Account hacked and all my items traded away

[Baithoven]

6:46 am and 6:55 I appearently, while I was asleep, traded away all my CS and Dota 2 skins to an account I've never seen before.

roughly 500 items neatly listed in my trade history.
I have never traded anything except few items between friends back around 2014.
I never used any 3rd party trade websites or anything of the sort.

How can I get my stuff back? I have reported the account in Steam Support. Is that enough?

Edit: I use 2FA and have no notifications about anyone trying to log into my account.

[Lilim]

Originally posted by P不:

6:46 am and 6:55 I appearently, while I was asleep, traded away all my CS and Dota 2 skins to this guy:

Please remove that link. Naming & Shaming is not allowed.


Your account is compromised.

Do not trade until your account is secured.

Take the following steps to secure your account:

1. Scan for malware. Use your own antivirus programm or use https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Originally posted by P不:

How can I get my stuff back? I have reported the account in Steam Support. Is that enough?

Steam does not return inventory items or wallet funds: https://support.steampowered.com/kb_article.php?ref=3415-WAFH-6433#noreturn

[Lilim]

Originally posted by P不:

I never used any 3rd party trade websites or anything of the sort.

• Did a friend send you a message to vote for their team/tournament/pixel art?
  
• Did you use any third-party site for gambling or trading?
  
• Did you log in on a public device?
  
• Did you enter any giveaways/giveaway groups?
  
• Did you try to claim any "free 50$ gift cards"?
  
• Did you talk to an "admin" after being "accidentally reported"?

[Baithoven]

I removed the scammers/hackers account name.

I will carefully follow these steps to secure my account.

So there's literally nothing I can do to get my items back?

[Baithoven]

Originally posted by Lilim:

Originally posted by P不:

I never used any 3rd party trade websites or anything of the sort.

• Did a friend send you a message to vote for their team/tournament/pixel art?
  
• Did you use any third-party site for gambling or trading?
  
• Did you log in on a public device?
  
• Did you enter any giveaways/giveaway groups?
  
• Did you try to claim any "free 50$ gift cards"?
  
• Did you talk to an "admin" after being "accidentally reported"?

No, never. I simply play CS:GO and Dota 2 with my IRL friends. I don't do anything outside of that.

[Cathulhu]

Correct. The items are gone. You are responsible for the security of your account and all actions on it.
You failed to secure your account properly, now you have to deal with the consequences of your actions.

[Lilim]

Originally posted by P不:

So there's literally nothing I can do to get my items back?

Unfortunately, Steam no longer returns items.

You need to find out how your account was compromised (it's either phishing or malware, see my list above).

[Baithoven]

Originally posted by Cathulhu:

Correct. The items are gone. You are responsible for the security of your account and all actions on it.
You failed to secure your account properly, now you have to deal with the consequences of your actions.

Any ideas how people usually fail to do this? I use 2FA and haven't submitted my account ID or name anywhere at any point. I don't even answer phone calls if I don't know the number. I haven't clicked any shady/unknown links. I haven't downloaded anything from any untrusted websites.

And again, I never bought, sold or traded anything outside the steam market, and have only done this in Steams own UI and Dota 2 in-game picking phase UI.

[Baithoven]

Originally posted by Lilim:

Originally posted by P不:

So there's literally nothing I can do to get my items back?

Unfortunately, Steam no longer returns items.

You need to find out how your account was compromised (it's either phishing or malware, see my list above).

Will do. Thank you.

[Cathulhu]

Originally posted by P不:

Originally posted by Cathulhu:

Correct. The items are gone. You are responsible for the security of your account and all actions on it.
You failed to secure your account properly, now you have to deal with the consequences of your actions.

Any ideas how people usually fail to do this? I use 2FA and haven't submitted my account ID or name anywhere at any point. I don't even answer phone calls if I don't know the number. I haven't clicked any shady/unknown links. I haven't downloaded anything from any untrusted websites.

And again, I never bought, sold or traded anything outside the steam market, and have only done this in Steams own UI and Dota 2 in-game picking phase UI.

You must have leaked your account name, the password and the SteamGuard code valid for a few seconds only at some point in the past.
Up to you to find out when you did that and how it happened.
Or it will happen again when you repeat your mistake.

[Muppet among Puppets]

Someone needed account name, password and a code at a time to get in your account.
Either you did it, or malware.

[Supafly]

Originally posted by P不:

I haven't downloaded anything from any untrusted websites.

Even trusted websites can be compromised and that can lead to a modified application being switched in. Thus you should always scan anything you download, no matter where you download it from

[Baithoven]

Originally posted by Muppet among Puppets:

Someone needed account name, password and a code at a time to get in your account.
Either you did it, or malware.

I might be dumb, but I don't really understand how to bypass Steam Guard 2FA.
I suppose this means it's malware and it's all done through my PC since it would be impossible to log in to my account without me getting a notification. The only thing I found was 2 notifications of the trades.

[Cathulhu]

It wasn't bypassed. You gave to code to someone else.

[Baithoven]

Originally posted by Cathulhu:

It wasn't bypassed. You gave to code to someone else.

I haven't given any code to anyone, if there's malware on my PC, how can that bypass a code generated on the Steam app of my phone? Or how do you mean?

[Cathulhu]

It could be malware on your phone. Or a keylogger on your PC that captured and transmitted the code while you were entering it.