Click deposit on a CS2 site, pick an AK, and one of two things happens. On some sites a trade offer from a bot appears in Steam within seconds. On others nothing happens for a while, until another player somewhere decides to buy your skin and the site tells you to send it to them. Same button, two very different systems underneath.
The difference used to be mostly about speed and pricing. Since Valve introduced Trade Protection in 2025 it also decides when your balance is actually yours to withdraw, and which scams you need to watch for. Here's how both models work, step by step, and how we'd choose between them.
The short version
| Bot deposits | P2P deposits | |
|---|---|---|
| Who receives your skin | A Steam account owned by the site | Another player who bought it on the site |
| How fast the trade happens | Usually seconds to minutes | Whenever a buyer shows up and you send it |
| Who sets the price | The site's price list | Mostly you, within the site's limits |
| Withdrawal selection | Only what the bots hold | Whatever other users have listed |
| Main scam to watch for | Fake bots and phishing logins | API key hijacking with a fake buyer |
| Trade Protection impact | Credit may be held or restricted for about a week | Seller's payment usually held until protection ends |
How bot deposits work, step by step
Bot-based sites run a set of Steam accounts that act as the site's inventory. You trade into a bot, the site credits your balance, and withdrawals come back out of the same pool.
- Log in with Steam on the site's real domain and save your trade URL in the account settings. If you're not sure where to find it, our Steam trade URL guide covers it.
- Open the deposit screen and pick skins. The site loads your inventory with its own price on each item. Items still under a trade cooldown or protection are greyed out.
- Request the trade. The site generates an offer from one of its bots and shows you a short security code, plus the bot's name and level.
- Check the offer in Steam. The security code in the offer message should match the site, you should only be giving items, and the bot should match what the site showed.
- Confirm in the Steam Guard Mobile Authenticator. Without it, Steam holds trades for up to 15 days, which makes skin deposits close to useless.
- The site credits your balance, either right away or with conditions attached, depending on how it handles Trade Protection (more on that below).
Withdrawals run the other way. You choose an item from the site's stock, a bot sends you an offer, and you accept it.
Where bots fall short
The biggest cost of a bot site is the spread. The site needs to buy your skin for less than it sells skins to other players, otherwise it loses money on every trade. An illustrative example:
| Same skin, market value about $100 | Price |
|---|---|
| What a bot site might credit you on deposit | $92 |
| What the same site might charge to withdraw it | $105 |
| Round-trip cost if you deposit and withdraw the same item | About 12% |
Real spreads vary by site and by item. Popular, liquid skins tend to have thinner spreads. Odd items, stickered skins and low-float pieces tend to get valued below what a collector would pay, because the site's price list doesn't care about float or sticker placement (our float values explainer covers why that matters).
Bots also limit what you can withdraw. If the site's bots don't hold the skin you want, you can't have it. And bot accounts occasionally get restricted by Valve, which can freeze items for a while. Good sites cover that for users, but it causes delays. Finally, a bot site holds all the deposited skins in one place. If the site ever shut down overnight, that inventory goes with it.
How P2P deposits work, step by step
On a P2P (peer-to-peer) site, the site never touches your skin. It runs a marketplace and acts as escrow. You sell to another player, they pay with their site balance, and the site releases that money to you once it's satisfied the trade happened and can't be undone.
- Set up Steam access. Same as above: real domain, trade URL, mobile authenticator, inventory set to public. Some P2P sites also ask for a Steam Web API key so they can track trade offers automatically. Only ever paste it into the real site.
- List your skin. Pick the item and set a price. Most sites suggest a value and let you add a small markup or discount. A discount sells faster.
- Wait for a buyer. Your item appears in the site's withdrawal marketplace. When someone buys it, their balance gets locked in escrow.
- Send the trade. The site notifies you and shows the buyer's Steam profile: name, avatar, level and account age. You send the offer from Steam within a set window, often measured in hours.
- Confirm it in the mobile app, after checking the receiving account is the same one the site showed you.
- Get paid. Under Trade Protection, the site generally holds your payment until the protection period ends, then releases it. Some sites let you use part of it sooner with restrictions on withdrawing.
When you withdraw on a P2P site you're simply the buyer: pick a listing, pay with balance, and wait for the seller to send the item. If they don't send it in time, the purchase is cancelled and your balance comes back.
What P2P gets right, and what it doesn't
P2P pricing tracks the real market much more closely, since sellers compete with each other. The selection is huge on busy sites because it's every user's inventory, not the site's. And the site isn't sitting on a giant pile of skins in bot accounts.
The downside is people. Sellers go offline, forget, or change their mind. A withdrawal that should take ten minutes can take hours. And P2P is the main target of the Steam API key scam, which we cover below.
What Trade Protection changed
Since mid-2025, Valve applies Trade Protection to CS2 items. For 7 days after a trade, the traded items are protected, and the original owner can reverse the trade. Valve's goal was to make stolen and scammed items easier to recover. It worked for that. It also broke the old model for skin sites.
Think about it from the site's side. Before, a seller could deposit a skin and have spendable balance within minutes. Under Trade Protection, a dishonest seller could take the balance, cash it out as crypto, then reverse the trade and get the skin back. The site (or the buyer) would be left with nothing.
So sites adapted, each in their own way:
- P2P sites generally hold the seller's payment until the protection window has passed. If the seller reverses the trade, the escrowed money goes back to the buyer. Buyers are protected; sellers wait.
- Bot sites either delay the credit, or credit it but restrict withdrawing that value (sometimes only letting you wager it) until the window ends.
- Withdrawals land in your inventory with the usual 7-day trade cooldown, so you can't flip a withdrawn skin straight away.
A P2P sale on a typical site now runs on this timeline:
| When | What happens |
|---|---|
| Day 0 | A buyer purchases your listing, you send the trade and confirm it |
| Day 0 to 7 | Your payment shows as pending; the buyer has the item but it's protected |
| Around day 7 to 8 | Protection ends, the site releases your balance, and it's free to play or withdraw |
The practical lesson: skins are now a slow way to fund a quick session. If you want to play tonight, or might want to cash out within a few days, crypto is the better route. Our guide to crypto deposits on CS2 sites covers which coins are fastest and cheapest.
The scams that target skin deposits
API key hijacking (mostly P2P)
This is the big one. A phishing page tricks you into logging in through a fake Steam window, and the scammer uses that access to create a Steam Web API key on your account. The key lets them watch your trade offers. When you send a skin to a real P2P buyer, they cancel your offer and instantly send a near-identical one to an account dressed up to look like the buyer: same name, same avatar. You confirm on your phone, and the skin goes to the scammer.
Defenses that actually work:
- Check steamcommunity.com/dev/apikey. If there's a key you didn't create, revoke it, change your password and deauthorize other devices.
- Before confirming any trade in the mobile app, compare the receiver's Steam level and account age with what the site showed. Impersonator accounts are usually low level and new.
- Never log in to Steam through a pop-up on an unfamiliar site.
Our full guide to the Steam API key scam goes through the clean-up step by step.
Fake bots and fake support
Real site bots don't send friend requests, and real support doesn't DM you on Discord asking you to "re-send the item to verify it." Bot trade offers should only appear right after you request a deposit or withdrawal, carrying the security code the site shows. Anything else, decline.
Trading outside the site
Some players try to skip site fees by trading directly with strangers. Since Trade Protection, the seller in a private trade can reverse it within 7 days, and there's no escrow to refund you. If you're buying skins from people you don't know, use a marketplace that holds the money.
Which sites use which (generally)
Sites change their setups, and plenty run a hybrid, so treat this as a general picture rather than a fixed rule.
- CSGOEmpire is the best-known P2P marketplace among CS2 gambling sites. Skin deposits and withdrawals go through user-to-user trades, and its large user base means a big selection. See our CSGOEmpire review.
- CSGORoll also uses P2P trading for skins, with a marketplace that's large for the same reason. See our CSGORoll review.
- Case-opening-first sites such as Hellcase, Key-Drop, Farmskins and DatDrop usually send withdrawals from the site's own stock or through a partner marketplace rather than from another player. Hellcase routes skin withdrawals through ShadowPay (details in our Hellcase review), and Key-Drop pays out in skins only (see our Key-Drop review).
You can tell which system a site uses in about thirty seconds. If the deposit flow asks you to list an item and wait for a buyer, then send it to a named user, it's P2P. If a bot sends you an offer with a security code as soon as you click, it's bot-based.
Steam Market, P2P or bot: what a $100 skin turns into
It helps to compare against the obvious alternative of just selling on Steam. The Steam Community Market takes 15% in total (5% Steam plus 10% for CS2), and the money lands in your Steam Wallet, which can't be cashed out and is capped at $2,000.
| Route | What you end up with | When you can use it |
|---|---|---|
| Steam Community Market | About $86.96 when a buyer pays $100, in Steam Wallet only | Right away, but only on Steam |
| P2P sale on a gambling site | Close to market value in site balance, minus any site fee | After the protection window, roughly a week |
| Bot deposit | The site's buy price, often a bit below market | Depends on the site's Trade Protection rules |
What we'd do
If you're funding a session and want to play the same day, use crypto and leave skins out of it. If you're turning a skin you don't use anymore into balance and you're happy to wait a week, a busy P2P marketplace gets you the closest to market value. Bot deposits make sense when you want the trade itself done instantly and you've checked the site's price for your item against the market first.
Whichever you pick, run through this before the first deposit:
- Steam Guard Mobile Authenticator is on, and your trade URL is saved correctly.
- Your API key page is empty, or only shows keys you created yourself.
- You've compared the site's value for your skin with its market price.
- You don't need the money back within the next week or so.
- You know how long you'll have to send items if you sell P2P, and notifications are on.
- You check the receiving account's level and age every time before confirming.
All of the sites we review are 18+ and restrict players from the US and the UK. Skin deposits are still a deposit into a gambling balance, so only use items you can afford to lose.
