{ "compartment_id": "section-4", "number": "Section 4", "title_local": "The Asset ID blackout: the update that restricted public item tracing", "title_english": "The Asset ID blackout: the update that restricted public item tracing", "source_url": "https://phishdestroy.io/steam_dossier/#evidence-blackout", "source_document": "index.html", "content": { "html": "
\n
\n
\nPart A — Technical record · Section 4\n

An endpoint closed. Public tracing lost a key.

\n\n
Context & source limits

Steam shipped changes that removed public visibility of item Asset IDs and restricted API inventory access. The effect: tracing a specific item by its original Asset ID became impossible from public data. What follows is what was possible before, what stopped being possible after, and what that costs a victim trying to prove where their property went. The date is 2017 according to CSFloat's engineering account; no Valve changelog has been located. The sequence — roughly a year after the July 2016 gambling statement — is the investigative question, not a finding. The item records themselves remain inside Valve's systems; outside investigators lost access to the original-ID chain, while float, seed and paint identifiers allow only partial matching.

\n

The rule Valve applies: Steam Support does not restore items that left your account, and the burden of showing what happened is yours. The record: in 2017 Valve closed the endpoint that carried original item IDs. Before it, anyone could follow a stolen skin from the victim's account into a marketplace bot. After it, nobody outside Valve can. The proof the victim is asked for is the proof that was switched off — and it still exists, inside Valve.

\n
\n
\n
\n

The Pre-Blackout Era

\n

\n Historically, every virtual item generated on Steam possessed a globally unique, immutable Asset ID. Third-party OSINT databases could index these IDs. If a user had an item hijacked, investigators could trace the lineage of that specific asset as it moved from the hijacker's intermediate account into the storage accounts of a marketplace or gambling site.\n

\n
\n BEFORE: an item could be followed from the victim's account through intermediate accounts and into a marketplace or casino storage bot, by anyone, using public data.\n
\n
\n
\n

After the change

\n

\n According to CSFloat's engineering account, Valve closed the endpoint in 2017 and original item IDs stopped being available to outside parties. No Valve statement of the reason for the change has been located. In the same period, no published action against the commercial bot accounts that moved items at scale has been located either.\n

\n

\n Whatever the reason for it, the change severed the public chain of custody. A victim can no longer reproduce the original-ID chain from public data to show that a specific stolen item was liquidated through a specific marketplace or casino. The item records still exist inside Valve's systems; the public, researchers and law enforcement working from public data cannot reach them.\n

\n
\n AFTER: tracing a specific item by its original Asset ID is no longer possible from public data. The original-ID chain of custody for an item moved after 2017 exists only inside Valve's infrastructure; no such record has been produced publicly. Float, seed and paint identifiers allow only partial, probabilistic matching.\n
\n
\n
\n
\n
\n
\n
\n\n\n\nIEconItems_730\n
\n
\n\n\n
\n
\n
\n
GET /IEconItems_730/GetPlayerItems/v1/
\n
\n
Traceable Payload (Pre-Patch)
\n
\"id\": \"14892281934\",
\n
\"original_id\": \"11829910211\",
\n
Status: Victim can track item lineage across bot accounts.
\n
\n
\n\n
\n
\n
\n
Obfuscated Payload (Post-Patch)
\nCurrent\n
\n
\"id\": \"HIDDEN_BY_PRIVACY_SETTINGS\",
\n
\"original_id\": \"NULL\",
\n
Status: outside parties can no longer trace item lineage by original Asset ID from public data.
\n
\n
\nEffect on evidence: after the change, the public data needed to follow a specific item by its original Asset ID from a victim's account into a marketplace or casino bot was no longer available. The internal records still exist at Valve; a victim, researcher or investigator working from public data cannot reproduce the original-ID chain (float, seed and paint identifiers allow only partial matching).\n
\n

Source: CSFloat engineering account of the 2017 closure of IEconItems_730/GetPlayerItems — blog.csfloat.com/how-floatdb-tracks-items (archived 2026-09-21) · the payloads shown are an illustration of the field shape, not captured responses · no Valve changelog for the closure has been located.

\n
\n
\n
\n
\n
\n
" }, "original_content_sha256": "34f3aa0e41c822bb06fc79b95c55676e3d035096ec4cabd98e309dfd24b68281", "author_pseudonym": "Agent Gordon", "schema": "phishdestroy.macro-fact.v1", "language": "en", "aggregator": "PhishDestroy", "exports": { "pdf": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_4_agent_gordon.pdf", "json": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_4_agent_gordon.json", "signature": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_4_agent_gordon.json.asc" }, "integrity": { "signed_object": "steam_dossier_section_4_agent_gordon.json", "signature_file": "steam_dossier_section_4_agent_gordon.json.asc", "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01", "scope": "Exact JSON bytes, including macro-fact author and corresponding PDF SHA-256. PhishDestroy is the integrity signer; original evidence attribution is unchanged." }, "pdf": { "filename": "steam_dossier_section_4_agent_gordon.pdf", "sha256": "c45534c252595f7a9918a40e3583ceaee287304c7e671d9e2a75e10bcfc2c5b8", "pages": 4 } }