If you click on a link and make a purchase we may receive a small commission. Read our editorial policy.

A Steam exploit could've let you add infinite money to your wallet

Valve have patched it, and paid $7500 to the discoverer

Until recently, Steam had an exploit that could've let you add unlimited funds to your Steam Wallet. Discovered by security researcher "drbrix", the storefront had a way users could fake the value of their deposits by changing a few words in the email address associated with the account. Valve have patched the exploit now though, and awarded $7500 (around £5410) to drbrix for finding it.

The hack would've involved a Steam user changing their account email address to include the phrase "amount100", before adding a little bit of money to their Wallet using a method that goes through the Smart2Pay payment system.

This exploit would then let the hacker intercept the request being sent to Smart2Pay's servers, allowing them to alter how much money they were actually adding. So if they just paid $1, they'd be able to turn that into $100 instead. (I guess it's technically not "infinite" if you have to pay a little bit every time, but still!) You can read the full explanation of how it all worked over on HackerOne.

In a thread that's now been made public (seeing as the exploit has been fixed), Valve staff member "jonp" thanked drvrix, rewarding them with the $7500 bounty.

"This was clearly written and helpful in identifying a real business risk. We have changed the severity assessment to Critical, reflecting the potential cost to the business, and applied a bounty accordingly," jonp said. "We hope to hear more from you in the future."

It's unclear if anyone managed to use this hack before it got patched, but in a statement to The Daily Swig, Valve said: "Thanks to the person who reported this bug we were able to work with the payment provider to resolve the issue without any impact on customers."

All's well that ends well then. Except for the people who might've been using that bug in secret, I suppose. No more freebies for them.

You're not signed in!

Create your ReedPop ID & unlock community features and much, much more!

Create account
Tagged With
About the Author
Imogen Beckhelling avatar

Imogen Beckhelling


Imogen is a lore enthusiast and lover of all the fun shenanigans game communities get up to. She spends too much time playing Overwatch, and not enough time having interests that aren't to do with video games.

Rock Paper Shotgun logo

We've been talking, and we think that you should wear clothes

Total coincidence, but we sell some clothes

Buy RPS stuff here
Rock Paper Shotgun Merch