THE DEFENCE NAMES ALL THREE.
Valve must answer for every game it puts behind its defence.
The New York response brings CS2, Dota 2 and Team Fortress 2 into one account of value, security and consumer rights. The documented controls do not cover them equally. Follow the gap between the statement, the protection available to a victim and the power Valve exercises over the same assets.
EXISTING LAW / A GLOBAL PLATFORM
A greeting addressed to New Yorkers does not confine the economic mechanism to New York. Valve operates the account, inventory and transfer infrastructure across territories. The question is how existing law applies to the transactions it offers.
The 25 February 2026 filing expressly examines TF2 and Dota 2 alongside Counter-Strike. Paragraphs 67–74 describe their paid random-item mechanisms. Naming all three in the response therefore creates a responsibility to explain protection in each.
NYAG invokes existing New York law and seeks an injunction, consumer financial relief, disgorgement and a penalty. Valve’s preference for future legislation does not decide that dispute. The requested relief is set out on PDF pages 50–51.
The case tests a mechanism used across Steam: paid random outcomes, transferable items, outside liquidity and the issuer’s control. The consequences matter wherever that mechanism operates. Valve should explain which product and infrastructure changes it would make, which users would receive protection and how it would apply those changes across its games and markets.
Valve’s Steamworks documentation identifies Perfect World as the partner for an onshore Steam China. It requires government approval before a game is published there and an ISBN displayed on the product page. Valve can therefore describe regional partners, approval requirements and a distinct product configuration when that is how it enters a market.
The comparison sharpens the New York question: Valve has already configured a separate product for another territory, so it must identify the protections it can extend here, the alternatives it rejected and the cost it accepted. The Russian funding-provider record raises a separate demand for intermediaries, territorial controls and the transactions they process.
THE SCOPE OMITTED FROM THE REASSURANCE
A completed-trade reversal and a delay before delivery do different jobs. A platform-wide defence should identify which remedy each player receives.
The general hold policy and CS2’s completed-trade protection operate on different sides of delivery.
The Trade Protection FAQ names CS2 as the only supported game. Reversal undoes all protected trades from the preceding seven days and imposes a 30-day trade and Market cooldown on the initiator. Counterparties do not receive that cooldown merely because another person reversed.
Dota 2 and TF2 users appear in the defence. They do not receive the reversal it invokes. Valve should publish the reason for the difference, the rollout timetable and the theft losses left outside the remedy.
A July 2019 bug made some crates produce an Unusual hat on every opening. Valve fixed it the following morning and locked the affected hats. Its announced remedy made the first affected hat per account tradable, kept additional ones locked, restored qualifying deleted hats and offered eligible refunds for hats, crates and keys. The 16 August update confirmed the selective release.
Locate the hats created by the crate bug.
Release the first affected hat; keep additional hats locked.
Restore qualifying deleted hats and offer eligible refunds.
That is active administration of scarcity and consumer remedies. Put the same specificity into the theft policy: identify the affected item, the available intervention, the reason for refusal and who bears the loss.
THE PLAYER’S COLLECTION
Items can serve as an appearance, a remembered collection and an exchange instrument at the same time. Preserved Dota testimony describes cosmetics as support for the game and a refused restoration. This is an account of personal loss beyond the case-opening transaction.
Choose a game to follow the role highlighted in this investigation. This is a qualitative comparison of the cases and instruments discussed below.
A skin can become part of the player’s loadout and identity.
Selected liquid skins are priced, transferred and used for settlement by outside markets and gambling services.
CS2 has the trade-reversal route described in Valve’s Trade Protection FAQ. Market and Wallet losses have other rules.
Victim accounts centre on a collection attached to a hero, a style and years of play.
Arcanas and other transferable items have trading roles. Price alone does not account for the personal loss.
The FAQ’s supported-game scope leaves Dota outside that recovery route. Valve should explain its protection and restoration policy.
Cosmetic appearance and rarity remain part of what the player values.
The Mann Co. Supply Crate Key is documented as tradable and marketable. Follow its role after the CS:GO key restriction.
Valve designed a selective remedy for the 2019 issuance bug. Theft recovery and CS2’s trade reversal need their own explanation.
THE ISSUER’S ADMISSION / THE COURT’S ORDER
Valve said fraud networks were using keys to liquidate proceeds and believed nearly all purchased keys subsequently traded or sold were fraud-sourced. It made new in-game key purchases non-tradable and non-marketable. Existing keys retained those functions.
Valve’s own explanation identifies a monetary use for game items and a restriction the issuer could impose. The distinction between existing keys and new purchases also shows how precisely it could change the trading function.
TF2’s Mann Co. Supply Crate Key remains a documented tradable and marketable instrument. After Valve restricted new CS:GO keys in 2019, what monitoring followed the other liquid instruments on its own platform? Publish the cross-game review, the services identified and the restrictions actually applied. The issuer cannot end its explanation at the boundary between two games.
After ExpressTrade launched, Valve said it violated the Subscriber Agreement and enabled avoidance of Valve’s policies. The company published a demand to stop and announced that OPSkins’ Steam accounts would be locked by 21 June.
The record names a business, a practice and an account-level deadline. Apply that level of detail to the operators warned in 2016 and to the later P2P model: what was disabled, what reappeared and which business actually lost the ability to operate?
The transition to player-held inventory ↗THE CANADIAN ORDER TESTED VALVE’S CONTROL.
The Ontario court ordered Steam to disclose account information and freeze the bankrupt’s accounts.
The trustee records receiving login, account, inventory and trade histories for five accounts.
The 11 July report concerns Aiden Pleterski and AP Private Equity. The trustee identifies more than 100 trades during bankruptcy and infers cryptocurrency settlement. The court order and the records subsequently supplied by Steam show that inventory, account histories and transfer restrictions can become concrete instruments of asset recovery.
Order §§3–4 · PDF p. 12 ↗Follow the item, identify the account, preserve the history and explain the restriction. Those are concrete requests directed at the issuer and custodian of the record. The Canadian file gives the investigation a documented example to put beside Valve’s general statements about control.
KNOWN LOSSES / MEASURABLE RESPONSIBILITY
In December 2015, Valve reported this scale and described organised theft aimed at experienced users as well as newcomers. It also recognised the monetary incentive created by item trading. This is a dated baseline, not a current monthly estimate or a cumulative count.
How much loss followed a known defect, and how long did Valve leave that defect in place? Answering requires the incident records, notice dates, fixes and remedies in Valve’s possession. Neither the 2015 figure nor the later million-account total — the March 2026 statement reporting over one million locked accounts — supplies that breakdown.
The author reports unauthorised purchases of low-value Dota items on 6 July and says support sent template replies. The disputed route is the Market and Wallet.
Read the original account ↗The author reports that support reset credentials and removed protections in an earlier incident, followed by inventory theft and refusal to restore. The authenticated recovery decision sits in Valve’s support records; Valve should produce it.
Read the original account ↗These are dated victim reports. The account and support logs that would settle them are held by Valve and belong in the disclosure demand. A standard warning about suspicious links does not resolve the specific transaction or recovery decision being disputed.
Record the credential involved, its creation and use, confirmation prompts and the actions it authorised. The historical key-registration issue and the later session-token workflows must be tested separately.
Historical API-key record ↗A substituted trade, a direct transfer and a Market purchase move value differently. Identify the receiving account, the confirmation event and the remedy applicable to that route.
The Market loss route ↗A malicious page, a renderer exploit and a support-mediated account reset need their own evidence. A single label such as “API scam” conceals the stage where protection failed.
The dated filter audit ↗STEAMWEBHELPER / CEF / DESTINATION CHECKS
DARKNAVY’s June 2024 research documents Steam’s embedded Chromium architecture and historical exploitation. It puts the browser security timeline directly into the accountability record: exposure, disclosure, patching and the consequences for users.
Chromium documents Google-service and API integration choices; the CEF maintainer describes its upstream Safe Browsing default. Valve controls the configuration it ships. It should disclose its actual service connections, reputation checks, patching cadence and the reasons for excluding any available protection.
Publish the shipped CEF version, patch lag, sandbox settings, active reputation services and reproducible warning results across the client, overlay and Big Picture. Compare the same dated destinations and record which protection actually stopped the visit.
The dossier’s embedded-browser investigation places the user’s actual protection on the record. A failed warning in a captured build is a concrete failure to address. Valve controls the shipped configuration and should disclose which services it enables, which it excludes, how quickly it patches and what those choices mean for users exposed to malicious destinations. Read the wider browser investigation ↗
VAC / KERNEL ACCESS / PLATFORM STRATEGY
Riot documents Vanguard’s kernel-mode driver. FACEIT describes a kernel driver, client and server SDK for protected CS2 matches, with Windows-only availability. These are deployed approaches to protecting competitive play. Microsoft documents the driver-signing and compatibility requirements that govern this route.
Valve must account for cheats that survive its protections, the time they remain active, the matches they affect and the users left without an effective remedy. Detection coverage, response times, erroneous bans and appeal outcomes belong in that account. A technical strategy is judged by the protection it delivers to players.
Valve’s own Steamworks guidance recommends authoritative servers and explains how game-ban systems should communicate with affected users. That gives Valve a standard against which its implementation and treatment of users can be examined. Publish how the layers work together, where coverage fails and how those failures are remedied.
PhishDestroy’s criticism is directed at Valve’s priorities. SteamOS, Proton and control over its browser and anti-cheat stack serve Valve’s platform strategy. Corporate independence does not discharge its responsibility for security. When users face cheating, inventory theft or ineffective recovery, Valve owes an account of the protection it shipped, the alternatives it rejected and the consequences it accepted. The relevant configuration and decision records are in Valve’s hands; producing them is part of accountability.
What protection did your architecture leave missing, who carried the cost, and what have you changed to prevent the same harm recurring?
REVENUE BEFORE THE BAN / LOSSES AFTER IT
Valve’s CS2 documentation connects Prime status with weekly item rewards. That creates an economic question about paid access, item issuance and repeat account purchases. Answer it with a purchase cohort and transaction ledger.
The farm’s economics depend on how little hardware time each running instance consumes. Reducing rendering load and sharing resources increases the number of accounts a given setup can sustain. Microsoft documents GPU resource sharing across virtual machines. Valve should explain which signals it uses to identify such automation, which controls interrupt it and how long the farm continues earning before intervention.
Use one currency throughout. The starting values are illustrative assumptions, not current prices or expected returns.
After 13 weeks: 90.3% of the initial entitlement and setup cost recovered.
Weeks = (entitlement + setup) ÷ (weekly receipts − weekly cost).
This simple scenario excludes bans, replacement purchases, price changes and time without earnings. Gross spending is not Valve’s recognised net revenue: taxes, refunds and the purchase channel must be reconciled. A Steam ban count supplies none of these inputs.
Newly purchased entitlements, legacy access, stolen accounts and ordinary users need separate cohorts.
Reconcile entitlement receipts, case purchases and internal Market fees. External trade value is a separate flow.
Track inventory restrictions, replacement accounts, continued operations and successful appeals.
Valve’s receipts and the farm’s continued operation belong in the same account. Match entitlement purchases, item issuance, Market fees, restrictions and replacement accounts over time. That would show the commercial benefit accumulated before a ban and whether enforcement actually stopped the operation.
The model shows the records to join. The payback calculator above provides the editable arithmetic.
The scenario begins with newly purchased entitlements for the farm’s accounts. The payment and the account cohort are the first entries to reconcile.
Purchase date · account cohort · entitlement · receipt · refundValve’s CS2 documentation connects Prime status with weekly item rewards. Follow what the eligible accounts receive, when the activity is recognised and which protection interrupts it.
Eligible account · reward date · issued item · activity recordThe farm’s receipts depend on the route and fees. An internal Steam Market transaction and an outside cash sale leave different ledgers. Reconcile the reward, transfer, sale and money actually received.
Item identifier · transfer · venue · sale proceeds · retained feesA restriction changes the account’s access. The investigation asks whether the same operation continues, replaces its accounts or loses the ability to earn. Follow purchases and losses after the intervention.
Restriction date · retained inventory · replacement account · later receiptsCOLLECTIBLES / PRECEDENTS / COMMUNITY
In an interview published on 8 November 2024, Lisa looks back at her interest in blind boxes and rare collectibles earlier that year.
The original April post — the first-person collecting record behind the 8 November 2024 interview — remains a separately sought primary source.
The official release describes paid passes, play-earned credits and item redemption. It places another cosmetic product inside Valve’s monetisation architecture.
The statement compares mystery boxes with physical collectibles. Valve issues the item, sets the paid sequence, executes the transfers and can stop the holder from using the market. The collectible comparison erases every one of those issuer powers.
Valve chose a collectible associated with a recent, highly commercial collecting boom. Put that choice beside the sequence: Lisa dates her collecting interest to early 2024; Valve introduces CS2 weapon charms on 2 October 2024; Valve invokes Labubu in its 11 March 2026 defence. PhishDestroy’s argument is that the analogy makes paid random outcomes feel like familiar collecting while directing attention away from Steam’s liquid item economy and the issuer’s control. The commercial role of appearance is also visible in the seven-Major inspect dataset ↗.
POP MART annual report · RMB billions · scale 0–15
Company-reported revenue for the full IP that includes Labubu, not resale turnover or Labubu alone. These figures show the commercial scale of the collectible market that Valve chose for its analogy.
The useful comparison with FIFA is the architecture of value. Steam combines transferable inventory, an internal Market and outside sale routes. Valve created and administers the transfer infrastructure on which that liquidity depends. A judgment about EA’s implementation cannot answer questions about Valve’s own system. Valve’s regional response in the Netherlands belongs at the centre of that comparison: when the obligation changes, the platform can change access. Follow the regional-control record ↗
In the community material examined by PhishDestroy, the appeal to privacy repeatedly meets ridicule and complaints about cheating, fraud and the security of inventories. Valve’s defence fails to answer the problem those players experience: a platform with extensive records and commercial control that still leaves them exposed. Their demand is effective protection and a remedy after loss.
Valve published the response on 11 March 2026. Its choice of audience, collectible analogy and privacy argument are the subjects of this analysis. The investigation treats the publication as the company’s position.
The broader dossier brings together support records, community discussions, reviews, technical material and commercial data. Those streams are used to examine how Valve’s public account compares with its users’ experience. The source archive preserves the dated records behind each part of that examination.
THE RECORD VALVE SHOULD PRODUCE
Publish theft losses, reversals, refusals and the reason Dota 2 and TF2 remain outside Trade Protection. Separate trades, Market purchases, gifts and recovery incidents.
Identify the financial instruments monitored after new CS:GO keys stopped circulating, the flows displaced and the interventions that followed.
For each security failure, provide the first notice, affected builds, exploitation evidence, patch date, affected population and compensation or restoration outcome.
Reconcile the relevant account cohorts with entitlement receipts, item issuance, fees, restrictions, repeat purchases and operator survival.
Disclose browser protection settings, anti-cheat coverage and measured trade-offs. Make the decisions that affect user security open to independent examination.
The items have an economic function. Valve has operational control. Protection and accountability must match both. The record now contains Valve’s own fraud admission, a court-directed account disclosure and a documented gap between the three games named in its defence.
THE PUBLIC RECORD
Sources cited in this article appear first. Select “All records” to inspect the complete 107-record register shared by the investigation; the dedicated evidence files retain their own detailed registers.
No matching records. Try a different term or select “All records”.
Reviewed 11 October 2026 UTC. The game comparison uses the current Trade Protection FAQ and the separate general hold policy. The Canadian exhibit distinguishes the court’s order from the trustee’s account and valuation. Victim reports retain their original dates and source links.
The farm model exposes its assumptions and arithmetic. Technical sources identify the documented architectures; the requested Steam-specific record includes the shipped configuration and observed protection. The New York exhibit is the February complaint, with its allegations and requested remedies attributed to the filing.
Casino commerce, account custody and remote control inside Steam.