If you did not authorise these wallet purchases then secure your account with the following steps:-

1. Scan for malware https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices https://steamhost.cn/twofactor/manage
4. Change passwords from a trusted/clean device.
5. Generate new backup codes for your Mobile App https://steamhost.cn/twofactor/manage
6. Revoke the API key https://steamhost.cn/steamcommunity_com/dev/apikey (there should be nothing in the APIKEY)

Also ensure your bank details are secure and then contact Support. Do not spend anything because the money can usually be refunded, so chat to Support about what has happened and explain everything in a ticket.

In other words -- your account was hijacked, the hijacker found a stored payment method that doesn't require any 2FA, and used it to get money into your wallet.

Next thing is they'll have you use that money to buy garbage from them on the market.

wow... the first person that has Been phished that DOESN'T play CS2... though he might be playing other MTX based games...