A serious security incident followed by repeatedly broken compensation promises
On 19 July 2026, I experienced a serious incident involving the official ShadowPay TradeManager Chrome extension and an item listed for approximately USD 3,300. A sale-style notification appeared in the browser where the official extension was installed. It looked like a legitimate ShadowPay transaction and instructed me to approve a Steam trade. Relying on that notification and ShadowPay’s normal workflow, I approved it through Steam Mobile Authenticator. The item was transferred to an unintended third-party account, but no matching sale, transaction or payment existed on ShadowPay. My case was handled under Support Request #55265. In preserved written communications, ShadowPay representatives referred to a website and/or extension vulnerability, exploitation connected to the trade and other affected users. The original wording is preserved in screenshots and recordings. Steam rollback recovered the item but imposed a 30-day trading restriction, preventing my normal trading activity. ShadowPay initially agreed in writing to pay USD 2,300 after rollback. I relied on that commitment and completed the rollback. The agreement was then withdrawn, reconfirmed and finally reduced to USD 1,000. I accepted the USD 1,000 because I had rent, bills and essential living expenses to pay. By then, I no longer trusted the company as before and feared that rejecting it might leave me with nothing. I signed no waiver, release or full-and-final settlement, and I did not abandon my claim for the remaining USD 1,300. Even this payment was mishandled. Two support representatives assured me that the full USD 1,000 would reach me, yet the BNB transfer was worth only about USD 939–940 when received. The incident, repeated reversals, delays and uncertainty caused serious psychological distress and affected my sleep, concentration and emotional wellbeing. I spent many days preserving evidence, recording communications, archiving pages, checking transactions and trying to obtain a clear answer. Reports or submissions have been made or attempted through: National CSIRT-CY Cyprus Police Cybercrime Unit Cyprus Consumer Protection Service SingCERT / Cyber Security Agency of Singapore Singapore Police Force – I-Witness Competition and Consumer Commission of Singapore CASE Singapore Google Chrome Web Store Google Chrome Web Store One Stop Support No regulator, police authority or court has yet made a final determination. This review describes my documented personal experience. A redacted public evidence package has been prepared, but Trustpilot does not allow external links or attachments in reviews. If Trustpilot’s Content Integrity team requests verification, I am ready to provide the complete evidence directly, including screenshots, recordings, Steam trade and rollback records, full ShadowPay correspondence, archived pages, extension and payment records, metadata and SHA-256 hashes. I consent to Trustpilot reviewing and, where permitted, using appropriately redacted supporting material. Some evidence is not public because it contains personal, account or third-party data and may be relevant to regulatory or legal proceedings. The complete original evidence remains preserved for competent authorities, courts and legal representatives. I am preparing to consult lawyers in two jurisdictions. Depending on their advice and official responses, further evidence that can lawfully be disclosed may be made public. A platform promoted as protecting users from fake or incorrect trades should provide a reliable workflow and honour clear written commitments when something goes wrong. That was not my experience.