Nearly 300,000 League of Legends and VALORANT Accounts Locked: Riot Turns Its Weapons to the Ranked Battlefield

For nearly a decade of watching ranked matches, I have carried an odd habit: I note down anonymous touches. Not the solo kills, not the perfect ganks. Rather, the moments when an account suddenly plays as if possessed by a different person — quicker decisions, wider vision, reflexes unlike anything from twenty minutes earlier. In 2026, while writing for an esports documentary series in Busan, I sat beside a tier-two scout. He opened the ranked ladder, skimmed a few names, and said something I have remembered ever since: "My problem isn't finding good players. My problem is not knowing which account is actually that person." That question, it turns out, does not belong to one scout alone. In September 2026, Riot Games formally integrated Vanguard — the kernel-level anti-cheat system long attached to VALORANT — into the League of Legends client. This was not a champion balance patch, not a meta shift, not a transfer deal. It was a system-level change: the way the League of Legends client behaves on a player's machine changed in kind. The outcome was nearly 300,000 accounts across League of Legends and VALORANT acted upon for ranked-related cheating. That figure includes permanent bans, suspensions, and accounts stripped of League Points (LP). The time window matters. Counting from the September 2026 Vanguard integration, the near-300,000 figure is most likely a cumulative enforcement tally across roughly one quarter or less — not an annual total. Annualised, the real run-rate could be substantially higher than the raw number suggests. It is a caveat I always remind myself of when reading anti-cheat statements: absolute numbers impress, but the denominator and the window tell the story. Alongside the enforcement wave, Riot announced a tightening roadmap: multi-factor authentication (MFA), hardware attestation via Trusted Platform Module 2.0 (TPM 2.0), and verification requirements tiered by rank. The stated goal is clear: make "one-time" accounts harder to create. On the reference data, monthly players across the two titles are estimated at roughly 140 million — about 120 million for League of Legends and 20 million for VALORANT. Worth saying immediately: those figures are not attributed to any specific source. Divide nearly 300,000 by 140 million and you get roughly 0.2%. In other words, for every 500 monthly active accounts, fewer than one was touched. The Economics of a Taxed Trade In Vietnam people call this trade "cày thuê" — farming on commission. In Riot's vocabulary, it is boosting: a highly skilled player logs into someone else's account to raise its rank. This is no hobby of a few idle individuals; it is a gray market with supply, demand, prices, and a working class at the bottom of its pyramid. Where does supply come from? From skilled players with no income from professional play. This is a structural feature I have observed for years: tier-two and tier-three competitors — good enough to reach Challenger but not lucky enough to hold a contract — often seek side income from the very skill they have. Where does demand come from? From players who want a handsome ranked frame, seasonal rewards, and the prestige a Diamond or Platinum account carries in the eyes of friends. When Riot locks nearly 300,000 accounts, it does not abolish that supply and demand. It raises the risk premium. In a gray market, the typical result of tightening supply is not disappearance — it is price. The boosters who survive will charge more to offset the risk of losing their main accounts. Buyers still buy. Anyone who has watched account markets elsewhere knows this: you can shut a shop, but you do not shut demand. The economics of boosting carries an interesting parallel with the transfer market I once covered. The transfer market is not a fish market; it is where dreams are priced. And in the ranked world, what gets priced is not goals — it is the time and risk of a skilled person. The Hitchhiker Doctrine and the Question of Justice Across the entire enforcement wave, the detail that stopped me longest was the definition of "hitchhiker." Riot describes a player who uses only their own account but queues together with an account being boosted. The consequence: ranked points earned in those games may be revoked. Read that carefully. A player who installs no cheats, logs into no one else's account, and violates no personal conduct rule can still lose points for having been on the same team as a stranger the system judged to be boosted. In legal terms this is expanded liability by association. In the perception of an ordinary player, it is a nightmare: you play well, you win, then one day you find your points erased because a teammate that day had a problem. This does not mean Riot is wrong in purpose. The purpose is protecting the integrity of the ladder — something I believe is necessary. But the enforcement tool here raises questions the statement itself does not answer: what is the false-positive rate? Is there an appeals mechanism? What evidentiary standard identifies someone as a "hitchhiker"? In a 2026 interview with a scout, one man told me: "I don't fear the cheater. I fear the system mistaking an honest person, because then I lose faith in the data itself." That is what I think about the hitchhiker doctrine. A system that gets it right 99% of the time but gives no one a chance to contest is still a system with a trust defect. The Blurred Line of Smurfing While boosting is struck hard, a neighbouring concept gets far softer treatment: smurfing. By the published definition, playing on a secondary account is not automatically cheating. Riot even enumerates a set of legitimate uses — including "protecting their highest achievement on their main account." This is a deliberately designed line, and it deserves analysis. Riot is not attacking account count. Riot is attacking behaviour and intent. A pro player with three accounts for champion practice is legitimate. A skilled player opening a new account to play casually with friends at low rank sits in the grey zone. A player using someone else's account to climb is a clear violation. But an intent-based boundary is extremely hard to enforce consistently. How do you distinguish someone smurfing to avoid revealing strategy from someone smurfing to bully newcomers? Externally, the two behaviours look nearly identical. Over nearly two decades of observation, I have learned that when an organisation publishes an intent-based standard, it commits itself to ceaseless explanation — and every inconsistent explanation erodes credibility. Hardware-Bound Identity: The Under-discussed Part This is the part I consider most important, yet it gets the least airtime. When Riot talks about MFA, TPM 2.0, and hardware-level attestation, it is describing an irreversible shift: an account no longer bound to a login string, but to the very machine you sit in front of. Think about the consequences. If an account is anchored to hardware, creating a new one is no longer three minutes of filling a form. It becomes buying a new machine, swapping components, or finding a way around device attestation. That is a different order of tightening from a simple account ban. But for the same reason, it opens two large problems. First, privacy: TPM 2.0 creates a hardware identity that can be linked to a specific person, and in some jurisdictions this touches personal-data regulation. Second, access equity: in many places — Vietnam among them — a substantial share of players access from internet cafés and shared machines. If account identity is anchored to a device, those players are structurally disadvantaged not because they cheat, but because they do not own the machine. In Japan, where I have followed international tournaments for years, there are models for handling similar conduct: they do not lock accounts, they freeze eligibility for official events. But they do so with a clear appeals process, defined response windows, and an independent panel. That is what is missing from the current picture here. A Lesson from a Scout Back to the opening question: what does any of this have to do with people who cover football, athletics, or swimming — the sports I watch and write about? The answer is scouting data. In football, academies use match metrics to filter young talent. In esports, the ranked ladder is that match metric. If the ladder is contaminated by boosting, tier-two teams and academies are reading a distorted dataset they do not know is distorted. One Challenger account looks exactly like another on the ladder — but one of them may not be the person sitting behind the screen. I once followed a case where a small detail changed an entire career. In 2026, at a second-tier Korean football match, I noted a strange sole-of-the-boot touch by a young player. I spent an evening cutting video, analysing every touch, and posted it to my personal channel with just 200 views. Three weeks later, a scout called me. That tiny detail pulled a person out of the dark. But in esports, an identical small detail can lead to the opposite conclusion: you track an account for a month, you are convinced, you reach out — then discover the real player is someone else entirely. That is the cost of an untrustworthy ladder. Every rough gem once lay still under mud, waiting only for a patient enough eye. But a polluted ranked system turns the rough gem into an impostor — and worse, turns the gem-hunter into a cynic. A Contrarian Angle: Big Number, Small Problem, Large Consequence Let us say plainly what I think many are avoiding: the near-300,000 figure sounds dramatic, but its real meaning is far smaller than the initial feeling. A rate of 0.2% is a modest number. In any system with tens of millions of users, a small fraction violating the rules is normal. The question is not how many cheaters were caught. The question is whether those caught were truly cheaters, and whether catching them genuinely makes the ladder cleaner. That is why I always interrogate statements like this, and not only Riot's. All the quantitative data in this story comes from a single source, and that source is simultaneously the lawmaker, the enforcer, the publisher of enforcement statistics, and the commercial beneficiary of enforcement. There is no independent audit layer in between. I think of athletics. In a sport where a record falls over an unregistered technical interval, organisers are forced to publish even their own erroneous results. In esports, that norm does not yet exist. No one obliges Riot to publish its false-positive rate, its successful appeals, or its restored accounts. Without those numbers, fans can only believe or disbelieve — never verify. Another paradox: if enforcement concentrates at high ranks, the short-term effect may be a contraction in the number of visible accounts at the top of the ladder. And if that decline happens without explanation, the community will ask its own questions. That is a signal to watch over the next six to eighteen months. What the cameras do not catch is usually what is worth filming — and in this story, what the cameras do not catch is the data on those wrongly punished. There is another possibility I have not seen written: if Riot keeps a quarterly disclosure cadence, it could inadvertently set an industry-wide reporting standard — much as anti-doping reporting shaped norms in traditional sport. Conversely, if Riot discloses this 300,000 figure once and then goes quiet, the event is a single data point, not a trend. Reflection Between the real and the virtual arena, only the name differs, not the heart. As Riot turns Vanguard from a cheat-software killer into infrastructure for governing behaviour and identity, it is redrawing the boundary of who counts as a "legitimate player." The question I leave behind, not only for Riot but for the whole industry: when a platform writes the law, enforces the law, publishes the statistics on its own law, and profits from enforcing it — at what point does it need an independent layer of verification? I do not write endings; I only go looking for roads no one has told yet. And this road may lead to a question far larger than the number 300,000.