THE DEFENCE NAMES ALL THREE.
Valve must answer for every game it puts behind its defence.
The New York response brings CS2, Dota 2 and Team Fortress 2 into one account of value, security and consumer rights. The documented controls do not cover them equally. Follow the gap between the statement, the protection available to a victim and the power Valve exercises over the same assets.
EXISTING LAW / A GLOBAL PLATFORM
A greeting addressed to New Yorkers does not confine the economic mechanism to New York. Valve operates the account, inventory and transfer infrastructure across territories. The question is how existing law applies to the transactions it offers.
The 25 February 2026 filing expressly examines TF2 and Dota 2 alongside Counter-Strike. Paragraphs 67–74 describe their paid random-item mechanisms. Naming all three in the response therefore creates a responsibility to explain protection in each.
NYAG invokes existing New York law and seeks an injunction, consumer financial relief, disgorgement and a penalty. Valve’s preference for future legislation does not decide that dispute. The requested relief is set out on PDF pages 50–51.
Product or infrastructure changes applied across Steam could affect users elsewhere. The reach of an actual remedy must be read from the order and its implementation. A New York decision does not automatically rewrite every jurisdiction’s law. Valve’s own regional container rules demonstrate that territorial implementation is also possible.
Valve’s Steamworks documentation identifies Perfect World as the partner for an onshore Steam China. It requires government approval before a game is published there and an ISBN displayed on the product page. Valve can therefore describe regional partners, approval requirements and a distinct product configuration when that is how it enters a market.
The comparison sharpens the New York question: identify the actual proposed obligation, the implementation alternatives and their cost. The Russian funding-provider record raises a separate demand for intermediaries, territorial controls and the transactions they process.
THE SCOPE OMITTED FROM THE REASSURANCE
A completed-trade reversal and a delay before delivery do different jobs. A platform-wide defence should identify which remedy each player receives.
| Control | Counter-Strike 2 | Dota 2 | Team Fortress 2 |
|---|---|---|---|
| Named in Valve’s response | Yes | Yes | Yes |
| Reverse a completed Trade Protected trade | Yes · 7 days | Not supported | Not supported |
| Mechanism | Immediate delivery; protected items cannot move again during the window. | General account, trade and item restrictions still apply. | General account, trade and item restrictions still apply. |
| Before-delivery hold | CS2 is excluded from the old hold / escrow system. | The general policy can hold delivery for up to 15 days depending on authenticator conditions. That is not a right to reverse a completed transfer. | |
The Trade Protection FAQ names CS2 as the only supported game. Reversal undoes all protected trades from the preceding seven days and imposes a 30-day trade and Market cooldown on the initiator. Counterparties do not receive that cooldown merely because another person reversed.
Dota 2 and TF2 users appear in the defence. They do not receive the reversal it invokes. Valve should publish the reason for the difference, the rollout timetable and the theft losses left outside the remedy.
A July 2019 bug made some crates produce an Unusual hat on every opening. Valve fixed it the following morning and locked the affected hats. Its announced remedy made the first affected hat per account tradable, kept additional ones locked, restored qualifying deleted hats and offered eligible refunds for hats, crates and keys. The 16 August update confirmed the selective release.
That is active administration of scarcity and consumer remedies. Put the same specificity into the theft policy: identify the affected item, the available intervention, the reason for refusal and who bears the loss.
ECONOMIC VALUE / PERSONAL LOSS
Items can serve as an appearance, a remembered collection and an exchange instrument at the same time. Preserved Dota testimony describes cosmetics as support for the game and a refused restoration. This is an account of personal loss beyond the case-opening transaction.
The investigation’s hypothesis is that personal attachment, resale liquidity and theft-related departure differ across games. A defensible comparison needs item-level transfer rules, comparable price and turnover data, dated theft incidents and subsequent play activity. Arcanas and TF2 keys should be assessed as specific items, not used to classify every inventory.
The claim that a substantial share of Dota victims permanently leave needs a defined cohort and follow-up period. The linked testimony documents experiences; it does not supply that population rate. Retain the hypothesis and publish the measurement alongside it.
THE ISSUER’S ADMISSION / THE COURT’S ORDER
Valve said fraud networks were using keys to liquidate proceeds and believed nearly all purchased keys subsequently traded or sold were fraud-sourced. It made new in-game key purchases non-tradable and non-marketable. Existing keys retained those functions.
The company identified both a monetary use and a control it could change. Its assessment concerned that key-purchase flow, not every skin transaction.
TF2’s Mann Co. Supply Crate Key remains a documented tradable and marketable item. Its existence keeps the cross-game question open: what monitoring followed the restriction of one liquid instrument? Proving migration of the same fraudulent funds into TF2 requires linked transactions; the continuing availability of another key alone does not measure that migration.
After ExpressTrade launched, Valve said it violated the Subscriber Agreement and enabled avoidance of Valve’s policies. The company published a demand to stop and announced that OPSkins’ Steam accounts would be locked by 21 June.
The record names a business, a practice and an account-level deadline. Apply that level of detail to the operators warned in 2016 and to the later P2P model: what was disabled, what reappeared and which business actually lost the ability to operate?
The transition to player-held inventory ↗THE CANADIAN ORDER TESTED VALVE’S CONTROL.
The Ontario court ordered Steam to disclose account information and freeze the bankrupt’s accounts.
The trustee records receiving login, account, inventory and trade histories for five accounts.
The 11 July report concerns Aiden Pleterski and AP Private Equity. It identifies over 100 trades during bankruptcy. Cryptocurrency settlement is the trustee’s inference. This is an asset-recovery record, not a judgment that Valve laundered money.
Order §§3–4 · PDF p. 12 ↗Follow the item, identify the account, preserve the history and explain the restriction. Those are concrete requests directed at the issuer and custodian of the record. The Canadian file gives the investigation a documented example to put beside Valve’s general statements about control.
KNOWN LOSSES / MEASURABLE RESPONSIBILITY
In December 2015, Valve reported this scale and described organised theft aimed at experienced users as well as newcomers. It also recognised the monetary incentive created by item trading. This is a dated baseline, not a current monthly estimate or a cumulative count.
How much loss followed a known defect, and how long did Valve leave that defect in place? Answering requires incident records, notice dates, fixes and remedies. Neither the 2015 figure nor the later million-account total supplies that breakdown.
The author reports unauthorised purchases of low-value Dota items on 6 July and says support sent template replies. The disputed route is the Market and Wallet.
Read the original account ↗The author alleges that support reset credentials and removed protections in an earlier incident, followed by inventory theft and refusal to restore. The missing evidence is the authenticated recovery decision.
Read the original account ↗These are dated victim reports. Their causal explanations require the account and support logs held by Valve. A standard warning about suspicious links does not resolve the specific transaction or recovery decision being disputed.
Record the credential involved, its creation and use, confirmation prompts and the actions it authorised. The historical key-registration issue and the later session-token workflows must be tested separately.
Historical API-key record ↗A substituted trade, a direct transfer and a Market purchase move value differently. Identify the receiving account, the confirmation event and the remedy applicable to that route.
The Market loss route ↗A malicious page, a renderer exploit and a support-mediated account reset need their own evidence. A single label such as “API scam” conceals the stage where protection failed.
The dated filter audit ↗STEAMWEBHELPER / CEF / DESTINATION CHECKS
DARKNAVY’s June 2024 research documents Steam’s embedded Chromium architecture and historical exploitation. That makes browser security a concrete part of the accountability record. It does not establish that those historical exploits still work in today’s client.
Chromium’s documentation treats Google services and API configuration as explicit integration choices. A CEF maintainer stated in March 2025 that Safe Browsing was enabled by default in CEF. The actual Steam build and its effective checks therefore have to be examined directly; the engine’s name alone cannot establish the configuration.
Publish the shipped CEF version, patch lag, sandbox settings, active reputation services and reproducible warning results across the client, overlay and Big Picture. Compare the same dated destinations and record which protection actually stopped the visit.
The dossier’s embedded-browser investigation places the user’s actual protection on the record. A failed warning in a captured build is a concrete failure to address. Valve controls the shipped configuration and should disclose which services it enables, which it excludes, how quickly it patches and what those choices mean for users exposed to malicious destinations. Read the wider browser investigation ↗
VAC / KERNEL ACCESS / PLATFORM STRATEGY
Riot documents Vanguard’s kernel-mode driver. FACEIT describes a kernel driver, client and server SDK for protected CS2 matches, with Windows-only availability. These are deployed approaches to protecting competitive play. Microsoft documents the driver-signing and compatibility requirements that govern this route.
Valve must account for cheats that survive its protections, the time they remain active, the matches they affect and the users left without an effective remedy. Detection coverage, response times, erroneous bans and appeal outcomes belong in that account. A technical strategy is judged by the protection it delivers to players.
Valve’s own Steamworks guidance recommends authoritative servers and explains how game-ban systems should communicate with affected users. That gives Valve a standard against which its implementation and treatment of users can be examined. Publish how the layers work together, where coverage fails and how those failures are remedied.
PhishDestroy’s criticism is directed at Valve’s priorities. SteamOS, Proton and control over its browser and anti-cheat stack serve Valve’s platform strategy. Corporate independence does not discharge its responsibility for security. When users face cheating, inventory theft or ineffective recovery, Valve owes an account of the protection it shipped, the alternatives it rejected and the consequences it accepted. The relevant configuration and decision records are in Valve’s hands; producing them is part of accountability.
What protection did your architecture leave missing, who carried the cost, and what have you changed to prevent the same harm recurring?
REVENUE BEFORE THE BAN / LOSSES AFTER IT
Valve’s CS2 documentation connects Prime status with weekly item rewards. That creates an economic question about paid access, item issuance and repeat account purchases. Answer it with a purchase cohort and transaction ledger.
Running many instances on shared hardware is a resource-allocation question; detecting or prohibiting automation is an enforcement question. Microsoft’s GPU-paravirtualisation documentation describes sharing physical GPU resources across virtual machines. A kernel driver does not, by its mere presence, impose one game instance per physical card. Claims of hundreds of instances on one card require measured hardware, load and instance data.
Use one currency throughout. The starting values are illustrative assumptions, not current prices or expected returns.
After 13 weeks: 90.3% of the initial entitlement and setup cost recovered.
Weeks = (entitlement + setup) ÷ (weekly receipts − weekly cost).
This simple scenario excludes bans, replacement purchases, price changes and time without earnings. Gross spending is not Valve’s recognised net revenue: taxes, refunds and the purchase channel must be reconciled. A Steam ban count supplies none of these inputs.
Newly purchased entitlements, legacy access, stolen accounts and ordinary users need separate cohorts.
Reconcile entitlement receipts, case purchases and internal Market fees. External trade value is a separate flow.
Track inventory restrictions, replacement accounts, continued operations and successful appeals.
The financial benefit and the effectiveness of enforcement can be audited together. A claim of mutual benefit becomes measurable when receipts and surviving operations are tied to the same cohort. A large ban total alone establishes neither revenue nor the closure of a farm.
COLLECTIBLES / PRECEDENTS / COMMUNITY
The official release describes paid passes, play-earned credits and item redemption. It places another cosmetic product inside Valve’s monetisation architecture.
In a first-person interview, Lisa discusses blind boxes and rare collectibles, dating her interest to early 2024.
The statement compares mystery boxes with physical collectibles. The question remains who issues the item, sets the paid sequence, executes transfers and can stop the holder from using the market.
Put the chronology beside Valve’s choice of analogy: the collecting culture around Labubu, weapon charms entering CS2 with the Armory on 2 October 2024, and Labubu appearing in Valve’s 11 March 2026 answer to the New York lawsuit. By invoking that collectible, Valve places its paid random-item system beside a recognizable commercial phenomenon. The comparison deserves to be examined alongside Valve’s own sales mechanics, item circulation and control over the market. The commercial role of appearance is already visible in the seven-Major inspect dataset ↗.
POP MART annual report · RMB billions · scale 0–15
Company-reported revenue for the full IP that includes Labubu, not resale turnover or Labubu alone. These figures show the commercial scale of the collectible market that Valve chose for its analogy.
The Dutch EA/FIFA judgment concerns the implementation before that court. Valve’s statement does not cite EA or FIFA. Any comparison must examine transferable items, external sale routes, market control and the paid random transaction rather than import another game’s outcome.
A claim that players rejected the statement needs a dated sample, selection rules, duplicate handling and coded responses. Complaints about cheating and privacy can be analysed within that corpus. Selected hostile comments do not establish the views of all players.
The 11 March response is a Valve statement. The published text has no Gabe Newell signature. Its effect on players and its authors’ intended mobilisation are separate questions.
The broader dossier publishes a support and research archive. To quantify reaction to this statement, preserve the exact post and comment set, collection period, language coverage, deleted-content treatment and coding method. To quantify departure after inventory theft, publish the separate victim cohort and follow-up definition. Link each published percentage to its denominator.
THE RECORD VALVE SHOULD PRODUCE
Publish theft losses, reversals, refusals and the reason Dota 2 and TF2 remain outside Trade Protection. Separate trades, Market purchases, gifts and recovery incidents.
Identify the financial instruments monitored after new CS:GO keys stopped circulating, the flows displaced and the interventions that followed.
For each security failure, provide the first notice, affected builds, exploitation evidence, patch date, affected population and compensation or restoration outcome.
Reconcile the relevant account cohorts with entitlement receipts, item issuance, fees, restrictions, repeat purchases and operator survival.
Disclose browser protection settings, anti-cheat coverage and measured trade-offs. Make the decisions that affect user security open to independent examination.
The items have an economic function. Valve has operational control. Protection and accountability must match both. The record now contains Valve’s own fraud admission, a court-directed account disclosure and a documented gap between the three games named in its defence.
THE PUBLIC RECORD
Sources cited in this article appear first. Select “All records” to inspect the complete 107-record register shared by the investigation; the dedicated evidence files retain their own detailed registers.
No matching records. Try a different term or select “All records”.
Reviewed 11 October 2026 UTC. The game comparison uses the current Trade Protection FAQ and the separate general hold policy. The Canadian exhibit distinguishes the court’s order from the trustee’s account and valuation. Victim reports retain their original dates and source links.
The farm model is an editable arithmetic scenario, not a survey of farms or a live price feed. Technical documentation describes capabilities; claims about a particular Steam build require that build’s configuration and measured behaviour. The February New York complaint is identified as a filed pleading, not a docket-status report.