300,000 League of Legends and VALORANT Accounts Locked: Riot Is Rewriting the Ranked Rulebook

Nearly 300,000 League of Legends and VALORANT accounts have been locked by Riot Games for ranked cheating, following the September 2026 integration of Vanguard into League of Legends. The number equals roughly 0.2% of an estimated 140 million monthly active players. But the real story is not the ban count; it is Riot's move toward hardware-bound identity, liability-by-association for hitchhikers, and a new governance layer for esports. Vanguard, Riot's kernel-level anti-cheat, originally deployed with VALORANT, entered the League of Legends client in September 2026. This is a platform-level change, not a balance patch. Riot is expanding Vanguard's remit from detecting software cheats to policing ranked-system manipulation: boosting, hitchhiking and other forms of paid rank climbing. Boosting is a gray-market service: a high-skilled player logs into another person's account to raise its rank. Hitchhiking is Riot's term for a player who uses their own account but queues with a boosted account. Smurfing sits on a different boundary. Riot says smurfing is not automatically cheating and lists eight legitimate use cases, but abuse can still be punished. In nearly 300,000 locked accounts, I found a boundary being ignored inside the ranked system: the line between cleaning up the ladder and restructuring digital power. Based on my experience watching ranked matches, numbers like these are often released for effect, but the key lies in how they are read. First, the math. 300,000 sounds huge, but the combined monthly active player base is estimated at about 140 million, with League of Legends around 120 million and VALORANT around 20 million. That puts the ban rate at roughly 0.2%. Every game has a violation rate; 0.2% is not enough to declare the ladder rotten. The time window matters. Riot did not say how long it took to accumulate 300,000 bans. If the tally started in September 2026, then the enforcement intensity is much higher than it looks. If it spans years, this is just a late summary. There is another problem: all the numbers come from Riot. There is no independent audit, no false-positive rate, no published appeals process. In traditional sport, a disciplinary body never releases punishment statistics without a layer of scrutiny. In esports, Riot is the rule-maker, the police, the court and the spokesperson. That does not automatically invalidate the 300,000 figure, but it weakens the evidence. The most consequential detail is not the boosted accounts being banned, but how Riot treats hitchhikers. A player who uses their own account, installs no cheat software and violates no rule directly can still lose LP earned in games played alongside a boosted account. This is liability by association. It clashes with basic fairness: a player is punished for someone else's behavior. Riot may argue the player knew or should have known, but what evidence proves that? A new player who accidentally queues with a friend using a boosting service may not realize it. Without a clear appeal mechanism, the hitchhiker doctrine creates a new risk layer for ordinary players. Riot says smurfing is not automatically cheating. It lists eight legitimate use cases, including protecting the highest achievement on a main account, practicing a new champion, playing with lower-ranked friends, or simply wanting a lighter experience. This contradicts the expectations of many fans who want all smurfs punished. But it also creates a vague boundary: when does a secondary account become abusive? If intent is the test, how does an algorithm measure intent? If match count is the test, legitimate players can be caught too. The policy may be well-intentioned, but enforcement will be a nightmare. One genuinely bright spot is LP-loss protection. When the system detects a cheater or a leaver in a match, affected players do not lose LP. For long-term ranked grinders, this is a clear quality-of-life improvement. It reduces the helplessness of facing a game-ruiner, and over time it makes LP a slightly more accurate skill signal because random variance is compressed. The most important part of the announcement is also the least emphasized: future plans. Riot wants to add MFA, TPM 2.0 device attestation, and rank-differentiated verification requirements. If implemented, the cost of creating a one-time account will spike. A cheater trying to return after a ban would face hardware-bound identity, not just a new email address. This is a structural change that could redefine the entire account economy in esports. But it raises privacy and accessibility questions. Internet café users, shared-computer households and players with old hardware will be hit hardest. Hardware attestation is, by design, a tiered system: it creates two classes of citizens in the virtual world, the verified and the suspected. People blame the cheater, but I see a verification policy bleeding at Riot. The issue is not the 300,000 bans. The issue is that Riot is using the anti-cheat fight to build a governance layer with no independent oversight. With Vanguard, Riot has kernel-level access to players' machines. With TPM 2.0, Riot can bind accounts to hardware. With the hitchhiker policy, Riot can revoke LP because of other people's actions. Together, Riot holds a set of governance tools no sports body has ever possessed. A football federation can suspend a player, but it cannot install software on that player's computer to monitor them. Riot can. What happens to the boosting gray market? In theory, stricter enforcement raises the risk premium, and some sellers leave. But demand for rank prestige and supply from skilled players seeking income both remain. Boosting prices will rise, and activity will migrate to harder-to-control platforms. This is displacement, not elimination. Without periodic data releases, we cannot know whether the campaign actually cleans the ladder or merely pushes the problem deeper. There is a quieter channel under pressure: scouting. Academies and tier-two teams use ranked standings to screen prospects. If a top-50 account was bought with money, a scout can waste weeks analyzing someone without matching skill. This campaign helps protect that channel. But uneven regional enforcement creates another issue: if one server is hardened and another is not, ladder rankings lose cross-region comparability. And if the 300,000 figure excludes the Tencent-operated China ecosystem, the true coverage rate may be lower than the global framing suggests. From the perspective of someone who has followed matches and organized amateur tournaments in Vietnam, this story has an extra layer. The Vietnamese market has long been familiar with borrowed accounts, rented accounts and public boosting services. Since Riot took over the Vietnam server, those habits have started to conflict with global policy. Vanguard and TPM 2.0 will create a bigger shock in regions with high rates of public-computer use or older hardware. Without internet-café exceptions, a segment of Vietnamese players could be left behind. When 50,000 spectators vanish from a stadium, home-field advantage becomes an illusion; when 140 million players are reduced to a press release, the scale of an enforcement campaign also becomes an illusion in its own way. What Riot is doing goes beyond locking accounts. They are rewriting the answer to a fundamental question: who is a player in the gaming ecosystem? A name? An email? Or a hardware fingerprint? The answer will shape not only League of Legends and VALORANT, but the entire esports industry for the next decade. The remaining question is: who watches the watcher?