Are we sure DECA is actually the one losing money or not? For third party processors, if you have $25 in your steam wallet balance, then you buy $20 worth of RotMG gold using steam funds, you receive the 2600 gold, but at that point does steam pay RotMG $20? They must, right? So if the exploit is through steam's wallet stuff, DECA is getting paid the full amount, but steam loses out.