How To Get Infinite Money On Steam

If you click on a link and make a purchase we may receive a small commission. Read our editorial policy.

A Steam exploit could've let you add infinite money to your wallet

Valve have patched information technology, and paid $7500 to the discoverer

Until recently, Steam had an exploit that could've let you lot add unlimited funds to your Steam Wallet. Discovered by security researcher "drbrix", the storefront had a way users could fake the value of their deposits by changing a few words in the email accost associated with the account. Valve have patched the exploit now though, and awarded $7500 (around £5410) to drbrix for finding information technology.

The hack would've involved a Steam user irresolute their account email address to include the phrase "amount100", before adding a little scrap of money to their Wallet using a method that goes through the Smart2Pay payment organisation.

This exploit would then let the hacker intercept the request being sent to Smart2Pay'due south servers, assuasive them to alter how much money they were actually adding. And so if they just paid $one, they'd be able to plough that into $100 instead. (I guess it's technically non "infinite" if you have to pay a little fleck every fourth dimension, but however!) You lot tin can read the full explanation of how it all worked over on HackerOne.

In a thread that'southward now been made public (seeing as the exploit has been stock-still), Valve staff member "jonp" thanked drvrix, rewarding them with the $7500 bounty.

"This was clearly written and helpful in identifying a real business chance. We have changed the severity assessment to Critical, reflecting the potential cost to the business, and applied a bounty accordingly," jonp said. "We hope to hear more from yous in the future."

Information technology's unclear if anyone managed to use this hack before information technology got patched, but in a statement to The Daily Swig, Valve said: "Thank you to the person who reported this bug we were able to work with the payment provider to resolve the issue without whatever impact on customers."

All'due south well that ends well then. Except for the people who might've been using that issues in secret, I suppose. No more than freebies for them.