Riot locks nearly 300,000 League of Legends and VALORANT accounts: When Vanguard crosses the ranked threshold

Riot locks nearly 300,000 League of Legends and VALORANT accounts: When Vanguard crosses the ranked threshold

In March 2026, I sat in a Brooklyn coffee shop reading a Discord thread a source had forwarded me. It was a price list from a rank-boosting service, extremely detailed. Silver to Gold: 120 USD. Gold to Platinum: 180 USD. Platinum to Diamond: 450 USD. Diamond to Master: 1,200 USD. Two-week warranty if the account gets banned. Full refund if the warranty claim is not honored.

I asked the source one question: "What do they say about Vanguard?" Three minutes of silence. Then a single line appeared: "Vanguard isn't in League yet. We'll deal with it when it arrives."

That was March. By September of the same year, Vanguard — the kernel-level anti-cheat that had lived only inside VALORANT — was integrated directly into the League of Legends client. And today, the figure of "nearly 300,000 accounts locked" across both titles has appeared. I look at that number and ask one simple thing: is this a purge, or a self-authored confession by Riot?

People sell boosting services with price lists. Riot answers with a number. Both are lying in their own way — one inflating the value it sells, one inflating the scale it is enforcing.

Context: a system-level change, not a patch

Riot Games deployed Vanguard inside League of Legends starting in September 2026, after years of running it in VALORANT. This is not a champion balance patch, not a shift in champion power or minion stats. It is a system-level change. Vanguard operates at the kernel level — the highest privilege tier of the operating system — meaning it has deeper access to your machine than any normal game process. In engineering circles, this is a double-edged sword: maximum anti-cheat effectiveness, but the deepest possible system intrusion.

I followed Vanguard's rollout into VALORANT in 2026. Back then the community split in two: half welcomed it as the answer to aimbots and wallhacks, half opposed it fiercely over privacy and performance concerns. Those arguments were never fully resolved. They simply quieted when VALORANT proved that its ranked cheating rate was meaningfully lower than comparable titles.

But League of Legends is not VALORANT. It is a fifteen-year-old title with a wider player base, lower-spec hardware, and a distinctive internet-café culture across Asia — where players do not own personal machines. When Vanguard entered the League client, it did not merely face cheaters; it faced the most diverse player ecosystem in esports.

The more important context is policy. Since Vanguard's arrival, Riot has expanded its remit from anti-cheat software — aimbots, wallhacks, scripts, macros — into behavioral control over the ranked system. Specifically: boosting services, smurf accounts, and the "hitchhiker" phenomenon.

This is the most notable point. The 300,000 accounts are not predominantly in the "used cheating software" category. Most fall under "ranked-system manipulation." The distinction is fundamental. Riot is no longer just catching technical cheaters; it is now processing social cheaters — people who write no code but sell services, buy services, or simply queue alongside buyers.

Over thirteen years covering this industry, I have seen many enforcement waves. The script bans in Korea in 2026. The account actions in China in 2026. The locking wave in North America in 2026. Every wave shared one trait: they targeted software. This one is different. It targets people — and more specifically, the social relationships behind those people.

On scale: estimates place League of Legends at roughly 120 million monthly active players and VALORANT at roughly 20 million — a combined 140 million. The 300,000 figure represents about 0.2%. But this is an estimate with no clear sourcing in the original material. I will return to this, because it is the single weakest point in the entire media narrative.

The "hitchhiker" clause: a new liability-by-association line

Among all the published rules, one stands out as the most consequential — and the least noticed. Riot calls it the "hitchhiker." Definition: a player using their own account, playing legitimately, violating no software rule, but queuing alongside an account being boosted. Penalty: loss of the LP earned in affected games.

This is the first clause in Riot's ranked history under which a player who broke no technical rule can still lose ranked points.

Technically, this is an expansion of "liability by association." In criminal law, this is gray territory: you did not commit the crime, but you were present at the scene, and you benefited indirectly. Riot is applying similar logic to a digital playground.

The problem lies in determining "knew or did not know." A player duos with a boosted account — did they know? Often the answer is yes: they paid, they knew what they were buying. But in not a few cases, it is an innocent player queuing with a friend they had no idea was being boosted. Riot has published no appeals mechanism, no false-positive rate, and no evidentiary standard for identifying a "hitchhiker."

That is the largest governance gap in the whole story. Three hundred thousand accounts actioned, and not one line about what happens if you were wrongly punished.

My tournament-coverage experience taught me one thing: every time a publisher introduces a new behavioral rule, the community's first reaction is "finally, someone is cleaning up." The second reaction — usually arriving three weeks later — is "I was wrongly banned." I have watched this happen with the LCK Summer 2026 account bans, with anti-doping actions in traditional sport, and with every centralized control system. There is no exception.

The smurfing paradox: Riot draws itself a blurry line

Interestingly, in the same announcement, Riot makes clear that smurfing — playing on a secondary account — is not automatically considered cheating. It enumerates eight legitimate use cases, including "protecting their highest achievement on their main account."

This is a deliberately soft line. Riot is not enforcing on account count but on intent and behavior. In governance terms, this is a sensible choice, since banning alt accounts would touch a large legitimate population, including pro players using practice accounts and streamers using anonymous accounts to avoid stream-sniping.

But in enforcement terms, it is a nightmare. How do you distinguish a Master-tier player creating a new account to practice champions from a Master-tier player creating a new account to sell? The answer lies in behavior: login frequency, match patterns, IP addresses, devices, and social graph. But behavioral analysis always carries error. When that error leads to an account lock, you need a clear appeals mechanism. Riot has not published one.

I once wrote about the limits of human beings in the LCK; now I write about the limits of human beings in the stands — and it turns out they look remarkably alike. Players are like pro athletes: they need to know the rules clearly before being punished, not after.

TPM 2.0 and the era of hardware-bound identity

The least noticed but heaviest element of the announcement is the forward-looking plan: multi-factor authentication, TPM 2.0, and hardware-bound identity verification.

TPM 2.0 — Trusted Platform Module 2.0 — is a hardware security standard enabling device-level identity attestation. That means your account is no longer tied only to an email and password, but to the actual chip inside your computer. Want to make a new account? You need new hardware.

This is one of the largest structural changes in esports history. If fully implemented, it turns the "one-time account" from a throwaway into an investment. A returning cheater no longer just needs a new email; they need a new machine. Economically, this is a fatal blow to the gray account market.

But there is a dark side the announcement does not mention.

In Vietnam, in China, across much of Southeast Asia where internet-café culture is strong, players routinely use shared machines. With hardware attestation, a café player may face access restriction because that machine is used by many people. Worse: a low-income player on an old machine without TPM 2.0 may be structurally excluded from the system. This is an accessibility and equity issue, and it is far more systemic than the 300,000 locked accounts.

In traditional sport, every control technology — from VAR in football to biometric verification at marathon majors — has a group that bears the cost. The question is not "is this technology effective," but "who pays for that effectiveness." Riot has not answered this question.

Two tiers of citizenship on the ranked ladder

The final detail, and perhaps the most subtle: verification requirements may be applied differently depending on rank. Silver, Gold — light requirements. Master, Challenger — heavy requirements.

This is a two-tier governance model. Logically it is sound: the higher the rank, the greater the benefits — prestige, pro opportunity, streaming income — so the greater the risk. It mirrors traditional sport, where whereabouts rules apply more strictly to elite athletes than to amateurs.

But it creates a problem: two tiers of citizenship. If you are Master, you are scrutinized more closely. If you are Silver, less so. This may be tolerable pragmatically, but it also means cheaters can shift toward lower tiers, where verification is looser.

More importantly: high elo is exactly where scouts and esports academies search for talent. If the top tier is scrutinized while the bottom is left open, the "scouting signal" from the bottom tier becomes distorted.

The blind spot of the number and the denominator question

Back to the 300,000 figure and the 0.2% ratio. There is a question no outlet has asked: does this figure include the Chinese servers?

League of Legends in China is operated by Tencent, with its own anti-cheat and account-verification infrastructure, not the global Vanguard. If Riot excludes China from the figure — highly likely, given it is an independently operated market — then the 140 million denominator is also wrong, since the bulk of League of Legends players sit in China. The result: the 0.2% ratio is miscalculated, and the weight of the 300,000 figure shifts.

This is the subtraction nobody performs. And when a number lacks an accurate denominator, it is no longer data; it becomes a slogan.

Impact on the scouting pipeline: when the signal distorts

The ranked system is not just a playground for amateurs. It is the de facto selection system for the entire amateur-to-pro pipeline. Scouts at LCK, LPL, and LEC academies monitor the ladder for talent. When boosting exists, the ladder signal is noisy.

This means the fight against boosting is not merely a player-experience issue. It is a talent-identification issue. A boosted Master account can land in a scout's crosshairs, wasting resources and corrupting the evaluation process.

I witnessed a similar case in 2026, when a European academy offered a trial to a player based on Challenger rank. After two weeks of scrims, they concluded his macro skill did not match his rank. There was no proof of cheating, but one possibility stood out: the account had been partially boosted. That is the sort of risk academies must now factor in.

If enforcement is effective, the ladder signal becomes more trustworthy. If not, academies will have to shift to scrim- and tier-2 tournament-based evaluation — an expensive but necessary change.

The streaming ecosystem and the audience problem

An under-discussed angle: stream content. In recent years, a large share of esports content on streaming platforms relies on "ladder climb from scratch" and "smurf showcase." This genre is compelling because audiences enjoy watching a high-skill player demolish lower-tier opponents.

If Riot tightens its rules on alt accounts and identity verification, that genre is affected. But at the same time, content from verified high-elo accounts gains value, because it serves as proof of genuine skill. In the long run, this could improve esports content quality in a positive direction — less theater, more real skill.

A gank at minute 20 can kill a game state, but it can also resurrect an entire brand. Here, Riot's gank targets the gray market, but it is also reshaping the whole content value chain around the ranked system.

The contrarian angle: the market will reprice, not disappear

When the announcement spreads, there will be a wave of celebration. "Finally, the ladder is clean." I want to test that romanticism with three points.

First: the boosting market will reprice, not disappear. Demand — rank as a status display, seasonal rewards, ego — is unchanged. Supply — high-skill players needing income, especially at the bottom of the esports labor pyramid — is also unchanged. When enforcement intensifies, you do not erase the market; you raise the price. This happened with virtual-gold markets in China, with account markets in Eastern Europe, and with every gray market I have tracked. Three hundred thousand banned accounts sounds large, but if the price of boosting doubles, fewer buyers remain — and the surviving sellers earn more. That is the paradox of supply-side enforcement.

Second: Riot is the rule-maker, the enforcer, the data publisher, and the commercial beneficiary of that same data. There is no independent arbitration layer. The 300,000 figure has had zero third-party verification. When a publisher announces "we locked X accounts," that is a self-congratulatory report, not an audit. In any other industry — pharma, aviation, finance — such a figure would require independent verification. In esports, it becomes a headline. And headlines, not numbers, shape public opinion.

Third: the 0.2% ratio the article computes itself undermines the headline's weight. If only 1 in 500 players is affected, then the cheating problem — real as it is — is not at "epidemic" scale. It is at "systemic issue requiring long-term management" scale. That difference matters, because it changes how we read the policy: from "Riot extinguished a crisis" to "Riot is building governance infrastructure."

I once put the Russia World Cup on the Summoner's operating table, and I learned one thing: when data comes from a single source, you are not reading the data — you are reading the source. Here, the source is Riot. And Riot is playing the ball while refereeing the match.

There is one detail nobody mentions: does the 300,000 figure include the Chinese servers? I raised this above, but it bears emphasis. If the figure excludes China — highly likely, given Tencent's independent operations — then both the numerator and denominator of the 0.2% calculation are wrong. The true ratio could be higher or lower, but one thing is certain: we are debating a number that we ourselves do not understand.

And here is the final point about romanticization: even if Vanguard works perfectly, it only solves the technical branch of the problem. It does not solve the economic branch — demand for rank as a social-status marker, and supply from high-skill players who need income in an esports ecosystem where the lower tier is underpaid. To solve it at the root, you would need to pay the lower tier more fairly, or create a status system that does not depend on a digital rank. No publisher does that, because it does not fit their business model.

What I am tracking next

What I want to track is not the 300,000 locked accounts. It is the next number.

If Riot publishes enforcement data periodically — quarterly, with trends, with regional breakdowns — then it is establishing an integrity-reporting standard for the industry, much as anti-doping reporting norms developed in traditional sport. If it publishes once and goes silent, it was a communications campaign, not a policy.

And the real question is not whether Vanguard cleans the ladder. The question is: when player identity is bound to hardware, who gets to play, and who gets pushed to the margins? The limits of human beings in the stands, it turns out, mirror the limits of human beings on the pitch — except this time, the ticket into the stadium is made of silicon.

The three hundred thousand figure will fade within weeks. But the chip inside your computer is here to stay.