Most of the hijiacks happen via a phishing site very similar looking to a legitimate site. Once you go to the website, you meet a steam login page that steals your credentials.
That's where the hijacked part comes into play. When you logged into a phishing website, you gave them the necessary 2fa code to login to your account. Instantly on their end a bot is signed in.
When you confirmed the trade on your phone, that you thought was a RustyPot deposit trade. You actually were confirming the very similar looking trade created by the scammer.
We have created 3 easy please follow ALL 3 ( IN ORDER ) to secure your steam account.
Go to store.steampowered.com/account/ and click on "Change my password"
Go to steamcommunity.com/dev/apikey and click on "Revoke My Steam Web API Key
Go to store.steampowered.com/twofactor/manage and click on "Deauthorize all other devices"
Watch this youtube video it explains how your account was hijacked very well.
Message one of our admins on Discord and they'll be happy to help you.