Scan for malware.

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change password and generate new back up codes.

First of, report the user or users that scammed you and explain all this in the report.

EDIT: It wasn't the guy who wrote in your profile right?
Did you fall for the link trick on his profile?

Do the stuff that was suggested above..

Originally posted by Spwaaa:

someone who contacted me about wanting several, cheap items for one more expensive item.

This is where you messed up royally, this where you should have been very suspicious and taken it slow and maybe even ignored him.
The scam methods will change but this part AKA the bait is always to good to be true.

They have tried lying about users quitting csgo and giving away their items for free but I guess that one was too obvious and they started with this story instead.

I'm just confused about how a separate trade offer was sent and accepted. I only confirmed one; is this pointing towards a hack?

Hack, no. Hijacking, sure.

Your account info was compromised some how.

Because (I assume) you did what you were told and clicked the link in his profile which leads to a phishing website, a copy of a steam profile and logged in there and gave them your account name, password and a steam guard code.
Did you do this?

Originally posted by Forcen:

Because (I assume) you did what you were told and clicked the link in his profile which leads to a phishing website, a copy of a steam profile and logged in there and gave them your account name, password and a steam guard code.
Did you do this?

If I did, I do not remember it.

What do you remember?
Your story is missing the start. Was it the guy who wrote a comment on your profile or not?
How did you find this guy and how did you send him the offer?

When you agreed to the trade, did you check the items in it?

Originally posted by Forcen:

What do you remember?
Your story is missing the start. Was it the guy who wrote a comment on your profile or not?
How did you find this guy and how did you send him the offer?

Yeah, it was the guy who wrote on my profile- I did click a (probably fake) trade link, but I don't remember logging into my browser. I thought I did the trade offer from the steam client, then confirmed it through mobile guard.

Originally posted by Muppet among Puppets:

When you agreed to the trade, did you check the items in it?

Absolutely.

And it wasnt the trade that happened right after you clicked agree to exactly that trade.?
Thats very unlikely.

But if thats what happened, contact support.

Originally posted by Muppet among Puppets:

And it wasnt the trade that happened right after you clicked agree to exactly that trade.?
Thats very unlikely.

But if thats what happened, contact support.

It was not the trade that happened. The fact that it is unlikely is why I'm so flummoxed. I have reported the user and have sent a message to support.

They must have switched the offer somehow.
Can you see two similar offers here? https://gtm.steamproxy.vip/my/tradeoffers/sent/?history=1
This stuff is more for valve to figure and and fix..
The part before when you fell for his bait and clicked a link you shouln't have could still have been avoided.

Anyway, there are two profiles in this this story, the real profile of the person who wrote on your comments and fake one he links in his profile. this leads to a fake steam profile with an offer link.

I bet valve are painfully aware of this, there are hundreds of profiles like this out there and they all make new websites all the time that valve blacklists as a temporary fix.
They need to fix the trick that hides the [website.com] thing on profiles and fix any issues with the app.

Can you search your web browser history (ctrl+H) for any websites that end with " .xyz " or "tormecio"? (don't visit them)

Originally posted by Forcen:

They must have switched the offer somehow.
Can you see two similar offers here? https://gtm.steamproxy.vip/my/tradeoffers/sent/?history=1
This stuff is more for valve to figure and and fix..
The part before when you fell for his bait and clicked a link you shouln't have could still have been avoided.

Anyway, there are two profiles in this this story, the real profile of the person who wrote on your comments and fake one he links in his profile. this leads to a fake steam profile with an offer link.

I bet valve are painfully aware of this, there are hundreds of profiles like this out there and they all make new websites all the time that valve blacklists as a temporary fix.
They need to fix the trick that hides the [website.com] thing on profiles and fix any issues with the app.

Can you search your web browser history (ctrl+H) for any websites that end with ".xyz" or "tormecio"? (don't visit them)

Yep and yep. Two similar offers, but one is the offer I confirmed and one is the offer that was accepted. Tormecio on the end of one link. I was definitely being stupid in there, but I'm, again, just flummoxed that it happened so quickly and without any chance from me to confirm the second offer.

Your account is accessed by someone else. That is what one can already say.

If there are two trades, was yours cancelled? Then you couldnt have agreed to that.
Remember back to differntiate between expectation and what actually happened.