🎮 Tekin Review: The Elden Ring Cyber Crime & Weaponized Anti-Cheat

In April 2022, just weeks after Elden Ring's triumphant launch and at the peak of its player community's growth, a bizarre and terrifying event unfolded that would become one of gaming's most notorious security incidents. Players who had invested hundreds of hours into mastering FromSoftware's punishing open-world masterpiece suddenly found themselves facing a message that declared them guilty of cheating - and sentenced them to a 180-day ban from online play. The strangest part? These players hadn't cheated at all. Their only crime was picking up an item from the ground.

The Forbidden Item: Underwear That Should Never Have Existed

Deep within Elden Ring's game files existed an item called Deathbed Smalls - a piece of undergarment belonging to Fia, the mysterious woman who embraces players at the Roundtable Hold hub area and grants them a blessing. This item, essentially a thong or pair of skimpy underwear, was cut from the final release by FromSoftware during the late stages of development. In technical terms, it became "cut content" - data that exists in the game's code but has no legitimate means of acquisition.

The reason for removing this item was never officially disclosed, but many industry analysts believe FromSoftware wanted to avoid unnecessary controversy around the game's content. Fia is one of Elden Ring's most complex narrative characters, playing a crucial role in one of the game's multiple endings through an extensive questline. Having her underwear as an equippable item could have led to unwanted interpretations of her character and potentially distracted from the narrative weight she carries in the game's lore.

Discovery by Dataminers: Uncovering the Hidden

In March 2022, merely days after Elden Ring's release, dataminers began their deep dive into the game's files. These individuals, typically using tools like Cheat Engine and various data extraction utilities, search for hidden content, removed items, and secrets buried within game code. During these investigations, Deathbed Smalls was discovered and documented.

The item possessed all characteristics of complete equipment: a unique icon, item description, defensive statistics, and even a full 3D model. The only thing it lacked was a legitimate acquisition path. This discovery spread rapidly across Reddit and Discord communities dedicated to Elden Ring, sparking curiosity among players eager to see what had been cut from the final game.

What dataminers didn't anticipate was how this discovery would be weaponized. While most cut content investigations remain academic exercises within the modding community, Deathbed Smalls would become the centerpiece of one of gaming's most sophisticated social engineering attacks.

Enter Pantsu Dealer: The Hacker Who Set the Trap

In early April 2022, strange reports began appearing on the Elden Ring subreddit. Players described encounters with a user named "Pantsu Dealer" who would invade their world but, instead of engaging in PvP combat, would drop an item on the ground and immediately disconnect. Players who picked up these items found themselves confronting a terrifying message hours later:

This message indicated a softban - a type of restriction where players cannot connect to the main player pool and are instead quarantined to special servers populated only by other banned players, hackers, and cheaters. The duration of this exile? Exactly 180 days - a full six months of effective multiplayer death.

The Reddit user Ok-Communication7125 was among the first to document this experience publicly. With over 220 hours invested in their playthrough, they suddenly found themselves facing a ban despite never using any cheating tools. Their post sparked panic across the community as more victims came forward with identical stories.

Anatomy of the Attack: How the Trap Worked

Understanding this attack requires examining its multi-layered structure. Pantsu Dealer and similar hackers followed a precise methodology that exploited both technical vulnerabilities and human psychology:

The Anti-Cheat Paradox: Why the System Failed

Easy Anti-Cheat (EAC) is one of the gaming industry's most widely deployed anti-cheat solutions, protecting games like Apex Legends, Fortnite, and Rust. The system operates at the kernel level - meaning it loads as a driver in the deepest layer of the Windows operating system before the game even launches, monitoring all processes with elevated privileges.

EAC scans for modified executable files, memory injections into game processes, suspicious software running alongside the game, and irregular items or statistics in save files. When it detects something anomalous, it immediately closes the game and issues a ban.

However, the core architectural flaw revealed by the Deathbed Smalls incident was EAC's inability to perform attribution analysis. The system could detect that an illegal item existed in a player's inventory, but it couldn't determine the origin story of that item. Did the player use Cheat Engine to add it themselves? Did they receive it from a modder? Did a malicious hacker drop it for them? EAC lacked the contextual awareness to make this distinction, and this blind spot became a weapon in the hands of attackers.

Victim Stories: When Hundreds of Hours Vanish

One of the first publicly documented victims was Reddit user Ok-Communication7125, who had accumulated 220 hours of progress across multiple characters. Their account of the incident painted a harrowing picture: a player named Pantsu Dealer invaded their world, dropped an item, and left. Assuming it was a friendly gift - a common occurrence in Souls games - they picked it up.

Hours later, upon launching the game again, the ban message appeared. They immediately contacted Bandai Namco support and, after providing detailed information about their situation, received a shocking response: the only way to avoid the 180-day ban was to delete all save files and reinstall the game. Otherwise, they would have to wait out the full six-month penalty.

This meant erasing 220 hours of progress, all character builds, every item painstakingly collected, and all completed questlines. For many players, this choice felt worse than the ban itself - it was like being told to demolish your own house to prove you hadn't committed arson.

Other cases emerged with similar patterns. User JeSuisLePamplemous reported that they didn't even know what the item was when they picked it up. They simply saw that an invader had left something and took it - a completely natural action in Souls games, where finding items on the ground is a core part of the gameplay loop and player culture.

The psychological impact extended beyond mere game progress loss. Players reported feelings of betrayal and violation. The Souls community prides itself on a unique honor system where veterans help newcomers, and this attack exploited that very trust. It was the gaming equivalent of poisoning a charity food bank - using generosity as a weapon.

Social Engineering in Gaming: Exploiting Human Nature

One of the most fascinating aspects of the Deathbed Smalls attack was its sophisticated use of social engineering principles. The hackers didn't need to compromise victims' systems, install malware, or steal passwords. They simply exploited a natural and instinctive behavior: curiosity combined with trust in community norms.

In the Souls series (of which Elden Ring is a spiritual successor), players can drop items for others as part of the game's design. This mechanic facilitates trading, assists friends, and enables veteran players to gift rare items to strangers. It's not just a feature - it's a beloved part of the community culture that has existed for over a decade across multiple FromSoftware titles.

The attackers understood this cultural context intimately. They knew that when players see an item on the ground, they instinctively pick it up - whether from curiosity, hope of valuable loot, or simply muscle memory from years of playing these games. This is textbook social engineering: manipulating human behavior rather than exploiting technical vulnerabilities.

FromSoftware and Bandai Namco's Response: Too Little, Too Late?

In the early days of the crisis, FromSoftware and Bandai Namco maintained radio silence. No official statement was issued, and the only responses victims received from support were instructions to delete their save files. This silence fueled community outrage, as it became increasingly clear that innocent players were being punished for a security failure that wasn't their fault.

Finally, in late April 2022, FromSoftware released an emergency patch. This update accomplished two critical tasks: first, it automatically removed Deathbed Smalls from all player inventories across the board. Second, it lifted bans that had been issued specifically for possession of this item, restoring access to victims' accounts.

However, the response came too late for some players. Those who had already deleted their save files following support's advice had permanently lost hundreds of hours of progress. Others who had chosen to wait out the 180-day ban had already missed weeks of multiplayer gameplay - one of Elden Ring's most celebrated features.

The incident also exposed a broader issue with Bandai Namco's customer support infrastructure. Many victims reported waiting days or even weeks for responses to their support tickets, only to receive generic automated replies that didn't address their specific situation. The lack of a robust appeal process for false positive bans revealed a systemic weakness in how the publisher handles security incidents.

Technical Analysis: Why EAC Couldn't Solve the Problem

The fundamental question remains: why couldn't a sophisticated anti-cheat system like Easy Anti-Cheat distinguish between perpetrator and victim? The answer lies in the architectural design of most anti-cheat systems.

EAC performs periodic scans of player save files and compares them against a database of legitimate items and statistics. When it discovers something that shouldn't exist - cut content items, duplicated gear, or impossible stat values - it flags the player account. This detection system is highly effective at catching obvious cheaters who modify their own files.

But EAC lacks origin tracking. When a player picks up an item from the ground, this action is processed through the game's multiplayer servers and written to the save file. To EAC, there's no difference between an item added via Cheat Engine and an item received through legitimate game mechanics like picking it up off the ground. The system only sees the end result: an illegal item exists in the inventory.

Could This Happen Again? The State of Gaming Security in 2026

Four years after the Deathbed Smalls incident, the situation has improved but not been completely resolved. Newer titles like Elden Ring: Shadow of the Erdtree (the game's major DLC expansion) implement more sophisticated security systems that can track item origins and, rather than issuing immediate bans, simply delete suspicious items.

Modern implementations include server-side validation for item drops. When a player attempts to drop an item, the server now checks whether that item could legitimately exist in their inventory based on their playthrough history. If the item is flagged as impossible or suspicious, the drop action is blocked before it can affect other players.

Additionally, improved logging systems now record who dropped an item and who picked it up, with timestamps and contextual data. This information enables security teams to investigate incidents and identify actual perpetrators rather than automatically punishing all parties involved.

However, legacy titles remain vulnerable. Dark Souls 3, Dark Souls Remastered, and even the base version of Elden Ring (without DLC updates) could theoretically still be exploited through similar methods, though the prevalence has dramatically decreased as awareness has spread and hackers have moved on to other targets.

The fundamental challenge persists: balancing security with user experience. Overly strict systems may ban innocent players, while lenient systems allow cheaters to operate freely. Finding the equilibrium point remains one of the gaming industry's greatest ongoing challenges.

Impact on Player Community and Souls Culture

The Deathbed Smalls incident had profound effects on the Elden Ring player community and the broader Souls gaming culture. One of the most cherished traditions in FromSoftware games involves veteran players dropping powerful items, extra runes (currency), or rare equipment for newcomers to help them through difficult sections.

After the incident, many players became paranoid about picking up any items dropped by strangers. Trust was shattered, and a culture built over more than a decade suffered damage. Subreddit posts and forum threads warned players: "Never pick up items dropped by invaders!" This defensive posture represented a fundamental shift in how the community approached multiplayer interactions.

The incident also sparked philosophical debates about trust in digital spaces. In online gaming, players must make split-second decisions about whether to trust unknown individuals. Deathbed Smalls demonstrated how trust can be weaponized, creating lasting changes in player behavior that persist years after the original incident.

Some community members advocated for a "whitelist" approach - only accepting items from players on your friends list. Others suggested that FromSoftware should disable item drops entirely in invasions, allowing them only during cooperative summons. Each proposed solution carried tradeoffs between security and the open, emergent gameplay that makes Souls games special.

Comparative Analysis: Similar Attacks in Gaming History

Elden Ring wasn't the first game to experience weaponized defense systems, and it won't be the last. Gaming history contains several notable cases where hackers exploited anti-cheat systems to harm innocent players:

A common pattern emerges across all these incidents: anti-cheat systems struggle to distinguish between perpetrators and victims when items or data are transferred between players. This represents a fundamental flaw in how many detection systems are architected - they assume that possession equals guilt, without considering how the prohibited content arrived in a player's account.

Industry Response and Evolution

The Deathbed Smalls incident served as a wake-up call for the entire gaming industry. Developers realized their security systems could be turned into weapons. At subsequent Game Developers Conference (GDC) panels on security and anti-cheat, this incident was frequently cited as a cautionary tale.

Several solutions emerged from industry discussions. One approach involves implementing "suspicion systems" rather than immediate bans. When a player is found with suspicious items, instead of instant punishment, the system monitors their behavior. If they show no other signs of cheating - such as using the item, attempting to drop it for others, or possessing multiple illegal items - they're likely a victim rather than a perpetrator.

Another proposed solution involves temporary quarantine with human review. Rather than imposing a 180-day automatic ban, players could be temporarily restricted for 24-48 hours while a human support team investigates the case. If evidence shows the player was victimized, they're immediately reinstated. This approach balances security with fairness, though it requires significant support staff investment.

Some developers have explored blockchain-based item tracking, where every item in a game has a complete, immutable history of ownership and transfers. This technology could definitively prove how an item entered a player's possession, providing the attribution data current systems lack. However, blockchain implementation carries its own controversies and technical challenges.

Future of Online Gaming Security

The Deathbed Smalls incident marked a turning point in how the gaming industry thinks about security. Several emerging trends promise to address the vulnerabilities it exposed:

Machine Learning Behavior Analysis: Instead of only scanning save files, modern systems analyze player behavior patterns. If a player exhibits normal gameplay patterns but possesses one suspicious item, ML algorithms can assess the likelihood they're a victim versus a perpetrator based on contextual factors.

Blockchain Item Provenance: Some newer games experiment with blockchain technology to maintain complete item histories. Each item carries a cryptographic record of its creation, all transfers, and modifications. While controversial, this approach provides definitive attribution data.

Automated Appeal Systems: AI-powered systems can rapidly review ban appeals by analyzing gameplay footage, chat logs, and transaction histories. Instead of waiting weeks for human support responses, players might receive decisions within hours.

Community-Based Reputation: Systems that incorporate community reporting alongside automated detection. If multiple players report someone for suspicious behavior, this data supplements technical scans to make more informed decisions.

Graduated Response Systems: Rather than immediate harsh penalties, implementing tiered responses. First offense might trigger a warning and item removal. Repeated violations lead to temporary restrictions. Only persistent, confirmed cheating results in permanent bans.

Security Recommendations for Players

If you're an active Elden Ring player or fan of FromSoftware titles, several practical security measures can protect you from similar attacks:

1. Never pick up items dropped by hostile invaders: If someone invades your world, drops an item, and immediately disconnects, this is a massive red flag. Leave the item on the ground.

2. Maintain regular save file backups: On Windows, Elden Ring save files are located at C:\Users\[YourName]\AppData\Roaming\EldenRing. Create weekly backups of this folder to external storage. If you're banned unfairly, you can potentially restore a clean save after the issue is resolved.

3. Use password-protected multiplayer sessions: Elden Ring allows password-protected co-op, ensuring you only play with known friends. This dramatically reduces invasion risk from unknown malicious players.

4. Recognize hacking signs: If you encounter players who are invincible, have impossible stats, or exhibit clearly abnormal behavior, immediately quit the game (Alt+F4) without picking up any items they may have dropped.

5. Keep your game updated: Always install the latest patches. FromSoftware continuously addresses security vulnerabilities, and staying current is your best defense.

6. Consider offline play for first playthroughs: While you'll miss multiplayer features, offline play completely eliminates invasion-based attacks. Save online play for subsequent runs when you're more familiar with the game's systems and security risks.

The Psychology of Digital Trust and Betrayal

Beyond the technical aspects, the Deathbed Smalls incident reveals fascinating insights into how trust operates in digital communities. The Souls series has cultivated a unique culture where strangers help strangers - veteran players leaving powerful weapons for beginners, co-op partners guiding newcomers through difficult areas, and even invaders who bow before combat as a sign of respect.

This culture didn't develop by accident. FromSoftware deliberately designed mechanics that encourage cooperation and emergent social behaviors. The item-drop system, the summoning mechanics, and even the invasion system were all intended to create unpredictable human interactions that make each playthrough unique.

When Pantsu Dealer and other malicious actors exploited this trust, they didn't just attack individual players - they attacked the social fabric of the entire community. The betrayal felt personal to many players because it perverted something beautiful and communal into a weapon. It's analogous to someone poisoning food at a community potluck - the damage extends beyond the immediate victims to everyone who now questions whether they can trust others.

Psychologists studying online communities note that trust, once broken, is exponentially harder to rebuild than it was to establish initially. Even years later, some Elden Ring players remain cautious about accepting items from strangers, demonstrating the long-term behavioral changes that result from security incidents.

Legal and Ethical Dimensions

The Deathbed Smalls incident also raises interesting legal and ethical questions. In most jurisdictions, modifying a video game for personal use isn't illegal. However, using those modifications to harm other players arguably crosses into harassment or computer fraud territory, depending on local laws.

Could Pantsu Dealer or other perpetrators face legal consequences? In theory, yes. The Computer Fraud and Abuse Act in the United States and similar laws in other countries criminalize unauthorized access to computer systems and intentional damage. Causing innocent players to lose hundreds of hours of progress could potentially constitute damage, and exploiting anti-cheat systems might qualify as unauthorized system access.

However, practical enforcement is nearly impossible. Most of these hackers operate anonymously, using VPNs and disposable accounts. Even if identified, the resources required to prosecute someone for causing in-game harm would likely exceed what most publishers are willing to invest. This creates a practical immunity for bad actors, who can operate with little fear of real-world consequences.

The ethical dimension is clearer: deliberately causing innocent players to be banned is malicious behavior that violates gaming community norms and general principles of digital citizenship. But translating ethical wrongs into legal accountability remains a significant challenge in the digital age.

Corporate Responsibility and Player Rights

The Deathbed Smalls incident also sparked discussions about corporate responsibility. When a company's security system harms innocent customers, what obligations does that company have?

Some players argued that FromSoftware and Bandai Namco should have offered compensation to victims - perhaps in the form of in-game items, currency, or even monetary reimbursement for those who lost significant progress. Others contended that since the companies eventually fixed the issue and lifted bans, they'd fulfilled their obligations.

The incident highlighted the need for clearer "player bills of rights" in online gaming. What recourse do players have when automated systems make mistakes? How quickly should companies respond to reports of security exploits? What standards should govern appeal processes for wrongful bans?

These questions lack clear answers, and gaming companies generally maintain broad terms of service that give them significant discretion in how they handle security incidents. The power imbalance between players and publishers means individuals often have limited options when they believe they've been treated unfairly.

Media Coverage and Public Perception

The Deathbed Smalls story gained significant media attention, with coverage from major gaming outlets like IGN, Polygon, Kotaku, and PC Gamer. This mainstream attention served several purposes: it warned other players about the threat, pressured FromSoftware to respond more quickly, and educated the broader public about vulnerabilities in anti-cheat systems.

Interestingly, the incident also became a meme within gaming culture. The absurdity of being banned for picking up underwear struck many as darkly comedic, and Deathbed Smalls became a symbol of gaming's stranger moments. Years later, it's referenced in discussions about game security, cited as an example in computer science courses, and occasionally appears in "gaming's weirdest moments" lists.

This cultural staying power ensures the incident continues serving an educational purpose. New players entering the Souls community often hear the Deathbed Smalls story as a cautionary tale, keeping awareness high and potentially preventing future victims.