The Vanguard hardware ban: how a used-CPU buyer paid for someone else's cheating

The machine still booted. The cooler still spun, the monitor still lit up, the browser still opened. Only one thing refused to run: VALORANT. A German player bought a Ryzen 7 5800X3D on Kleinanzeigen, Germany's largest secondhand marketplace, slotted it into his rig, reached the login screen, and was kicked out. On August 12, that chip's hardware identifier sat on Vanguard's blacklist. Not his account. The CPU.

I read this story from a Reddit post, relayed by Kotaku, on an evening in Chengdu when my neighborhood lost power for nearly two hours. When Chengdu went dark, I found an angle they forgot to flip. The whole block sat in the black, and I read all three hundred comments and realized the argument was not about one unlucky player. It was about a hole in how this industry defines crime and punishment.

The mistake never lives in the final shot; it lives in the second I saw the system crack. This case cracked somewhere else, earlier, and in a part of the machine almost nobody in esports wants to look at directly: hardware.

Vanguard is Riot Games' anti-cheat software, running at the kernel level of the operating system, level with the deepest layer a program is allowed to touch. It stays resident on the machine, launches with Windows, and can observe nearly all system activity to detect tampering. Because it runs that deep, it can read hardware identifiers, HWID for short, including CPU, drive, and motherboard serial numbers.

HWID bans were created to plug a hole everyone knows: a cheater whose account is locked simply makes a new account, registers a new email, and returns to the arena within ten minutes. An account ban locks the door while he still owns the house. A hardware ban locks the house. As anti-cheat logic, that is a reasonable step forward.

The problem starts when the house changes owners. That Ryzen 7 5800X3D did not stay put. It was resold, and when it changed hands, the curse travelled with it. The buyer did not know, and had no tool to check before paying. Riot has not confirmed this case. The whole story rests on a single source: the player's own account, spread through Reddit, picked up by Kotaku. PCWorld itself, when covering the phenomenon, describes such cases as rare.

Put that fact on the table before going further. One rare, unverified case is not enough to build a panorama. But the mechanism is real, and the mechanism is the part worth talking about.

The break sits in the concept of attached liability. In criminal law, a clear line separates the offender from the person who unknowingly inherits the consequences. Here, Vanguard draws no such line. A hardware identifier is morally neutral matter, yet the system treats it as a guilty individual. When the chip changes hands, the sentence follows the chip. The new buyer, who never played a single match on that chip, carries the punishment for the conduct of someone he has never met.

The flaw is not in banning hardware; it is that the system has no mechanism to transfer responsibility when the asset changes owners.

Technically, this is explainable. If Vanguard opened a loophole for every buyer of a used machine, cheaters would exploit it instantly, buying back their own rigs through an intermediary account and escaping the ban. Any amnesty mechanism must itself resist fraud, and this is a genuinely hard problem.

But technical difficulty does not erase a lack of governance transparency. Three points deserve a straight look.

The appeal process is not clearly published. A player who wants to contest must fumble through support channels, file tickets, wait, with no document stating in advance under what conditions an HWID ban can be lifted. The process exists on paper, but not as a route a user can trust and follow.

Riot occupies three roles at once: rule-maker, enforcer, and commercial stakeholder. In football, a disciplinary decision can go to a sports arbitration court. In esports, no independent arbitration body stands between players and the publisher. The publisher blows the whistle, signs the sentence, and collects revenue from the very arena that sentence protects. This structure is legal under terms of service, but it concentrates all interpretive power on one side.

And the least-discussed part: the secondhand market is the lifeblood of grassroots esports. Not everyone can afford a new rig. A student in Hanoi, a young player in the provinces, a semi-pro saving every coin, they buy used parts. That market feeds the base of the ecosystem, the layer from which stars rise.

When a used chip can carry an invisible sentence, its value falls, and worse, it becomes goods the buyer cannot assess beforehand. Economics calls this information asymmetry: the seller knows the item is flawed, the buyer does not, and prices collapse for good and bad parts alike. No lookup tool lets a buyer scan a component for placement on any anti-cheat blacklist. Kleinanzeigen has no disclosure duty. AMD, the manufacturer, has none either. The risk falls entirely on the person holding the money.

This mechanism does not stop at VALORANT. Any title running kernel-level anti-cheat with HWID can run into the same problem. This is a pattern, not an outlier.

Now the part where I may be wrong. And in this case, I may be wrong a lot.

What I am analyzing is a mechanism, but what is spreading is an emotional story. One case, self-reported by the person involved, unconfirmed by Riot. It is genuinely possible the player misread the sequence, or that the chip was not the direct cause, or that another component in the rig was flagged and he left it out.

I have been laughed at for going against the wind, and that laughter did not last the season. But there were also times I went against the wind and was flatly wrong. Experience taught me one thing: when the data has a single point, do not draw a line. The biggest risk right now is turning a rare case into a system-wide panic. If the community starts seeing every used CPU as a landmine, the damage lands on the poor. Panic protects no one; it only pushes prices up and trust down.

The balance point is this: the mechanism is real, but the scale is unclear. And the way to tell a one-off fault from a design fault is to count independent cases. One case is an accident. Three cases are a pattern. Ten cases are a system failure.

If two or three more independent cases surface in the coming months, the story changes nature: from rare accident to design flaw, and pressure on Riot becomes a public argument about publisher power. If Riot speaks, publishing an appeal process and an ownership-verification mechanism, the episode can close as a correction, and become a standard for the industry. If it stays silent, that void gets filled with assumptions, and assumptions always favor the party that does not speak.

What I leave behind is not for that German player. It is for every platform selling used parts, every publisher running kernel-level anti-cheat, and every player saving up for the next chip: when hardware can carry a sentence, who is responsible for clearing that sentence when it changes hands?