Riot Games Locks Nearly 300,000 Ranked Accounts: Vanguard Expands Its Remit, and the Part Nobody Is Discussing

A Match History That Reads Like Two People

The match history of a Diamond account reads like two different people sharing one keyboard.

In the first two hundred games of the season, the player jungle-pathed half a beat late, warded after mid lane had already lost control, and won 47 percent of games. In the final sixty games, on the same account and the same champion pool, reaction times sat at 180 milliseconds, major objectives were contested on the exact cooldown cycle of the opponent, and the win rate was 71 percent. No balance patch explains that jump. No coach signed off on it. Only one cheaper explanation exists: somebody else sat down in the chair.

For the past three months I have been reading hundreds of match histories like this one every week. Based on my experience tracking ranked games on the Korean server across multiple seasons, a human being's skill curve is the hardest thing in all public data to counterfeit. Players can buy champions, buy skins, buy thousands of hours of playtime. Nobody buys a 180-millisecond reaction time that appears overnight.

Riot Games has announced it locked nearly 300,000 accounts across League of Legends and VALORANT for cheating in ranked play. Most coverage reads the event along a moral axis: cheaters caught, honest players made whole. I read it along a different one.

A cleanup operation at this scale is always the signature of a larger restructuring of power, and this time the structure being rewritten is the player's own identity.

Vanguard Walks Into League of Legends

In September 2026, Vanguard was integrated into League of Legends. That is the single most important fact in this story, and it is also the fact most reports bury near the bottom.

Vanguard is a kernel-level anti-cheat client originally built for VALORANT. It does not scan files in the ordinary sense. It operates at the deepest layer of the machine, where it holds access to nearly every running process. VALORANT players accepted that trade-off years ago. League of Legends has a far lower minimum spec and a far larger player base, so extending Vanguard there changes how the client behaves on user machines. It does not change how the game plays.

Riot describes the goal of the enforcement wave as improving player experience and limiting negative effects. On the balance sheet of a free-to-play title, that is the language of retention. Players who get cheated against leave, and players who leave do not pay. The investment in Vanguard, in multi-factor authentication, in Trusted Platform Module 2.0 attestation, is infrastructure spending that generates no direct revenue. It only makes sense if more players stay than leave.

Roughly 300,000 accounts were actioned across the two titles. Add an estimated 120 million monthly active players for League of Legends to roughly 20 million for VALORANT, about 140 million combined, and the hit rate lands near 0.2 percent. The original report concedes that this ratio is relatively small.

The targeted group splits into three categories. First, boosted accounts, where a highly skilled player logs into someone else's account and climbs the ladder on their behalf. Second, hitchhikers, who use their own accounts but queue alongside an account being boosted, and who may lose the ranked points they earned. Third, smurf accounts, which are not automatically classified as cheating.

Alongside the bans, Riot published plans to add multi-factor authentication, hardware authentication via TPM 2.0, and verification requirements that may differ by rank. The stated goal is to make throwaway account creation harder.

The Ranked Ladder Is an Unnamed Scouting System

To understand why this enforcement wave matters, the ladder has to be read for what it actually is.

The ranked ladder is not a recreational playground. It is the de facto qualification system for the entire amateur-to-professional pipeline. Academies, tier-two organizations and scouts all use rank as the primary filter before spending labor on VOD review or tryouts. When an account is boosted to Challenger by someone else, what breaks is not the experience of a few players in the same game. What breaks is the reliability of a scouting signal.

In basketball I once wrote about defensive connectors nobody notices, the players who hold a system upright while media only watches the scorers. The ranked ladder is that kind of connective tissue in esports. Nobody hands it a trophy. But when it tilts, everything above it tilts with it.

Scouting that relies on rank is only as valuable as the honesty of that rank.

That is why I read the 300,000 figure not as a crime statistic but as an indicator of how deeply the gray market has penetrated competitive infrastructure. The craftsman reads the numbers; the strategist reads the flow. The number says 300,000 accounts were locked. The flow says money has moved through that gap long enough to build an entire service industry.

The Economics of Boosting

Boosting exists because two curves intersect.

On the demand side are players who want a rank their own skill cannot produce. The motive is not only the badge. It is seasonal rewards, access to limited modes, and a form of social credibility measured by the rank frame displayed beside a name. On the supply side are highly skilled players who need income, and in the labor pyramid of esports the lowest tier is the worst paid.

Those two curves meet in the middle and produce a price. Riot does not control that price. Riot controls only the risk of getting caught.

This is where naive analysis of ban waves usually goes wrong. Banning accounts raises the risk cost for suppliers. It does not reduce demand. People who want a rank still want one next season. People who need income still need it next season. In a gray market with stable demand and constrained supply, the standard outcome is not disappearance. It is repricing.

Boosting is not an individual deviance, it is a supply-and-demand relationship with an address and a price tag.

With 300,000 accounts locked, I expect boosting prices to rise over the next two to three quarters rather than collapse. If that happens, revenue per transaction for surviving operators goes up, and the enforcement wave quietly consolidates the position of the gray market's elite tier. It is the familiar paradox of every supply-side crackdown.

The Doctrine of Liability by Association

The most notable part of this announcement is not the ban count. It is the definition of a hitchhiker.

Riot describes this group as players who use their own accounts, play every game themselves, and violate no software rule, but who queue alongside an account being boosted. The penalty can be revocation of ranked points earned in affected games.

This expands liability by relationship rather than by conduct. Traditional sport has precedents for that kind of imputation, such as match-fixing rules applied to players who knew and did not report even without direct involvement. The difference is structural: in traditional sport, athletes are contracted labor with unions and arbitration panels. Ranked players have none of that.

I do not object to the principle. A player who deliberately queues with a boosted account to be carried through thirty straight games is a direct beneficiary of cheating, even with clean hands. The problem sits elsewhere: separating the deliberate from the oblivious.

A student who queues with a classmate for three games, unaware that the classmate's account was boosted by someone else a week earlier, lands in the same category as the co-conspirator. The announcement states no false-positive rate, describes no appeals process, and publishes no evidentiary standard for classifying someone as a hitchhiker.

When a system extends its authority over people who broke no rule, its legitimacy rests entirely on the quality of the appeals mechanism, and that mechanism is currently undescribed.

This is the largest governance gap in the enforcement wave, and it is far larger than the number 300,000.

Smurfs and a Gray Zone Legalized With Conditions

On the opposite side, Riot takes a clear position on smurf accounts, and that position will be the most contested item in community discourse.

Riot representative Phillip Koskinas is quoted saying that playing on a secondary account is not automatically treated as cheating. The announcement lists eight legitimate use cases, including playing at a lower rank to practice, playing with friends of different skill levels, and protecting the highest achievement on a main account.

This is a boundary drawn by intent, not by account count. And a boundary drawn by intent is the hardest boundary to enforce in any governance system, because intent does not appear in server logs.

The gap between community expectation and actual policy sits here. A significant share of players wants smurf accounts eliminated outright. Current policy does not do that, and shows no sign of doing so. The paradox is that the policy is more sensible than the majority expectation: banning all secondary accounts would erase a large legitimate population, including professional players who use separate accounts to practice champions without wrecking their main rank.

Two Tiers of Citizenship on One Server

The most structurally significant detail, and the least discussed, is that verification requirements may be applied differently depending on a player's rank.

As a design, this is tiered governance with logic behind it. Traditional sport applies whereabouts rules more heavily to elite athletes than to amateurs, because competitive risk differs. In esports, strict requirements at the top of the ladder make sense, because the top of the ladder is where scouting, prize money, and open qualifier slots live.

But that model also produces what I would call two tiers of citizenship on one server.

A Silver player can create a new account with almost no friction. A Challenger player must pass multiple layers of verification, may be bound to specific hardware, and may face identity review. Measured against anti-cheat objectives, that is correct resource allocation. Measured against equal-treatment principles, it is a discretionary administrative decision that has not been fully argued in public.

I do not think Riot is doing something wrong. I think this is the kind of decision worth recording and tracking, because it sets precedent for how publishers sort players by their value to the ecosystem.

LP Protection and a Recalculated Expected Value

One small item in the announcement carries large behavioral weight: protecting ranked points in games affected by a detected cheater or a leaver.

Mathematically, it is a minor adjustment. Psychologically, it rewrites the entire calculus of a serious ranked player. Previously, a loss caused by a teammate leaving was an unrecoverable cost. Now that cost is partially insured. Across a few hundred games per season, variance compresses, and League Points become a marginally more accurate skill signal.

This is the kind of change the community will feel far more than 300,000 locked accounts, because it touches every game every player plays. Ban waves are news. LP insurance is experience.

The Counterintuitive Angle: A Big Number and a Forgotten Denominator

Nearly 300,000 is a large number. It is also a large number presented without its denominator, right there in the headline.

The original report computes the 0.2 percent ratio itself and concedes the ratio is small. That creates internal tension: the headline shouts, the body lowers its voice. When a report contradicts itself that way, it usually means the absolute figure came from the source and the division came from the writer.

There is a deeper problem in the denominator.

The 120 million and 20 million monthly-player figures are attributed to no source. They appear as floating estimates with no auditing body behind them. And they likely exclude a large share of the player population.

League of Legends in mainland China operates inside Tencent's ecosystem, with localized anti-cheat and account verification infrastructure distinct from the global Vanguard rollout. Whether the 300,000 figure includes, excludes, or can be separated from the China server population is unanswered in the public material.

If that figure is global-ex-China, the 0.2 percent ratio is calculated against the wrong denominator, because a large share of League of Legends monthly actives sit inside the China ecosystem. The true rate could be substantially higher than published.

This is the kind of error I encounter constantly in sports reporting: the denominator is taken from the most convenient source rather than the correct one.

A second sourcing problem: every quantitative claim in this story originates with the enforcing party. Riot writes the rules, enforces the rules, supplies the enforcement statistics, and benefits commercially from enforcement. None of those four roles belongs to an independent third party.

This governance structure is specific to esports and differs fundamentally from traditional sport, where at least an international arbitration body can hear cases against organizers. No equivalent exists here. The structure is not legally wrong, but it means every claim about anti-cheat effectiveness must be read as a one-sided statement until independently audited.

The Risk Sits in the Design, Not the Offense

When assessing risk in this story, I separate two layers.

The first layer is cheating itself. Risk here is baseline risk, present in every competitive title, and this enforcement wave meaningfully reduces it. Nothing about that layer is controversial.

The second layer is enforcement design. This is where the real risk sits, and it has three components.

The first is liability by association for hitchhikers, as analyzed above, carrying the full bundle of false-positive exposure and absent appeals process.

The second is hardware-bound verification through TPM 2.0. When an account is bound to a specific hardware module, the cost of creating a new account spikes, exactly as intended. But the same mechanism creates another problem: players on internet café machines, or on second-hand hardware, are structurally disadvantaged. In some regions, internet cafés are how most players access League of Legends.

This is an accessibility and hardware-equity risk, and the announcement does not mention it. Binding identity to devices also intersects with personal-data regulation in some jurisdictions. That is the kind of question a global publisher will have to answer, sooner or later.

The third is Vanguard's expansion from detecting cheat software into policing ranked-system behavior. Once anti-cheat software runs at kernel level with behavioral visibility, extending it to other conduct categories becomes a product decision rather than a technical capability question. That is a precedent worth tracking.

The Gray Market Will Reprice, Not Disappear

The role of the craftsman never disappears, it merely gets upgraded into a system.

Here, the system being upgraded is the enforcement apparatus itself. But enforcement only touches the supply side of the gray market. Demand remains intact: the desire for rank, seasonal rewards, social credibility. And supply retains its motive: the income gap at the bottom of the esports labor pyramid.

When risk cost rises and demand holds, price rises. When price rises, margins for surviving suppliers rise. When margins rise, the incentive for new entrants rises too, because the reward for clearing the risk barrier is larger.

This is why I expect the problem to move rather than be solved. Boosters pushed out of League of Legends and VALORANT can migrate to titles with looser verification. At industry level, this is a redistributed problem, not an eliminated one.

Transfers do not buy players, they buy expectations. Ban waves operate on similar logic: they do not buy honesty, they buy the expectation of honesty. And expectations need periodic renewal through fresh data.

What to Track Next Season

The biggest variable is not whether Riot locks more accounts. It is whether Riot publishes enforcement data on a recurring basis.

If the 300,000 figure is a one-off disclosure, it will fade within weeks and become an isolated data point in the archive. If it is the first brick in a recurring series with trend lines, split by title and region, then Riot is establishing an industry integrity-reporting standard, the way anti-doping reporting norms developed in traditional sport.

As a market reader, I would bet on the second scenario, but not at high probability. The cost of recurring disclosure is enormous: once you publish a series, you must explain every fluctuation, and you create the yardstick others will use to judge you.

If hardware and rank-tiered verification actually reach deployment within six to eighteen months, the impact on player experience will exceed all 300,000 locked accounts combined. That is the change worth tracking closely in client patch notes and account policy documentation, not in news reports.

And if you run a tier-two team or an academy that uses ladder rank as a recruiting filter, this is the moment to re-weight that filter. A signal just improved in fidelity and was simultaneously flagged as manipulable, and those two facts do not cancel each other out.

A cleaner ladder will not produce better players within one season. It will only make finding them cheaper. In an industry where scouting budgets are the first thing cut, that is the quietest and most durable form of improvement available.

The question I leave behind: when the publisher writes the rules, enforces the rules, publishes the enforcement data, and profits from enforcement, who checks whether the next number is true?