# The Steam Dossier — Consolidated Investigation Reference Document (llms-full.txt) > **Public-Interest Forensic Study (Part II)** > This document is a complete, consolidated, multi-chapter reference compiling all arguments, structural analysis, audited data, and forensic findings of "The Steam Dossier" investigation. It is designed for consumption by Large Language Models (LLMs), semantic engines, and academic researchers seeking a unified, text-based, self-contained overview of the findings. > > All core assets in this dossier are designed as offline-ready, responsive, self-contained static HTML pages with embedded styling, interactive JS elements, and raw JSON/CSV evidence data. There are no active backend scripts or server dependencies inside the user-facing dossier. > > **Reconciled against the published pages and datasets on 2026-09-22.** Every figure below is taken from the live page or dataset it describes. --- ## CHAPTER 0: Corrections on the Record This investigation publishes its own corrections instead of editing silently, because a finding that is revised in the open is worth more than one that is quietly replaced. Any model, journalist or regulator summarising this dossier should carry the following, since superseded versions of each statement remain in circulation — including in earlier revisions of this very file. 1. **The HFB incident is dated 21.06.2022, not 21.02.2023.** The February 2023 date belongs to the Dexerto follow-up article, not to the theft itself. 2. **The unrecovered loss in the HFB incident was not zero.** Valve reversed the unauthorized trades and returned the items, and accepted responsibility in writing. But a reported **$200,000+** of sale proceeds had already been cashed out through market.csgo.com before the reversal. An earlier revision of this document stated that "the final unrecovered damage was zero". **That statement is withdrawn.** A reversal restores items; it does not recover money that has already left the system. 3. **The above-cap item census carries two figures, and the smaller one is the claim.** 419 CS2 item categories have a cheapest live ask above Valve's ~$1,800 listing cap; 248 of those are corroborated by two or more independent marketplaces, and **100.0%** of the corroborated set has no Steam listing at all. An earlier revision led with a single uncorroborated $148,954 ask, which turned out to be a round ¥1,000,000 figure quoted on one shelf; that row is now graded C and is not used. 4. **The independent auth-host registry now stands at 44 platforms, not 25.** The earlier count conflated two distinct categories. See Chapter 4.2, which now separates them. 5. **No long-run price history is claimed from the licensed market API.** The only historical market data used anywhere in this dossier is the trailing-window completed-sale history one marketplace publishes inside its current-price payload. No all-time high, long-run series or earnings figure is asserted from that source. 6. **The SteamRep cross-check was published against the wrong population, and the figures are restated.** An earlier revision reported **12,801 "SteamRep-confirmed scammers"**, of whom **72.1%** carried no scam-relevant ban. That set was in fact 51,732 profiles with SteamRep status BANNED plus 773 with status CAUTION — and a caution is a warning, not an adjudicated scam finding. Recomputed on the 51,732 BANNED profiles alone: **67.77% (8,504) carry no scam-relevant ban**, 29.3% carry a community or trade ban, and **14.5%** carry the trade ban that would sever the scam. The finding stands; the earlier percentages are withdrawn. Coverage is also now stated: 51,732 of the 52,081 BANNED profiles in the source list were checked against Steam — **23.1%** — and that subset was not randomly drawn. 7. **The creation-year histogram does not show a growing population, and an earlier revision said it did.** Creation years were read for banned accounts only. With no year-by-year denominator for the full 10,880,610, the chart shows the age profile of the banned, not a ban rate by cohort; a larger recent install base would produce the same shape. The 2025 and 2026 bars are floors, not a downturn — a recent account has had less time to collect a ban. What survives is narrow and still useful: **70% of the dated banned accounts were created in 2020 or later**, so this is not a leftover from the 2013–2015 trading-card era. --- ## CHAPTER 1: Core Hypotheses and the Causality Chain The primary analytical vector of Part 2 of this investigation evaluates how virtual asset ownership, third-party authentication routes, and delegated support access intersect inside Valve Corporation's infrastructure. While Valve officially states that account hijacks are the result of user-end credential compromise (phishing), a forensic review of primary sources suggests systemic security gaps and contract delegation routes. To establish accountability, the investigation evaluates the following chain of causality: $$\text{Valve Notified} \longrightarrow \text{Conscious Inaction} \longrightarrow \text{Support Contractor Abuse} \longrightarrow \text{No Disclosure of Who Held Access}$$ ### Verified vs. Speculative Boundaries: 1. **Valve Notified & Conscious Inaction:** Fully documented at the infrastructure level. Valve operates the entire technical framework for virtual asset circulation, item trading, and account recovery. Despite receiving automated and manual reports regarding bypass loops and security vulnerabilities, the underlying routes remained open. 2. **Support Contractor Abuse:** Allegations surfaced in February 2023 claiming outsourced support staff used administrative access to compromise high-value collector accounts. While Steam officially acknowledged responsibility for specific recovery-based rollbacks (e.g., the HFB incident), direct, public forensic proof linking named contractor employees to coordinated theft rings remains a priority for independent audits. 3. **No Disclosure of Who Held Access:** Valve has never publicly named the contractor that staffs its support desk. A circulating theory that Valve rebranded a specific Irish contractor (CPL→Covalen) to conceal the 2023 incidents does not survive the dates — the *Covalen* brand launched on 2 October 2019, years before — and this dossier does not use it. The accountability gap is not the rebrand; it is that the holder of account-recovery access is undisclosed. --- ## CHAPTER 2: Valve Support Outsourcing and the Undisclosed Contractor ### 2.1 Legitimate Third-Party Access (Valve Privacy Policy §5.2) Valve’s official global Terms of Service and Privacy Policy legally confirm the mechanism of transferring user personal data to third parties: - **Section 5.2:** Expressly permits Valve to share user personal data with external support service providers (contractors) to the extent necessary to provide customer support services. - **Infrastructure Scope:** Support operators have delegated authority to reset account passwords, disable or transfer Steam Guard mobile authenticators, override email associations, and rollback or force item trades. ### 2.2 The Contractor Is Not Publicly Named Valve outsources support and has said so — business-development head Erik Johnson told Kotaku the company had *"hired a couple different companies"* to help with support — and its privacy policy §5.2 authorises those third parties' access to user data (§2.1). Which firm holds Steam's account-recovery access is not established by any public source: - **Named in community discussion, not confirmed:** vendors such as **Concentrix** are named in community threads as Steam support providers; none is confirmed by Valve. - **A plausible vendor type, not a proven contract:** **Covalen** (rebranded from CPL on 2 October 2019) is a Dublin BPO that publicly advertises outsourced game-support, but no public source confirms a Steam contract. An earlier draft cited a *"Covalen – Steam Support CSE"* job listing as proof; that listing could not be independently verified and is **withdrawn as an asserted fact**. - **Contractual Transparency:** No party — Valve or any vendor — publishes access matrices, logging protocols, internal audit trails, or the data-access terms governing support staff. --- ## CHAPTER 3: Market Ceilings and the Grey Economy The design of the official Steam Community Market imposes artificial caps that mathematically generate the economic necessity for external, third-party skin trading platforms and casinos. ### 3.1 Official Infrastructure Restrictions: - **Item Listing Limit:** The maximum listing price for any single Counter-Strike item is approximately **$1,800 USD** (adjusted slightly by local currency exchange rates). - **Steam Wallet Cap:** A user's total Steam Wallet balance is strictly limited to **$2,000 USD**. - **Liquidity Block:** Steam Wallet funds are completely non-withdrawable. Once money enters the Steam ecosystem via game sales, credit card loads, or community market sales, it cannot be legally withdrawn to a traditional bank account or payment processor. ### 3.2 The Economics of Evasion: If a highly rare skin (such as a Souvenir AWP Dragon Lore, rare Doppler Knife, or low-float collector item) has a real-world market valuation of $5,000 to $15,000+ USD, it is *contractually and technically impossible* for a collector to sell it at its true value on the official Steam Community Market. This restriction creates an immediate, highly lucrative market gap. Third-party platforms fill this gap by providing: 1. **Peer-to-Peer (P2P) Trading:** Real-world fiat payments bypass the Steam Wallet restriction. 2. **Liquidity Access:** Sellers receive actual cash in bank accounts, credit cards, or cryptocurrency. 3. **No Listing Caps:** High-value items trade freely at their real speculative market value. This grey economy operates in direct violation of the Steam Subscriber Agreement (SSA) prohibition on commercial bot use and real-world currency trading, yet Valve's infrastructure continues to facilitate millions of daily P2P trade requests that sustain these platforms. --- ## CHAPTER 4: OpenID Bypass Mechanics (Split-Domain Routing) To prevent users from navigating to untrusted skin casinos, phishing portals, and unregulated markets, Valve implements the **Steam Link Filter**. However, third-party platforms bypass this filter using a highly coordinated "Split-Domain Routing" strategy. ### 4.1 The Evasion Strategy: A commercial site (e.g., a skin gambling casino) operates its primary branding and user interface on a highly visible main domain. Because of gambling prohibitions or fraud complaints, this main domain is flagged and hard-blocked by Valve's Link Filter (returning a bold red warning screen if clicked inside Steam). To maintain frictionless login, the platform registers and operates a separate, unblocked "clean" domain purely to host the OpenID login handshake. 1. **User Access:** The user visits the main site (e.g., `https://rollbit.com` or `https://howl.gg`). 2. **Handshake Redirect:** When the user clicks "Sign in with Steam," the site redirects them to an independent, clean authentication host (e.g., `https://rbsnin.com` or `https://howl.uno`). 3. **Steam Presentation:** The browser opens the official Valve login page (`https://steamcommunity.com/openid/login`). The official page displays the authorization prompt, showing the client-declared `openid.realm` and `openid.return_to` pointing to the clean domain. 4. **Successful Bypass:** Because the clean auth domain is not blocked by Valve’s Link Filter, the user is authorized, their session parameters are sent to the clean domain, and they are silently redirected back to the main, blocked branding domain with an active session. ### 4.2 Verified Independent Auth-Host Registry: **Read this section carefully, because the two tables below are not the same finding.** An earlier revision of this document presented a single 25-row table and described all of it as "split-domain structure". That was wrong: roughly half of those rows were platforms whose main domain is *not* blocked by the Link Filter, which makes them separate-domain auth routes but not evasions of a block. The registry now separates them, and the totals below come from `steam_tos_assets/master_registry.json` directly. Totals as of 2026-09-22: **26 filter-split pairs**, **18 separate-domain routes without a main-domain split**, giving **44 platforms authenticating on a separate registrable domain**. Alongside these the registry records 58 same-domain-or-subdomain routes, 13 platforms with no Steam login at all, and 3 unresolved. Of the 44, **27 carry a per-route evidence file** (`realm_src` = live capture, supplied OpenID URL, or Steam login-page notice) and **17 were collected by hand** (`realm_src` = user) and carry no capture file for the realm. **Table A — filter-split pairs (26). Main domain BLOCKED by the Steam Link Filter; auth host on a separate registrable domain that the filter treats as CLEAN. This is the evasion pattern.** | Main Domain (BLOCKED) | Clean Auth Domain (OpenID realm) | Realm source | | :--- | :--- | :--- | | **rollbit.com** | rbsnin.com | live capture | | **howl.gg** | howl.uno | live capture | | **farmskins.com** | steam.kobal.cc | live capture | | **csgo.net** | cn2.easylot.net | live capture | | **skins.cash** | skinscash.live | live capture | | **tf2hunt.com** | rstspcl.com | live capture | | **skinsnipe.com** | pricing.tradeupspy.com | live capture | | **csgobig.com** | letmeinbig.com | live capture | | **skin.club** | sc-auth.net | supplied OpenID URL | | **duelbits.com** | switchflips.com | supplied OpenID URL | | **csgofast.com** | steam-login.authtofast.com | supplied OpenID URL | | **cobaltlab.tech** | cobaltauth.com | supplied OpenID URL | | **ggdrop.com** | ggauth.com | supplied OpenID URL | | **rustchance.com** | hgfuihd.com | supplied OpenID URL | | **skin.fans** | auth.skinfans.com | supplied OpenID URL | | **skinport.com** | skinport.app | supplied OpenID URL | | **daddyskins.com** | go-go-daddy.com | hand-collected | | **key-drop.com** | kdauth.com | hand-collected | | **clash.gg** | clggauth.com | hand-collected | | **c5game.com** | www.imbastar.com | hand-collected | | **swap.gg** | swapauth.com | hand-collected | | **shadowpay.com** | thelogins.com | hand-collected | | **csgocases.com** | log-1n.com | hand-collected | | **csgogem.com** | api.csgem.com | hand-collected | | **gamdom.com** | login.gambldom.com | hand-collected | | **12cs.fail** | fail.games | hand-collected | Note on `skinsnipe.com`: the auth host is a subdomain of `tradeupspy.com`, a separate registrable domain from `skinsnipe.com` which also authenticates its own users directly. One registrable domain, two roles. It is correctly classified as a split pair, because the test is whether the auth host sits on a registrable domain other than the blocked main domain — not whether that other domain happens to be a subdomain of something. **Table B — separate-domain routes without a main-domain split (18). The platform authenticates on a different registrable domain, but its main domain is not currently blocked, so no Link Filter block is being evaded. These rows document the architecture, not an evasion.** | Main Domain | Auth Domain (OpenID realm) | Realm source | | :--- | :--- | :--- | | **csgoempire.com** | csgoempirelogin4.com (rotating logins 1-10) | live capture | | **cs.money** | auth.dota.trade | supplied OpenID URL | | **csfloat.com** | csgofloat.com | supplied OpenID URL | | **g4skins.com** | auth.g4s.to | supplied OpenID URL | | **juice.gg** | letmeinjuice.com | supplied OpenID URL | | **market.csgo.com** | dota2.net | supplied OpenID URL (shared) | | **rust.tm** | dota2.net | supplied OpenID URL (shared) | | **skinbaron.de** | skinbaron.com | supplied OpenID URL | | **tf2royal.com** | tf2auth.com | supplied OpenID URL | | **tradeit.gg** | connect-tradeit.com | supplied OpenID URL | | **upgrader.pro** | upgauth.space | supplied OpenID URL | | **csgolounge.com** | dota2.net | hand-collected (shared) | | **dota2lounge.com** | dota2.net | hand-collected (shared) | | **rustcases.com** | rstlgn.com | hand-collected | | **hellcase.com** | steam.loginhell.com | hand-collected | | **csland.gg** | dland-steam.me | hand-collected | | **igxe.cn** | gamingsky.cn | hand-collected | | **lis-skins.com** | lisauth.com | hand-collected | Registration dates for these auth domains are in `DOMAIN_AGE_REPORT.md` and `steam_tos_assets/domain-registration.json`. Three hand-collected realms were re-checked against live RDAP on 2026-09-22 and confirmed: `go-go-daddy.com` registered 2019-01-26, `gambldom.com` 2017-09-24, `tradeupspy.com` 2020-03-11. --- ## CHAPTER 5: Forensic Registry of Declared Losses When evaluating claims of massive multi-million dollar losses stemming from Steam Support insider activities, observers often fall prey to simplistic mathematical summation. Our forensic review categorizes these claims to establish their true boundaries. ### 5.1 Critical Methodological Rules for Damage Analysis: 1. **Summing Categories is Invalid:** Market valuation of inventory, asking price, unauthorized Steam Wallet spend, and actual unrecovered loss are incompatible financial metrics. 2. **Asking Price $\neq$ Revenue/Loss:** The prices set on grey-market listings are uncompleted asking values, not actual cash values realized in trades. 3. **Rollbacks Restore Items, Not Money:** A compromise where Valve Support reverses the unauthorized trades returns the *items*. It does **not** recover proceeds from any part of the inventory that was sold and cashed out before the reversal. Treating a reversal as a loss of zero is therefore wrong wherever a cash-out preceded it — see the HFB row below, and Chapter 0. 4. **Refusal is a Separate Outcome:** Restored, refused and unresolved are three different outcomes and must not be pooled. On the register below, two of the largest episodes were refused outright. ### 5.2 Key Incident Breakdown: Each figure is the number its named source published, and each row states what *kind* of number it is — priced valuation, reported inventory value, proceeds, or wallet spend. They are not one running total and must not be collapsed into one. - **The HFB Incident (21.06.2022):** * *Sum as published:* **$2,000,000+** reported inventory valuation on the day, raised to **$3,000,000+** in the 21.02.2023 Dexerto follow-up. Contents included 7× Souvenir AWP Dragon Lore and the #1 Blue Gem Karambit at approximately $1.26m. * *Forensic Status:* **Restored.** Trades reversed and Valve accepted responsibility in writing — which confirms Valve possesses the manual capability to reverse trades, though it does not offer it to standard consumers. **The final unrecovered loss was not zero:** a reported **$200,000+** of sale proceeds had already been cashed out through market.csgo.com before the reversal. - **The CS.Money Incident (14.08.2022):** * *Sum as published:* **$6,300,000** priced valuation of 19,000+ skins; the first estimate was $1.6m. The vector was the mobile-authenticator files of the platform's trading bots. * *Forensic Status:* **Refused.** No reversal, on the ground that it was "a third-party site". Community researchers mapped 55 attacker accounts within hours. - **The Qkss Incident (reported 21.02.2023):** * *Sum as published:* **$1,000,000+** reported inventory valuation. * *Forensic Status:* **Refused.** Same route and same actor as HFB, eight months later. Not restored. - **The Insider Trade (reported 02.2023):** * *Sum as published:* **≈$320,000** in proceeds over roughly one year — proceeds, *not* an inventory valuation. * *Forensic Status:* Support-side access reportedly reached account data up to 15 years old. One M4A4 Howl (with iBUYPOWER and Titan Katowice 2014 holos) sold for **$35,000** and ended up with NAVI's b1t. The contractor dismissed its entire Steam-support staff. - **The Matvey Incident (02.12.2024):** * *Sum as published:* **$13,000 USD**, the author's own inventory estimate. * *Forensic Status:* **Refused.** Recovery was granted to someone supplying data the owner could not match — two years after the contractor sackings. No direct proof of insider operator theft exists in the public record. - **The Quebec Incident (09.05.2025):** * *Sum as published:* **~$10,000 USD** claimed item loss. * *Forensic Status:* Complaint alleges Steam Guard removal following a third party's request. The complete transaction logs and the primary support ticket are missing. - **Steam Wallet / Dota 2 Incident (07.07.2022):** * *Sum as published:* **>$500 USD** across 44 unauthorized Community Market purchases. * *Forensic Status:* Complaint about suspicious automated Market transactions. No evidence of insider involvement. - **Trustpilot / Wallet (09.12.2023):** * *Sum as published:* **€288** in unauthorized wallet spend. * *Forensic Status:* Brief user review. No primary ticket and no individual source URL preserved. The authoritative version of this register, with per-row source links, is the table in `PART2_RESEARCH.md` section 4. --- ## CHAPTER 6: Objective Audit of Saved Datasets A byte-by-byte forensic audit of the collected data archives has been performed to isolate facts from collector-applied labels. ### 6.1 Listing Database (steam/identifiers.txt): The archive contains exactly **231,829 unique entries** of accounts listed on dark markets. The classification represents the nomenclatures of the dark-market sellers: - **Auto-registrations (`autoregs.txt`):** 33,509 listings (14.45% of sample) managed by 40 unique seller signatures. These are mass-created bot accounts. - **Stealers (`stealers.txt`):** 198,320 listings (85.55% of sample) linked to 1,172 unique seller signatures. These represent accounts harvested via info-stealing malware or phishing. - **Financial Total Limit:** The combined value of the `Price` field across the dataset sums to **90,278,987.37** (unverified currency). This represents total seller *asking prices*, not completed sales or Valve-derived revenues. ### 6.2 Ticket and Support Reviews: - **`steam_support_tickets_MEGA.json`:** Contains 1,585 user posts. Multiple threads regularly discuss the same single incident, inflating simplistic counts. - **`steam_support_corruption_MEGA.json`:** Contains 1,005 user discussions. A high percentage consists of off-topic community comments and reports of external scammers *pretending* to be support operators, rather than verified internal support abuse. - **Trustpilot Dataset:** Normalized and de-duplicated to isolate **201 unique reviews** from an initial 354-row export (153 duplicate rows removed). Individual source URLs were not preserved in the historical export. *Reconciliation note:* the searchable archive (`steam_evidence_archive.html`) reports **393** Trustpilot records because it indexes the wider master export, not this de-duplicated 354-row file. The two numbers describe different inputs and should not be compared directly. ### 6.3 Social and GitHub Overlaps: - **Social Graph:** maps **3,435 nodes** and **4,551 edges** (representing 4,299 friendship links, 252 comment links, and 176 self-loops). A social link on a public Steam profile does not prove coordinated malicious activity or employee status. - **GitHub Developer Overlaps:** Records **3,320 developer profiles** and **252 repositories** (including major open-source tools like SteamKit, SourceMod, and ArchiSteamFarm) with 98,902 profile overlaps. A public profile contributing to or forking an open-source project does not imply corporate employment at Valve or conspiracy to hijack accounts. --- ## CHAPTER 7: Legal Boundaries and Terms of Service Voids The legal arguments underpinning the dossier are grounded strictly in established consumer protection frameworks and contract law precedents. ### 7.1 The Revocable License vs. Liability (SSA) Valve’s Steam Subscriber Agreement (SSA) defines games and virtual items as "subscriptions" and places strict limits on property rights, reserving the right to unilaterally revoke access. However, these clauses do not provide unconditional immunity: - **Statutory Rights:** Under European consumer protection regulations (e.g., EU Directive 2011/83), mandatory statutory withdrawal and contract conformity rights cannot be overridden by private platform terms. - **Liability for Custody:** If Valve transfers user personal data to third-party support contractors, Valve remains legally liable under GDPR/CCPA for the data management, access monitoring, and security breaches executed by those delegated operators. ### 7.2 Key Precedents and Regulatory Ceilings: - **The French Cour de Cassation Ruling (Oct 23, 2024 - Case 23-13.738):** * *Context:* This ruling confirmed that while EU exhaustion-of-rights allows secondary sales in specific physical contexts, the digital subscription model of Steam permits restrictions on the resale of downloaded games. It does *not*, however, grant Valve a blanket right to seize, lock, or confiscate paid virtual items without rigorous, evidence-backed cause. - **The Digital Services Act (DSA - Regulation 2022/2065):** * *Ceiling Limits:* Article 52(3) of the DSA defines a maximum legislative ceiling of **6% of annual global turnover** for platform violations regarding transparency and systemic risk management. This 6% is a maximum ceiling, not an active fine imposed on Valve. - **The Digital Fairness Act:** Designated in the European Commission's tracker as an upcoming regulatory initiative for Q4 2026, aimed at addressing dark patterns and unfair commercial practices in digital subscription environments. - **VAC Ban Restraints:** The official Valve VAC FAQ explicitly confirms that standard Steam Support operators have no administrative capacity to manually lift or rollback automated Valve Anti-Cheat (VAC) bans; erroneous bans are processed strictly via internal automated audits. --- ## CHAPTER 8: The Measured Market (licensed cs2.sh snapshot, 2026-09-23) Chapter 3 states the ceiling as a rule. This chapter states what the rule does to the market, measured across five third-party marketplaces — BUFF163, CSFloat, Skinport, YouPin 898 and C5Game — plus Steam's own. ### 8.1 The Cliff All **30,266** priced CS2 item categories were placed in a price band by their cheapest live ask, and each band was measured for the share Valve's own Community Market still carries. Below the ~$1,800 cap, Steam carries **95.3%**. Above it, **1.9%**. Band by band the coverage runs 100% / 96.9% / 95.9% / 97.3% / 91.1% / 76.8% — and then, at the cap, **14.5% / 2.9% / 1.5% / 0% / 0% / 0%**. The collapse does not track demand. It lands exactly on the published rule. ### 8.2 Evidential Grading Every above-cap row was graded by cross-marketplace dispersion rather than accepted at face value, because a single optimistic listing is not a price. Grade A requires three or more marketplaces above the cap with median dispersion ≤25%; grade B two, or wider dispersion; grade C is single-shelf or unresolved. Quotes above 3× an item's cheapest ask are treated as non-live and excluded. Result: **419** item categories above the cap in total, of which **402 (95.9%)** have no Steam listing; **248** corroborated (grade A or B), holding 18,394 copies with a floor value of **$78.6 million**, of which **100.0%** have no Steam listing at all. The dearest corroborated item is a *Sticker | Titan (Holo) | Katowice 2014* at **$66,285**, quoted by four marketplaces within 5.2% of each other and carried by none of Valve's. ### 8.3 What Valve Charges Valve takes a 5% Steam fee and a 10% publisher fee from the seller's proceeds — the familiar 15% — but each carries a $0.01 minimum, so no sale can carry less than two cents in fees. Solved across all **29,635** priced item types: counted by type, **84.8%** pay about the headline rate; counted by live listing, **18,682,244 of 24,038,911 (77.7%)** sit on item types charged *more* than 15%, because the overcharged types are the cheap, high-volume ones. **1,109** types are charged more than double the headline rate and alone carry 14,083,486 listings. This is arithmetic on a disclosed minimum, not an allegation. ### 8.4 The Walled-Garden Premium For every item quoted both on Steam and outside it (**28,700** items), Steam is the dearer venue **86.4%** of the time, by a median of **+35.7%**. The curve is U-shaped: +48.3% under $0.50, a minimum of +28.6% in the $10–50 band, and **+67.9%** above $1,000 — beyond which comparison stops, because the rule forbids the listing. ### 8.5 Money In, No Money Out Steam buy orders are pre-funded and Steam wallet funds cannot be withdrawn. Summing every price level of every tracked buy book gives **$128.1 million** committed across **170.6 million** standing funded orders on 31,253 item types, facing **$105.8 million** of asking value. This is a snapshot of money already debited, not revenue and not a claim about Valve's balance sheet. ### 8.6 Realised Sales and the History Boundary Completed sales, not asking prices, on the smallest of the five shelves over a trailing 90 days: **1,219,143** sales worth **$30.9 million**, an annualised floor of about **$125 million** — including **492** sales above Valve's cap worth **$1,643,938**, none of which could have happened on Steam. The highest single completed sale in the window was **$14,191.61**. **Boundary:** **no all-time price, no long-run series and no earnings figure is claimed anywhere in this dossier from this source.** The only historical data used is the trailing-window completed-sale history one marketplace publishes inside its own current-price payload, and it is labelled as such everywhere it appears. --- ## CHAPTER 9: The Card Economy and the Automation Clause ### 9.1 The Entry Fee A Steam account cannot receive a trading card until it is not *limited*, and Valve's own support page sets that gate in money: "You will need to spend at least $5.00 USD within the Steam store." Limited accounts are barred from "Participating in the Steam Market", from "Trading Steam Community items (trading cards, booster packs, gems, etc.)" and from "Gaining Steam Profile Levels (Locked to level 0) and Trading Cards". Cards then drop only from games the account *owns* — family sharing does not count, promotional freebies cannot be farmed, and free-to-play titles drop nothing without in-game spend. An automated card farm is therefore not a leak in Valve's store; it is a wholesale buyer, at a price Valve publishes, per account, before it produces anything. Valve has also priced a card drop directly: "For every $9 USD spent (approximate) since the start of the Steam Trading Card Beta, you will earn one card drop." ### 9.2 The Measured Scale All figures below were read on 2026-09-22 from public sources requiring no account: Steam Card Exchange's published badge pricelist, Valve's own store endpoint `store.steampowered.com/api/appdetails` (cc=us), and the public card-bot directory at `steam.supply/CardBots`. A second directory, `steamlvlup.net/cardbots` (data CC BY 4.0), was read as an independent check. - **13,876** games on Steam issue trading cards, holding **99,971** distinct card types. A set is 5 cards at minimum, 6 at the median, 7.21 on average, 15 at most. - **$0.74** is the median market price of a finished set; $1.70 the mean; $0.20 the cheapest in the census. One of every set in existence costs **$23,586.57**. - **694,673** complete sets are held in stock right now by **91** publicly listed card-trading bots. At the 5-card minimum that is **3,473,365 cards**, unsold. - Valve's own rule is that a game drops "about half the number of cards in that game's set" and that "**You'll need to collect the other half of the set from other community members.**" One account can therefore never complete a set. Two, at minimum, each owning the game, each burning a once-per-game drop allowance that never regenerates. The stock above therefore represents at least **1,389,346 spent account-and-game drop allowances**. - Pigeonhole floor on distinct accounts: one bot lists 14,310 sets drawn from only 11 games, so at least one of those games is represented by 1,301 sets, requiring **at least 2,602 distinct accounts** that each bought that game. That is one bot out of ninety-one. **This is not a count of farm-owned accounts.** These bots buy from ordinary players as well as farms; the figure counts drop allowances spent somewhere on Steam and now sitting unsold in commercial stock. It is also a floor in a second sense: it excludes everything already sold, everything held privately, and every bot outside the directory. **And farming does not pay for itself at Valve's prices.** Of the 13,876 card-bearing games, prices resolved for 13,713; 12,918 are paid titles with a **median list price of $9.99**, against a median finished set of $0.74, and two licences are needed per set. Only **323 games — 2.5% —** have a set worth more than the game that yields it. Card farming is therefore a loss-making activity at Steam's own list prices, viable only on licences acquired below them (bundles, regional pricing, key resale). The cards are the residue; the purchase is the event, and the purchase happened on Steam. Cross-check: the two directories list 21 of the same bots. Aggregate stock across those 21 agrees to **0.03%**; the largest single-bot disagreement is 1.36%, consistent with two crawls of live inventory minutes apart. **The fleet is permanent, not seasonal.** The 91 bots above were read on an ordinary day with no seasonal sale running (2026-09-22); even at rest they hold 694,673 sets — on the order of **186,000 TF2 keys, $334,000–$464,000 of card value sitting idle** between sales. Read back through the Wayback Machine, the same public directory has carried up to **3.22 million sets** at the Winter 2023 sale peak, and **87 of the 91 resting bots (96%) reappear by SteamID64** across the seven seasonal-sale snapshots 2022–2026, sixteen in every one. It is a standing commercial operation that swells toward each sale and never empties, not a sale-time pop-up. The *number* of bots per snapshot is not comparable across sales (some snapshots list only featured bots), so the finding is stock and identity, not headcount. ### 9.3 The Ladder: What a Steam Level Costs The finished good of the card economy is not the card, it is the Steam Level. Valve wires it into the account: crafting a badge gives "100XP, which may increase your Steam Level. **If your Steam Level increases, the limit on the size of your friends list will be increased by five**, and potentially you'll unlock the ability to customize your profile with showcases." Level also governs free supply — "your Steam Level increases your rate of receiving a booster pack drop: Level 10: +20%… Level 50: +100% increase in your drop rate (i.e. the rate has doubled)" — so consumption of sets accelerates the delivery of more material. The reinvestment loop is Valve's design. One badge craft consumes one complete set for 100 XP, and "You can craft a set for the same game at most five times." Valve publishes the rate but not the escalation, hedging it as "(at least to start)". The standard curve — every level inside a block of ten costs 100 XP more than the block below — was verified against the bot directory rather than assumed: for every bot whose advertised maximum is limited by its stock rather than by the five-crafts-per-game cap, the computed level matches the advertised level exactly (541/541, 494/494, 464/464). No claim is made about the curve above level 667. | Steam Level | Sets consumed | Games to own to craft them | At $0.20/set | At $0.74/set | |---|---|---|---|---| | 10 | 10 | 2 | $2.00 | $7.40 | | 50 | 150 | 30 | $30.00 | $111.00 | | 100 | 550 | 110 | $110.00 | $407.00 | | 200 | 2,100 | 420 | $420.00 | $1,554.00 | | 500 | 12,750 | 2,550 | $2,550.00 | $9,435.00 | | 667 | 22,579 | 4,516 | $4,515.80 | $16,708.46 | 667 is the highest level a public bot advertises it can deliver, out of 33,359 sets across 6,117 games. Put the ladder next to 9.2: one account at level 500 requires 12,750 complete sets, each of which consumed at least two drop allowances on accounts past the $5.00 gate — **at least 25,500 spent allowances under one vanity number.** Valve is the counterparty to every leg of that. ### 9.4 The Clause Names the Activity SSA § 4.C does not prohibit automation in general terms; it enumerates. Two of its four examples are "**Faking gameplay statistics (e.g., inflated wins or losses, XP, playtime)**" and "**Earning rewards or progress without genuine user input**" — which are, respectively, what an idled account contributes to Valve's published engagement figures and what a farmed card is. Idled playtime is genuinely recorded: the tooling's own FAQ states it updates "usually every 30 minutes or so". ### 9.5 The Commercial-Use Trap § 2.A licenses Content and Services for "personal, non-commercial use". § 2.G(iii) forbids exploiting them "for any commercial purpose". § 3.D reserves Valve's right to charge a fee on marketplace transactions. A farmed card is worthless until it is sold, traded or crushed into gems — and each of those is the commercial use the licence forbids, transacted through the marketplace on which Valve takes a fee. Valve's own enforcement letter names it: one banned operator was told the account "was used to illegally collect collectible cards on Steam, as well as related and not only commercial activities." The sales cleared and the fee was taken before the ban. A restriction that reaches effectively every card seller and is enforced against almost none of them functions as an option, not a rule. ### 9.6 The Enforcement Record § 4.D reserves termination "without notice". The tooling's FAQ reproduces three Steam Support letters — operators of 1,000+, 170+ and 120+ bots, trade-banned or permanently banned. A fourth episode is recorded in the project's own tracker in June 2025: VAC bans on accounts that had only idled Counter-Strike 2. In the same thread a project collaborator describes the propagation rule — accounts can be banned "by chain", if they are using same phone number, with "just one VAC ban, propagated to 'clean' accounts connected to the banned one". Since Steam Guard requires a phone number, this is the documented mechanism by which an enforcement wave removes an operator's main account along with the farm. **The same clause reaches ordinary traders, and the answer is a template.** Eight lock notices published by their recipients between 2020 and 2026 were collected for this document. Three reproduce the letter verbatim, and they are word-for-word identical across fifty-five months, three named agents (Hal, Vido, Sally) and two interface languages: > "The account you are writing in for has been locked for violating the terms of the Steam Subscriber Agreement. The account has been identified as being used for commercial purposes based on trading, community reports, and other factors. This lock is permanent and Steam Support cannot help you further with this. Because we have provided all the information we have I am closing this help request." The only change between 2020 and 2024 is the final sentence hardening from "you will not receive further replies" to "future help requests submitted regarding the account lock may be closed without a reply". The stated grounds are a category, a report of unknown origin, and an unnamed remainder. One of the three recipients was not appealing a lock at all - their account had been stolen along with their email and they were asking for access; they received the same paragraph three times. The remaining five cases cover P2P trading on Buff and Bitskins (December 2021, twice), a decade-old account traded for loadouts (December 2024), a returning user who added wallet funds over a VPN and was given no reason at all (December 2024), and an Iranian customer whose community access was locked until 2038 under "sanctioned regions" after years of accepted payments and an approved refund from the same IP. No claim is made here that any of these accounts was innocent or guilty; the finding is that **no reader and no regulator can tell from the letter.** **The asymmetry.** Set that standard against the one applied to Valve's own support operation. A customer who traded on a third-party marketplace: no evidence shown, no notice (SSA 4.D reserves that), no appeal, ticket closed on the first reply, profile, friends list, chat, Market and inventory gone, permanently. The insider-access incident reported in February 2023: approximately **$320,000** in proceeds over roughly a year, support-side access reportedly reaching 15 years into account histories, one M4A4 Howl sold at $35,000 - and the outcome on the public record is that the contractor dismissed its Steam-support staff, with no Valve incident statement, no published count of affected accounts, no restitution framework, and the outsourcing relationship continuing. The hedges of Chapter 2 and 5.2 stand: direct public forensic proof linking named contractor employees to a coordinated ring remains unestablished, and the rebranding-to-conceal claim is withdrawn (Chapter 0). What is not hedged is the asymmetry of what was published afterwards. A third side of the same comparison is internal to Valve. On 18 September 2026 a user reported the Russian war symbol "Z" on the Steam forums, as they had for years and as had previously resulted in removal; the report was returned as no violation, the user requested human review, and the human review returned the same finding. The point is not the ruling - the letter alone is ambiguous and the thread says so. The point is that **the machinery for a reviewable decision with an appeal exists, and it is pointed at forum content rather than at the enforcement actions that take a customer's property.** ### 9.7 Governance of the Card Economy Read from Valve's own public group and profile pages on 2026-09-22 and reproducible by anyone: the official community group of a third-party commercial card service, with **97,114** members, lists among its moderators - the accounts holding that group's controls - one flagged by Valve's own site markup as a **Valve employee**. This is not an automation point; a group moderator is not running a bot. It is the commercial-use point: trading cards through third-party services is the exact conduct for which Valve permanently locks ordinary accounts (9.6), and on this service a Valve employee is on the moderator list. Separately, a third-party "global ban list" service group is administered by an account that is *not* a Valve employee but is a member of Community Moderators, Wiki Coordinators and a series of Valve programme and pre-release groups; in the same group sits the self-declared operator of a major SteamID-resolution service. Group membership is not employment and no individual is accused of anything. It is recorded because ban lists, SteamID resolution and card trading are the three services that decide who is trusted, who is identifiable and what an item is worth — and none of the three is operated by Valve. ### 9.8 Nobody Publishes the Census The Steam ID space is a contiguous integer range, and Valve issues the Web API key needed to walk it at `steamcommunity.com/dev/apikey`. Enumerating it to report how many accounts are banned, how many are limited, and how much inventory sits behind a trade ban is a loop, not a research programme. **No independent party publishes that census** — not a regulator, not a journalist, not an academic, not a consumer body. The only public figures on the scale of Steam enforcement are the ones Valve chooses to mention. The capability is not absent; it is held. The service that resolves and indexes the ID space at scale states in its own FAQ that it "primarily utilizes the Steam Web API for data collection", running across multiple dedicated servers, off-site storage and text-search machines and a separate backup facility, and that the site, "network infrastructure, and security systems are all managed by 76561197977933359" — one private individual, whose ban-list sibling group is co-administered by a long-serving Valve community moderator with pre-release programme access. The party positioned to publish the count sits inside Valve's orbit and does not publish it. No claim is made that a census was attempted and suppressed; the finding is only that none exists. **So we ran it once.** Not across the whole ID space, but across one self-identifying population: the **10,880,610** total members of the ArchiSteamFarm community group (including **5,360,499** non-limited accounts past the $5.00 store gate), each passed once through `GetPlayerBans`. It took 55 minutes on one key. ASF sets `Statistics` to true by default and auto-joins that group on first launch unless the operator opts out, so its membership is a working census of the running install base. The headline is what Valve has *not* done: **9,680,599 accounts — 88.97% — carry no Steam ban of any kind.** Of the **1,200,011 (11.03%)** that do, **99.8% carry only a community ban** — a forum/profile/group restriction that does nothing to a trading bot; the trade/economy ban that actually severs trading sits on just 5,214 accounts, but the point is not that number (trade bans are rare across Steam) — it is that even the fraction Valve touches keeps trading. Dated by creation time, the banned accounts cluster in 2020–2024 (peak **227,030 in 2024**, still 121,070 in 2025): a live and growing supply line, not a legacy mess. Where they expose a country (100,413 of them, 8.5%), the fleet is global — US 15.5%, Ukraine 10.0%, China 9.4%, Russia 7.7%, then a long tail. Limits stated plainly: a Steam ban has no reason field, so none is attributed to card farming specifically; group membership is not proof any account is a bot; country is self-reported. Aggregate, reproducible: `steam_tos_assets/asf-ban-census-2026-09-23.json`. A second, independent population points the same way: of **51,732** SteamRep-listed (community-confirmed) scammers, only **29.3% carry a scam-relevant ban** (a community or trade ban) — **67.77% carry none**, retaining trading, friend-request and messaging ability. VAC bans (12.8%) are excluded from that measure because VAC addresses cheating in a game, not fraud (`steam_tos_assets/steamrep-vs-steam-2026-09-23.json`). Valve can run the identical query against its own database in seconds, with reasons attached, across the whole ID space. It publishes nothing; these are ours. **Why no one can count: the identifier sequence.** Item lineage was countable while a Steam item's immutable OriginalID could be matched across inventories at scale against the AssetID that is regenerated on every trade. Chapter 4 of the main dossier sets out the blackout. The dated steps: - **17.10.2016** - the Washington State Gambling Commission, having ordered Valve to stop the transfer of skins for gambling, reports that Valve missed its deadline. Director David Trujillo: "I am disappointed that Valve Corporation missed Friday's deadline, but encouraged that they have committed to responding today." (WSGC update PDF, read via Internet Archive.) - **18.10.2016** - Valve's reply arrives; the Commission states it "will continue to evaluate its options regarding the violation of Washington's gambling laws." No public account of what was agreed has followed. - **2017** - the endpoint returning original item IDs to outside parties closes. No Valve statement of the reason has been located; the year is CSFloat's engineering account and is carried with that limitation. - **29.03.2018** - CS:GO puts a seven-day cooldown on traded items. Valve's stated reason, verbatim: "Over time, third-parties have developed services that use **automated Steam accounts to mimic players** and make use of Steam's trading functionality... Unlike players, these services rely on the ability to trade each item very frequently." ("Adjustments to maps and trade", CS:GO blog.) - **April 2018** - Steam makes game details and inventories private by default, ending the bulk reading of public inventories that every independent tracker depended on. The announcement is reachable but its body could not be rendered by the collecting host, so only the month is asserted. Each step has a defensible safety or privacy rationale, and each was announced as one where it was announced at all. **What none of them has is a published measurement of its effect.** Valve has never stated how many gambling operators any of these changes removed. The measurable effect on the other side is that after April 2018 no outside party can assemble the inventory-wide view needed to trace a stolen item, count banned accounts, or test any enforcement claim against a number. The question is answerable only by Valve: which identifier or capability was withdrawn, on what date, on whose decision, and with what measured effect on the operators it was aimed at. --- ## CHAPTER 10: Complete Index of Dossier Assets The Steam Dossier comprises the following interactive static HTML files and raw JSON/CSV datasets, all relative-linked and executable completely offline: ### Primary Portals and Reports: 1. **[index.html](index.html) (Main Dossier - Part II):** The core publication compiling the open letters, Link Filter bypass evidence, OpenID domain mapping, and the demand for accountability. 2. **[investigation_part2.html](investigation_part2.html) (Summary Portal):** Visually polished executive briefing mapping user vs. publisher keys, phishing vectors, and the Irish support chronology. 3. **[legal_analysis.html](legal_analysis.html) (Interactive Legal Review):** Comprehensive legal review covering the revocable license model, secondary markets, French cassation case, Wolfire antitrust, and EU consumer directives. ### Interactive Exhibits: 4. **[valve_scandals_registry.html](valve_scandals_registry.html) (The Source Registry):** Interactive directory allowing researchers to sort and explore Trustpilot reviews, Reddit discussions, and external support allegations. 5. **[steam_evidence_archive.html](steam_evidence_archive.html) (Forensic Archive):** High-performance client-side search engine indexing 16,319 records of user complaints, ticket logs, and GitHub activities. 6. **[steam_enforcement_evidence.html](steam_enforcement_evidence.html) (The Evidence Room):** Tabular display of selected support tickets, mobile reset records, and the 252 captured repositories in the Steam developer network. 7. **[elite_skins.html](elite_skins.html) (Price-Gap Register):** 419 CS2 item categories whose cheapest live ask exceeds Valve's ~$1,800 listing ceiling, of which 402 (95.9%) have no Steam listing; 248 corroborated by two or more marketplaces, of which 100.0% have no Steam listing. Carries the published correction withdrawing the earlier uncorroborated headline. 8. **[skin_atlas.html](skin_atlas.html) (Price-Ladder Atlas):** All 30,266 priced item categories banded by cheapest ask, with item renders, server-rendered charts, evidential grading and realised-sale highs. The Steam-coverage cliff of Chapter 8.1 is this exhibit. 9. **[market_economics.html](market_economics.html) (Market Mechanics):** The "Two Economies" model plus the measured fee census, the walled-garden premium, the $128.1M of non-withdrawable committed buy orders and the $30.9M of realised third-party sales. 10. **[card_economy.html](card_economy.html) (The Card Economy):** Chapter 9 as an exhibit — the $5.00 entry gate, the enumerated automation clause, the commercial-use trap, the enforcement record and the governance findings. 11. **[security_timeline.html](security_timeline.html) (Security Chronology):** Chronological record of Valve's safety and trade-restriction updates from 2018 to 2026; 16 entries, 10 verified for both event and date, 6 partly verified. 12. **[social_graph.html](social_graph.html) (Relationship Graph):** High-performance interactive visualization rendering friendship connections, comment links, and profile overlaps (3,435 nodes, 4,551 edges). 13. **[license_disclaimer.html](license_disclaimer.html) (Rights Declaration):** The "one actual rule" legal waiver and public-interest declaration surrendering all compilation rights to humanity. ### Raw Data Core (steam_tos_assets/): - `master_registry.json` — Canonical registry: 26 filter-split pairs, 18 separate-domain routes without a split, 58 same-domain-or-subdomain routes, 13 platforms with no Steam login, 3 unresolved. - `full_platform_proxy_map.json` — Operational directory mapping gambling/trade platforms to active authentication hosts. - `auth-route-audit.json` — Consolidated network capture logs and verification statuses for 189 domains. - `domain-registration.json` — WHOIS/RDAP registrar database confirming registration timestamps. - `live_verification_2026-09-22.json` — Latest real-time Link Filter block checks for 179 domains. - `dead_domains_2026-09-22.json` — Dead or dormant auth hosts excluded from the active audit directories. - `selected-support-records.json` — Curated support tickets confirming authorization, reset, and rollback actions. ### Market Data Core (licensed cs2.sh snapshot, steam_tos_assets/): - `cs2sh-manifest.json` — Provenance manifest: per-file SHA-256, capture timestamps, the 323-file item-render set, and the **plan boundary** record quoting the provider's verbatim HTTP 403 for every history and archive endpoint. - `cs2sh-atlas.json` — The full five-marketplace price ladder for 30,266 item categories. - `cs2sh-artefact-screen.json` — Evidential grading (A/B/C) of the above-cap census. - `cs2sh-realised-highs.json` — Completed-sale highs, trailing 90 days, one marketplace. - `cs2sh-steam-fee-census.json` — Effective Steam fee solved for all 29,635 priced item types. - `cs2sh-walled-garden-premium.json` — Steam ask versus cheapest third-party ask across 28,700 items. - `cs2sh-steam-locked-capital.json` — Census of funded, non-withdrawable Steam buy orders.