavy stuff.
One of the most interesting pieces of info that we uncovered was this chain of messages that ranged from May 2, 2020 – July 9, 2020. Messages were sent regarding the “leak” back in May, and then on July 9th (over 2 weeks before the leak was released to the public on 4chan), a user posted about the Pokemon Generation 1-4 leaks, The iQue and Wii leaks, 3DS leaks, etc. They even claimed “we didn’t start the fire” – very interested how they knew about all of this well before it was released to the public.
What’s even more interesting is that the account that posted this message is one of the followers on RyanRock’s Github account we mentioned earlier. Below this post, you can even see a post about what is believed to be the naughty video that was found in the leaked files.
We then found photos of what appear to be prototype Wii remotes, a strange early Wii system console, the Wii startup Disc code, and the following:
It looks like an internal spreadsheet containing a list of unreleased Wii games has been uncovered. Also, it appears that even more dirty videos have been found – this time allegedly being linked to Nintendo employees.
Additionally, it appears that a floor plan of a Nintendo office has been found and 2 separate versions of the Wii startup disc are known to exist and have been leaked.
Along with the information and files that have already been leaked, from what we can tell, it seems like there is quite a bit more on the way soon. Members of the community had stated that they are sitting on heavy information, waiting for the proper moment to leak it, with one user stating that the leak would make the community “blow up”. At this point, we do not feel confident making any definitive claims as to who the exact leaker(s) is/are, but one thing seems clear – the leaks aren’t over yet.
The community continues to sift through files, uncovering hidden secrets about Nintendo and its properties that we never knew existed. While some members of the community may be running the fine line of legality, their dedication and ingenuity are quite impressive. Who knows what further information will surface in the coming days?
We will continue to update this article live as more information becomes available.
We do not recommend downloading any of the leaked files. Openly reading about them, researching, and discussing them are one thing, but downloading them and having them on your machine are another. Furthermore, you have no idea if the people who are reuploading these leaked files have added viruses or malware – in general, it’s best to just not do it.