Nearly 300,000 Accounts Locked — What Riot Is Really Changing Isn't the Number

In September 2026, Vanguard — the kernel-level anti-cheat previously tied only to VALORANT — began running on the League of Legends client. Less than two quarters later, Riot Games announced that nearly 300,000 accounts had been actioned across the two titles. I read that number on a Munich evening, snow falling outside the window and a single spreadsheet open on the screen. Three hundred thousand. Enough to fill a mid-sized stadium. But when I divided it myself by the combined monthly player base of the two titles — estimated at around 140 million — the result landed near 0.2%.

I sat with those two numbers for a long while. They do not contradict each other. They tell two different stories. The eye watches one match, the data watches a different one — and both are right.

To place the event properly, it must be separated from the "patch" news bucket. It is not a champion balance update, not a tactical meta shift, and not related to tournament results. This is a governance story — more precisely, competitive-integrity governance. A fight between a publisher and the gray economy surrounding the ranked ladder.

Boosting is defined clearly: a highly skilled player logs into another person's account to climb ranks on their behalf. Its economics are as simple as any gray market. Someone pays to own something they did not earn. Someone else needs money and sells their skill. Demand comes from rank prestige, seasonal rewards, and player ego. Supply comes from the lower tier of the esports labor pyramid, where many tier-2 and tier-3 players live on unstable income.

Across seven years of tracking this industry, I have always believed that any analysis of cheating must begin with its economic structure, not with morality. Ignore that context and every subsequent number becomes noise.

Vanguard arrived in League of Legends in September 2026 after roughly a year serving VALORANT alone. The nature of the change is not gameplay. It is infrastructure: operating-system-level anti-cheat now runs on both clients. But the more notable point lies in its expansion direction. Vanguard is shifting from fighting cheat software alone toward controlling behavior on the ranked ladder itself.

The evidence sits in a new doctrine: "hitchhiker". This is Riot's term for a player who uses their own legitimate account but queues alongside an account being boosted. The penalty: they may lose earned LP, despite breaking no software rule themselves. An expansion of liability by association — a standard that has not existed at this scale in esports governance.

Alongside this, Riot announced LP-loss protection when the system detects cheating or a leaver. Mathematically this is a subtle but important change. Over a sufficiently large sample, reducing the penalty for unlucky games compresses variance, making LP a marginally more accurate skill signal. It is an improvement the media barely noticed, yet it directly affects the daily player experience.

But the largest pivot sits in the concept of smurfing. Riot states clearly: smurfing is not automatically treated as cheating. They enumerate eight legitimate use cases, including "protecting their highest achievement on their main account". Phillip "mirageofpenguins" Koskinas, a Riot Games staff member, is the person responding directly on the issue. Riot's enforcement boundary turns out not to rest on account count, but on intent and behavior. That is a soft line, very hard to enforce consistently.

For repeat offenders, penalties can extend to the main account. But the larger plan lies ahead: multi-factor authentication, TPM 2.0, hardware attestation, and requirements that differ by rank. The end goal is to make "one-time" account creation far harder. At that point, how fast a cheater climbs is no longer the central issue — the cost of starting over is what changes.

Viewed through the industry transmission model, this is a weighty move. Riot is turning one title's anti-cheat tool into a platform-level governance layer. Other publishers will have to measure their own integrity programs against this new standard.

This is where the most misread element appears. The community sees 300,000 locked accounts and nods: the problem is solved. But gray-market economics say the opposite. When supply is squeezed and demand is unchanged, prices rise. The market does not vanish — it reprices. The operators who survive will collect more per transaction, not less. This is the standard outcome of any supply-side enforcement.

As for hardware attestation, technically it means an account is bound to a physical device. That is convenient for anti-cheat, but it creates a rarely discussed consequence: it turns the player base into two tiers of citizenship. Players with stable personal machines sit in one tier. Players on shared machines at internet cafés — a substantial share of League of Legends players in some regions — sit in another. Access inequality is not a technical question. It is a policy question, and the original reporting never mentions it.

And it must be said plainly: Riot is simultaneously the rule-maker, the enforcement body, the sole data source for enforcement figures, and the commercial beneficiary of the action itself. There is no independent arbitration layer in between. This does not make the action wrong. But it makes absolute trust in the number a calculated naivety.

One more important detail goes unmentioned. The 120 million League of Legends players and 20 million VALORANT players are attributed to no specific source. The 0.2% ratio is built on a denominator of unknown origin. Curses do not exist, only data we have not finished reading — and this time, some numbers are ones whose very source we cannot read. Further, there is no false-positive data, no description of an appeals mechanism, no independent audit. For an action touching 300,000 accounts, that transparency gap is too large to ignore.

I track my own ranked matches through the numbers, and what I am waiting for is not the count of locked accounts. I am waiting to see whether Riot turns this figure into a periodic report or leaves it as a one-off announcement. If periodic, they may inadvertently set a transparency standard for the whole industry, much as anti-doping reporting norms formed in traditional sport. If not, it is only a time-limited performance.

Empty stadiums are not a crisis; they are the largest laboratory in football history. The ranked ladder, in its own way, is one too. And the remaining question does not sit with the cheater, but with this: when your identity is bound to hardware, do you still own your account, or does it own you?