[gruez]

how were they able to conclude the coins were stolen?

[pests]

It’s not this. Steam accepted 0confirmations to ease the payment flow. Before the transaction would be mined into a block, the fraudster would submit a new higher priority transaction sending the payment to themselves.