Riot locks nearly 300,000 ranked accounts: Behind the number is an unprecedented governance shift

In September 2026, Riot Games deployed Vanguard – an anti-cheat system operating at the kernel level of the operating system – into the League of Legends client. Less than three months later, the publisher announced that nearly 300,000 accounts had been locked for ranked cheating across both League of Legends and VALORANT.

Mainstream media received this news as a victory for justice. I see it differently.

What made me pause is not the 300,000 figure. It is a sentence buried in the middle of the announcement: “hitchhikers” – players who ride along – could have their ranked points revoked even though they played on their own accounts, even though they installed no cheating software whatsoever. Riot has just asserted the right to punish a player for their relationship with another player. In the history of esports governance, this authority is unprecedented.

“No scandal ever starts with the janitor. It starts with the boss’s signature.”

So I am not writing this article to praise the anti-cheat campaign. I am writing to answer three questions. Why did Riot choose this moment? Why does the 300,000 figure say less than it appears? And who will pay the price when hardware becomes a player’s identity?

Context: When Vanguard enters LoL

Vanguard is not an ordinary anti-cheat program. It runs at the kernel level – the deepest layer of the operating system, with nearly absolute access to every process on a computer. Riot first deployed it for VALORANT in 2026, generating significant privacy controversy due to the depth of its intrusion into player devices. In September 2026, Riot expanded Vanguard to League of Legends – a game with an estimated 120 million monthly players, plus about 20 million VALORANT players.

The enforcement context needs clarification. Boosting is a paid service: a high-skilled player logs into another person’s account to raise that account’s rank. This black market operates openly on social media platforms, forums, and dedicated websites. The scope of the enforcement extends beyond boosters. Riot also targets two other groups: boost clients – account owners whose ranks were raised – and hitchhikers – players who use their own accounts but queue alongside accounts being boosted.

The ranked system in League of Legends and VALORANT is more than a place for players to have fun. It is the bottom tier of the esports ecosystem – where scouts find talent, where academy teams screen candidates, where semi-professional players build their reputations. A corrupted ladder means the entire scouting system receives bad data. This explains why Riot treats the issue seriously enough to mobilize Vanguard – the heaviest tool they have.

But there is a crucial detail that most news coverage missed: the nearly 300,000 accounts figure was published without a specific time window. If counted from September 2026 – when Vanguard was integrated into League – the figure accumulated in less than one quarter. At that pace, the annual enforcement rate would substantially exceed the initial number. The 300,000 should be read as a snapshot, not a full picture.

The number needs careful reading

“The truth lives in the smallest lines that few people bother to enlarge.”

I have followed sports integrity investigations long enough to know one principle: every figure from the enforcing party requires cross-verification from at least three independent sources. In 2026, at an Asian regional sports event, I gained access to the doping control room of a regional federation. I discovered seven procedural errors in sample storage – not by trusting official reports, but by cross-referencing operational logs against chain-of-custody forms. When I published my series on those gaps, the first reaction was denial, not reform. Only when the federation was forced to confront the evidence did they change their procedures.

This story taught me a lesson: when the enforcing agency is the sole source of data about its own enforcement effectiveness, readers have a right to be skeptical.

In this case, Riot self-published the nearly 300,000 figure. No independent audit. No false-positive rate disclosed. No appeals process described. No comparison data from the pre-Vanguard period. No breakdown between League of Legends and VALORANT. Even the estimated 120 million monthly League players is presented without a concrete source.

I am not saying the figure is wrong. I am saying it is a directional claim, not an audited conclusion. When Riot writes the rules, polices the rules, adjudicates the rules, and simultaneously reports its own performance to the public, the conflict of interest is self-evident. An investigative journalist never accepts a police press release as the final destination. He asks: who holds the books? Who audits the auditor?

The hitchhiker doctrine

The detail that made me re-read the announcement multiple times is the hitchhiker doctrine. Riot asserts the right to revoke LP – League Points – from hitchhiker players even though they used their own accounts and no cheating was detected from their side. The rationale: these players benefited from climbing alongside a boosted account and therefore bear joint responsibility.

“I read financial reports slower than most people, because I read them twice.”

Place this principle in the context of traditional sport. In a relay race, if one member uses doping, the whole team can lose medals. But that decision is based on test evidence, has an appeals process, independent arbitration, and a sports court. In esports, Riot has just created a new principle without describing any accompanying procedural mechanism.

What happens if a player innocently queues with a friend who secretly hired a booster? What happens when a semi-professional player accepts a friend request from an account showing suspicious patterns? In the millions of matches played daily, even a 0.1% false-positive rate could create thousands of wrongful sanctions each month. The original article never mentions error rates or appeal procedures. This is a serious transparency gap, disproportionate to the scale of the action.

TPM 2.0 and the identity story

The most important element being underestimated across this entire story lies in the future plans. Riot announced intentions to implement multi-factor authentication (MFA), the TPM 2.0 hardware security standard, and verification requirements that may differ based on a player’s ranked tier.

TPM 2.0 – Trusted Platform Module 2.0 – is a hardware security standard enabling device-level identity attestation. If Riot deploys it, player accounts would be bound to specific hardware. The stated purpose is clear: make creating new accounts more expensive and block repeat offenders.

The consequences extend far beyond cheating. What challenges will an internet-café gamer face – a significant segment of the League of Legends community in many regions – when logging in on a public computer? What about players whose machines do not support TPM 2.0? If an account is stolen, does hardware binding become an obstacle to account recovery? And in certain jurisdictions, could hardware identity verification intersect with personal data regulations?

I have observed how game publishers build authentication systems for more than two decades. One thing is certain: every new security layer creates new barriers for legitimate users. The question is how Riot will balance security against accessibility. Rank-differentiated verification also raises equal-treatment concerns: higher-ranked players face stricter controls, lower-ranked players looser ones. From a governance perspective, this can be justified because higher ranks carry greater influence. But it creates a two-tier citizenship model within one community – precisely the kind of discretionary rulemaking that this story fails to analyze deeply enough.

The boosting market will adapt

“Money has no name, but contracts always do.”

Why does boosting exist? On the demand side, players want high ranks for prestige, season rewards, and status within the community. On the supply side, high-skill players – often semi-professional gamers and low-tier competitors – need income. The esports labor pyramid pays very little at the bottom. A semi-professional player can earn more from boosting than the combined total of contract salary and tournament winnings.

When Riot tightens enforcement, the risk cost for service providers rises. They will raise prices. They may migrate to servers with weaker verification mechanisms. They may move to other games with less robust anti-cheat systems. This is the classic consequence of supply-side enforcement: the problem gets displaced, not eliminated. A black market does not dissolve because of one crackdown; it adjusts prices and shifts territory.

In traditional sport, anti-doping never stops at catching athletes. It includes education, monitoring, and changing incentive structures. Riot is addressing the symptom – cheating accounts – but not the root cause: the demand for high rank and a labor supply lacking income. Without addressing root causes, every account-locking campaign is merely a bandage on an open wound.

The gray zone of smurfing

Another detail in the announcement could spark fierce community debate: Riot states that smurfing – playing on secondary accounts at a rank lower than one’s true skill level – is not automatically considered cheating. They list eight legitimate use cases, including practicing new champions, playing with lower-ranked friends, protecting one’s highest achievement on a main account, and several others.

As policy, this is a smart approach. Banning all secondary accounts would block a common community behavior and trigger massive backlash. As enforcement, the boundary is extremely vague. How can an algorithm distinguish between a professional player practicing a new champion on a smurf account and a player deliberately climbing with disguised boosting services? Riot says they rely on intent and behavior. The big question is what evidentiary standard is being used and who audits the algorithm’s decisions.

There is another analytical layer: why release the data now? In investigative work, I have learned that the timing of an announcement always has a reason. Publishing “nearly 300,000 accounts locked” serves three purposes: public deterrence against potential violators; justifying the massive investment in Vanguard, which generates no direct revenue; and preparing public opinion for upcoming, tighter controls – MFA, TPM 2.0, hardware attestation. By framing the anti-cheat narrative first, Riot shapes the debate in their favor: players must choose between full privacy and a clean ladder.

Scouting and the ecosystem

Look at the esports ecosystem from a scouting perspective. The ranked ladder is the primary talent channel of the amateur-to-professional pipeline. Academies and tier-two teams use rank, LP, and win rates as initial screening filters. When boosting is addressed, ladder signals become more trustworthy. This is a clearly positive impact.

But an unexamined risk exists: if enforcement is uneven across regions, ranked data quality will diverge by server. Regions with strict verification mechanisms will produce more reliable ladder data than others. Teams with global scouting strategies will need to recalibrate their evaluation criteria – not relying solely on rank but combining scrim results and tier-two tournament performance. For professional players maintaining practice accounts – a group explicitly protected in Riot’s eight legitimate cases – they still sit close to the enforcement boundary. A single duo-queue session with a flagged account could create reputational risk for their entire team.

The reasonable side of Riot’s argument

Now, I do what I always do in any investigation: find the reasonable part of the other side’s argument. Based on my years of experience following ranked matches, I understand why Riot acted. A player who loses because a teammate is a boosted account climbing at the wrong rank experiences real frustration. If this recurs enough, players quit. In a free-to-play model, churn directly erodes revenue. Enforcement here is a churn-prevention investment, not merely punitive policy.

Moreover, the detail about LP protection when cheaters are detected in a match is a genuinely smart player-experience improvement. It reduces the penalty for unlucky games, compresses random variance, and makes LP a marginally more accurate skill signal over large samples. For serious ranked grinders – the most important group for ladder health – this change has a greater positive impact than any account ban.

As for hitchhikers, I acknowledge the logic behind the enforcement: without penalizing riders, players could circumvent the rules by not directly hiring boosters but simply queueing alongside boosted accounts. Expanding liability is the only way to close this loophole. But new liability must come with clear evidentiary standards, a fair appeals process, and transparent error-rate reporting. Riot’s announcement provides none of these elements.

In fact, the most important question I want to raise appears nowhere in the announcement: is the 300,000 figure a one-off disclosure, or the beginning of periodic reporting? If Riot publishes enforcement data quarterly with trend lines, they will set an industry transparency standard – a legacy far more valuable than any account-locking campaign. If this is a one-time disclosure, the number is merely a public relations tool.

The biggest question

There is another way to read this entire affair. It is not really about cheating. It is about power and governance structure.

Riot has just demonstrated it can expand an anti-cheat program from software detection to behavioral control. It has just asserted the right to punish players for their relationships with others – a new principle of joint liability unprecedented in esports. It is about to deploy hardware identity attestation, creating a two-tier citizenship structure within the player community. The truly transformative development lies in Vanguard’s shift from cheating-software detection to platform-level behavioral enforcement, accompanied by a joint-liability doctrine for “hitchhiker” players without precedent in esports governance.

“Audiences want to see a penalty. I want to see the contract before the match.”

The fate of nearly 300,000 accounts is not the main story. The main story lies in what will happen to the remaining 100 million players when hardware becomes identity, when the boundary between legal smurfing and illegal boosting is drawn by an algorithm with no public appeals process. In traditional sport, a disciplinary decision affecting one athlete’s career goes through multiple appeals levels. In esports, a decision affecting hundreds of thousands of accounts is issued via a press release.

I would not be surprised if next year witnesses the privacy and due-process debate in esports growing hotter than ever. Riot will lock more accounts. It will tighten more rules. But the biggest question remains unanswered: who protects the smallest player when the publisher itself becomes the rule-maker, the enforcer, and the judge?

“Every season ends, but the files never do.”