Capcom Arcade Stadium’s record player numbers blamed on card mining

Some of my favourite retro video games are making waves on Steam, but not in the way you might think. Classics such as Strider, Ghosts n’ Goblins, and more are all available as content for Capcom Arcade Stadium. This is an emulator which lets you play 31 arcade games from the 80s/90s. The games themselves are paid downloadable content, but the main emulator download itself is free. It also comes with one free game as a taster of the full edition.

It didn’t have a great reception at launch, because people didn’t like titles being sold in bundles only. As such, it was something of a surprise to see it riding high at the top end of the Steam activity charts in the last few days.

Sure, the games can now be bought individually. But would that really equate to an all-time concurrent tally of 481,088 players? Did people really wake up this week and think “What we need in our lives is 3 different versions of Street Fighter 2”?

The numbers game

Make no mistake, these are some of the biggest numbers you can achieve on Steam and it typically requires a massive AAA+ title to achieve it. For example, right now the three top played games on Steam are:

1. Counter Strike: Global Offensive with 507,995 players
2. Dota 2 with 325,679 players
3. PUBG: Battlegrounds with 150,498 players

These are all huge online games, played against other people. Yet somehow we have the archaic arcade emulator, with its one free game by default, storming into the top three.

These numbers are so vast, Capcom Arcade Station has managed to hit 8th place in the top records for most simultaneous players. What could have possibly caused this? The faithful translation of arcade controls to gamepads? The ability to rewind the game should you make a mistake? Customising the individual game’s arcade cabinet before loading up a title?

Nope, it’s bots.

How did bots cause the great player count inflation of 2021?

Generally when we talk about bots in gaming, we mean hacked accounts or PCs performing certain tasks. It could be a DDoS attack, or sending out phishing messages inside game chat, or some other nefarious activity.

In this case, the “bot” is something a little bit different. It’s not something caused by what happens inside the game itself. Rather, it’s a layer of virtual economy and digital goods driving what happens to the player count.

Before we get to the nitty gritty, it’s time to explain the ins and outs of Steam card trading.

Steam card trading

Sometimes folks get confused on this, so for clarity, there’s two types of “Steam card”. The first is an actual, physical gift card you can buy in stores. These cards have monetary amounts assigned to them, and they’re a way to preload your Steam account with credit. You then use it to purchase games from the store. You can also buy “digital” versions of these cards which perform the same function.

The other type of card, the one we’re focusing on, are Steam trading cards. These are items which are tied to certain games, but don’t exist within them. They’re essentially cool looking virtual cards with characters from the game on them. The more you play a game, the more likely the chance you’ll be given a free card drop. When you collect all of the cards for a game, you can create a badge for your Steam profile. At the same time, you’ll be given other community-centric items like emoticons, the possibility of discount coupons for other games, or even the option to bump up your Steam level (another profile feature).

The system is designed so you can’t just grab all of the cards by playing. There’s a limit on how many you’ll receive and then you need to get the rest by trading with friends, or buying from the Steam marketplace.

This is a very detailed system with a lot of depth to it. Steam trading is big business, and often one of the focal points for scams, phishes, and malware antics. However, that’s not the case here.

Rather, it appears to be users trying to game the system for their own ends. For once, nobody is compromising accounts and running off with a sack full of stolen logins.

Still, this begs the question: what is happening here?

The wonderful world of card mining

It’s not just Bitcoin hogging all the space in the mines these days. Steam cards can also be mined, and there’s a surprising number of tools available to do it. One of the most popular is something called ArchiSteamFarm. This is a third party tool you can log into with your Steam credentials, and it’ll tell you what can/can’t be farmed. If there are card drops available, you simply tell it which games of yours to “idle” on and we’re off to the card mining races. You don’t have to download the game in order to idle, which makes it super convenient for people wanting cards without gigabytes of downloads and wasted hard drive space.

This is where things get really interesting.

Steam cards usually only drop for paid titles. If you don’t buy the game, you can’t get cards. In this case, the base Capcom Arcade Simulator game is a free download with one free title included. This isn’t (and shouldn’t!) be enough to have cards start dropping.

However, something seems to have gone wrong. All of a sudden, people found they could obtain trading cards despite only having the free game. This meant a huge surge in botting activity to grab cards before someone at Valve—the company behind Steam—fixed it.

As a result, a massive amount of card miners fired up their tools (whether ArchiSteamFarm or something else entirely), and idled their way to sweet card victory. As above, there’s limitations on how many cards you can farm. Once you hit the limit, that’s it – no more mining on that game ever. You have to trade or buy the rest. So this is, essentially, people just wanting to get in on the ground floor of red hot card trading action.

Watching Steam achievement totals drop in real time

As this Ars Technica article notes, you can observe clues regarding the automated action taking place. One way to do this is by checking out Steam achievement numbers. Around 44.6% of people had gained the achievement for loading up a game for the first time a couple of days ago. Now, the number sits at just 7.9%. That’s lower than the previous figure in the article. The only way this number makes sense given the massive user numbers is if huge amounts of new game owners are using tools to “idle” while prospecting for card drops.

The leaky card pipeline has apparently been fixed, so no amount of idling will produce any more cards. This happens to games occasionally, most notably when an error caused card drops for Life is Strange 2. What usually happens after an incident like this is the market is flooded and card value plummets, so it’s probably a fraught time on the old trading card stock exchange or something.

When retro revivals are no more…

Unfortunately my dreams of a Strider revival off the back of massive player numbers and a sudden boom in retro gaming now seems unlikely. On the bright side, the peculiar rise in player numbers didn’t involve people up to no good with malware or phishing.

While Valve probably won’t be too pleased by the inadvertent rush on cards, that is at least one small mercy we can be thankful for.

The post Capcom Arcade Stadium’s record player numbers blamed on card mining appeared first on Malwarebytes Labs.