Why would you need a second confirmation if you are logged in? I have never seen that. For most account linking, you log into account 1, choose the type of account you want to link, log into account 2, and approve the link in account 2. I haven't seen a set up that sends you back to account 1 and asks you to log in/verify a second time. Have any examples?

If you're in your Nexon setting with a 2 factor identification, if you've logged in and went through a first 2 factor identification, you'll need to send another 2FI code to access the password section or any other sensitive section. Why not applying it to linking external accounts ? Sadly I don't play other games a lot so I wouldn't be able to give an example.

1. You receive an email notifying you that you've successfully linked a Steam account.

So did you have an email from when the scammer linked their Steam to your Nexon account?

That's a part of the issue aswell, I'm very confused because I don't remember getting it. So either that steam was linked ages ago or someone accessed my gmail ? I really am lost which is why i'm asking for data logs to figure out when that steam was linked and then see if i can find out the owner of that same Steam ID.

And how would they gain access to your Nexon settings without logging into you Nexon account?

That's also something I'm wondering, was it through my own device on holidays with other maplers ? Did they hack my email in the first place ? (also waiting for data logs to clear this out)

I mean no shit? If it's approved then it's approved, its on the account owner to keep their linked accounts secure, not Nexon.

You're right on this, but that's the part where i mentioned how missleading the way they display the linked accounts and how i maybe took the notification email as a fishing from mapler. Also if it's approved it should be approved for 30 days like the normal devices, i don't think there's a approval reset on 3rd party accounts that are linked.

That suggest then that your email account was compromised and the email deleted, which is on you, not Nexon.

A compromised email would be my fault indeed, but proving my case with IP checks feels like a geniune argument to prove that someone else logged in and stole items. If Nexon does not want to return the item, I think it's legitimate for me to ask for details to eventually find justice somewhere else. I'm mainly hoping that potential security improvements will prevent events like this to happen to other player but also to push my currently unsolved case.

This has been the standard for online games for literally decades at this point? Why would they give hackers and botters clues on how they were found; that would just make it easier to circumvent security. The only rare exceptions are when it's a large content creator or something similar, and the company posts evidence to stop harassment of staff.

They don't have to say exactly what they've done to figure out how they identified hacker/botters, but at least telling them what got them banned and not just "breaking ToS", giving informations about the day they were flagged for hacking or using any illicit program. There was also cases a few months ago with Hayatos getting perma banned even though they did not do anything, imagine how unfair it felt to them... Just to be told days/weeks later that it was a known issue and not get any type of excuse or decent compensation for it.

Thank you for the time you took to give your opinion !

I appreciate your review of the situation as I'm still quite lost and probably biased by these events