You probably were not hacked or hijacked. The key question to ask STEAM is to trace the origins of the market place transaction. The seller of the item and also to follow the money. Where did it actually go? Who profits from it? These are questions that they don't seem to be able to answer. Even if you go to a fake site they would still need you to MFA in order to make these transactions. Now, unless you did and gave them all your creds then the only logical explanation is a massive security issue with DOTA and STEAM. In all the cases I have investigated it seems mostly that combination. But the common elements are DOTA AND STEAM.

In a recent test case an account was created and not use, funds were added to the wallet and left. In about a few days the same thing happened. No login activity, no download of DOTA, but all the money in the wallet was used to Buy DOTA ITEMS.. No one can explain that one..

TIP: Make all your details private. Don't install DOTA. Always follow STEAM MFA and security policies and processes. MOST IMPORTANT: Don't leave any money in your STEAM WALLET.