Riot Locks Nearly 300,000 League of Legends and VALORANT Accounts: What Matters Is Not the Number

An old friend of mine, a former semi-professional player now working as a private coach in Ho Chi Minh City, messaged me at 11 p.m., furious: "My alt account just got locked. I haven't used any cheating software." I asked him exactly one question: "Were you queuing with anyone?" Ten seconds of silence. Then: "Yeah, someone asked me to carry their rank."

That was the moment I understood that the news of nearly 300,000 League of Legends and VALORANT accounts being locked is not simply a story about "Riot busting cheaters." It is a redefinition of the concept of guilt in an online competitive environment, where the line between the rule-breaker and the person innocently standing next to them starts to blur. And in this crackdown, what Riot is truly targeting is not cheating software. It is player identity.

Context: a milestone at the system level

To understand the story, one date matters. In September 2026, Riot Games integrated Vanguard, the kernel-level anti-cheat formerly deployed only for VALORANT, into League of Legends. This was not a champion-balance patch, and it has nothing to do with champion power or lane meta. It is a system-level change: the way the League of Legends client behaves on users' machines changes in substance.

A short glossary note for readers unfamiliar with the term. Vanguard is anti-cheat software running at the operating-system kernel level. It is highly effective against cheating tools, but it reaches deep into the user's machine, and that is the origin of much of the privacy debate in the community. Extending it to Riot's largest title is a structural decision, not a simple technical note.

Alongside the Vanguard integration, Riot defined two key concepts. The first is boosting: a high-skill player logs into another person's account to climb ranks for them. The second is smurfing: playing on a secondary account, typically at a rank lower than one's true skill level.

And here is the most notable point in the entire rules framework. Riot does not treat smurfing as automatically cheating. It enumerates eight legitimate uses of a secondary account, including "protecting their highest achievement on their main account." In other words, the boundary Riot draws rests on behavior and intent, not on account count. A soft line. And like every soft line, it is very hard to enforce consistently.

From September 2026 to the time of publication, nearly 300,000 accounts across both titles have been locked. Against estimates of roughly 120 million League of Legends players and roughly 20 million VALORANT players monthly, that is about 0.2 percent. Read carefully, that 0.2 percent is the single most important detail, because it shrinks the scale the headline is trying to inflate.

What is actually happening at the technical level

Three mechanisms are activated at once, and I will pull them apart one by one.

The first mechanism: Vanguard expanding from hunting cheating software into controlling ranked behavior. Previously, the goal was to detect who was running a tool. Now the goal includes detecting who is manipulating the ranked system, through boosting, arranging games, or moving ranks. In the language I habitually use: this crackdown is a patch at the system layer, not the balance layer. It touches no champion stat, but it changes the rules of the entire ladder.

The second mechanism: the "hitchhiker" doctrine. This is the hardest term to translate and the most contested point. A hitchhiker is a player using their own account who queues together with an account being boosted. They violate no software rule. But the League Points (LP) earned in those games may be revoked. In other words, Riot is establishing liability by association: you play clean, but you stand next to someone who does not, and you can lose points.

The third mechanism, and the part the press has underplayed, is the future identity-verification roadmap. Riot plans to add multi-factor authentication (MFA), the TPM 2.0 hardware standard, device-level attestation, and rank-tiered requirements: the higher the rank, the stricter the verification. The end goal is to make creating a "one-time" account harder and more expensive.

TPM 2.0 deserves a clear explanation, because it is the technical core of the story. It is a hardware security standard that enables identity attestation at the device level. When applied, an account becomes bound to physical hardware. In the phrasing I favor: this is a mechanism for binding identity to hardware, and it changes the entire economics of creating a new account. Creating a new account used to be nearly free. If TPM 2.0 rolls out as planned, that cost is no longer free.

MFA is more familiar to ordinary users: multi-factor authentication, combining several methods to confirm identity at login. The rank-tiered requirement is a governance decision with landmark status. It mirrors how traditional sports apply heavier rules to elite athletes, for example whereabouts rules in anti-doping that fall hardest on the elite tier. It is a rational design, but it creates what I call a "two-tier citizenship" model within the player base.

In behavioral-economics terms, boosting exists because there is demand and supply. Demand comes from players wanting a high rank for prestige, seasonal rewards, and community standing. Supply comes from high-skill players who need income, often semi-pro or tier-2 and tier-3 players, the lowest-paid layer of the esports labor pyramid. When Riot raises the risk of punishment, it does not erase demand. Nor does it erase supply. It only raises the risk premium.

The familiar economic outcome of a gray market follows: prices rise, and the market does not disappear. Remaining operators collect more per transaction. Anyone who has tracked the boosting market, account trading, or similar services in Vietnam will recognize this. Prohibition pushes prices up rather than eliminating demand.

One point the original report omits: enforcement intensity may not be uniform across server regions. League of Legends and VALORANT in mainland China are operated within Tencent's ecosystem, which uses separate anti-cheat and account-verification infrastructure, distinct from the global Vanguard rollout. Does the 300,000 figure include or exclude the China servers? This is an open question, and it directly affects the denominator in the 0.2 percent calculation. If the enforcement figure covers only the non-China portion, the 0.2 percent ratio is miscalculated in a way that makes the problem look smaller than it is.

Ganking from the left flank: what matters is not the cheating

This is where I want to gank from the left flank, against the wave of opinion celebrating "Riot cracking down hard." The real story is not the 300,000 accounts. It is how Riot is redefining who counts as guilty.

The first issue is source transparency. Every quantitative claim in the story, from 300,000 accounts to 120 million League players to 20 million VALORANT players, comes from Riot. Riot is simultaneously the rule-maker, the enforcer, the source of enforcement statistics, and the commercial beneficiary of enforcement. No independent auditor is involved. In traditional sports, anti-doping bodies are required to publish false-positive rates, appeal processes, and evidentiary standards. Here there is no false-positive rate, no described appeal process, and no independent verification. That is a large transparency gap, disproportionate to the scale of the action.

The second issue is the hitchhiker doctrine, the most serious rule change and the most lightly treated. When Riot asserts the authority to revoke ranked points from players who used their own accounts and broke no software rule, it is expanding liability by association. The question lies in defining what counts as hitchhiking. Does a player who randomly queues with an account being boosted count as a hitchhiker? If the answer is yes, false positives are unavoidable. If the answer is no, a clear evidentiary standard is needed, and none has been published.

My friend's case is living proof. He played on his own account, joined the same party as someone who asked for a carry, and now loses points. He used no cheating software. He did not log into anyone else's account. But under Riot's new logic, he is still inside the risk zone.

The third issue is that the device-level verification roadmap creates a two-tier model. Low ranks face light requirements; high ranks face heavy ones. In governance terms this is rational, since higher ranks carry stronger incentives to game the system. In equal-treatment terms it raises questions: who sets the rank threshold? Can it change over time? And how will players at the borderline be treated?

The fourth issue, which no one in the original report mentions: players using shared computers, at internet cafes or game shops, are structurally disadvantaged by device attestation. In some markets, including Southeast Asia, a significant share of League of Legends players access the game through shared machines. Binding an account to hardware means those players face a barrier not of their own making. That is an equity problem the report does not touch.

On risk, my ranking is as follows. The highest risk is liability by association for hitchhikers: clean players can lose points with no clear appeal path. A medium-high risk is the lack of independent verification for the 300,000 figure and the 140 million denominator. A medium risk is device attestation and rank-tiered enforcement, with attendant privacy and equal-treatment concerns.

The systemic risk to watch is gray-market adaptation. Enforcement raises the cost of boosting but does not address demand (rank prestige, rewards, ego) or supply (income needs of lower-tier players). So the market should be expected to reprice rather than vanish. Operators pushed out of a hardened League of Legends and VALORANT environment may migrate to titles with softer enforcement. The industry-level problem is displaced, not solved.

Industry transmission: anti-cheat as cross-title infrastructure

At the transmission layer, what Riot is doing is turning anti-cheat into cross-title infrastructure. Vanguard is no longer a VALORANT-only tool; it is a platform-level governance layer. As the remit expands from software hunting to ranked-system behavior control, other publishers face a new benchmark to match.

At the academy and scouting layer, the consequences are very real. The ranked ladder is the de facto selection system for the entire amateur-to-pro pipeline. Boosting corrodes scouting signals. If ladder integrity improves, academies and tier-2 teams get more trustworthy signals. Conversely, if enforcement is uneven across servers, scouting quality diverges by server. This is the most under-appreciated transmission channel in the entire story.

At the content and streaming layer, the consequences are fairly positive. Carry-boosting content and smurf content, long a money-making segment for many channels, now face friction. Genuine high-elo content gains credibility. For sponsors, ladder integrity is a brand-safety indicator, though the scale of impact here is small and long term.

At the betting and gray-zone layer, the impact is two-directional and ambiguous. Cleaner ranked data improves the reliability of any market signal derived from the ladder. But boosting operators pushed out of a hardened environment may spill into less-regulated titles, meaning the problem is displaced rather than eliminated.

What I want to emphasize is the degree of publisher power concentration. Riot now controls patch control, tournament control, client-level system access, and hardware-level identity attestation. This is the most complete vertical stack in esports governance, and it narrows the already thin space for independent oversight. For someone who has tracked this industry for 15 years, this is a more notable structural change than the account count.

What to watch, and a memory to freeze

If you have read this far and still wonder how it affects you, the answer depends on your tier. Ordinary players will see little difference immediately. But semi-pro players, multi-title content creators, and those dreaming of an academy slot face a change far bigger than the ban count.

What matters is not the number but three upcoming milestones. Will Riot publish enforcement data periodically, with trends and per-title breakdowns? Will MFA and TPM 2.0 actually deploy beyond test scope? And will the light of the appeals process shine onto the hitchhiker boundary?

Another valuable signal lies in LP protection when a match involves a cheater or a leaver. This is a small but far-sighted player-experience win, easing the pain of losing a game for reasons beyond one's control. Low cost, direct impact on player sentiment, and likely to improve goodwill more than the ban announcement itself.

Eight years ago, I wrote that every play by Levi at MSI 2026 was an attacking poem, and I believed tactics needed a language of their own. This year, I believe one more thing. When player identity becomes a variable that can be bound to hardware, keeping it clean also needs a language of its own, and that language must have the word "transparency" in the middle of the sentence.

Football has no patch, but it has moments that rebalance an entire era. Esports has patches, and sometimes the most important one touches no champion stat. It touches a fundamental question: who is really sitting behind the keyboard, and when does becoming someone else in a game count as a crime.