Riot Games Locks Nearly 300,000 League of Legends and VALORANT Accounts for Ranked Cheating

In the first week of November, I reopened the tracking file I had built on the day Vanguard was embedded into the League of Legends client back in September. The figure Riot Games had just published made me stop typing: nearly 300,000 accounts across League of Legends and VALORANT have been locked for ranked cheating. Most of them belong to the boosting category, a paid service in which a highly skilled player logs into someone else's account and drags the rank upward. For the North American esports market, this is the single largest enforcement action a publisher has ever announced at one time.

Then I pasted 300,000 into cell B2 of my spreadsheet, divided it by the combined monthly player base of both titles, and the ratio came out at roughly 0.2%. I stared at that cell for a while.

A number that speaks is worth more than a contract that has been dressed up.

To understand this ban wave, it has to be placed inside the industry's actual power structure. Vanguard launched alongside VALORANT and drew controversy from day one because it runs at the kernel level of the operating system, highly effective against cheat software but deeply invasive on a user's machine. In September 2026, Riot extended Vanguard into League of Legends. That is the real timestamp: from that moment, every ranked account in that title sits under the same layer of monitoring as VALORANT.

At the same time, Riot redefined the scope of enforcement. Boosting is a two-way economic relationship. The buyer wants prestige rank, seasonal rewards and social standing; the seller is a highly skilled player, often sitting at the lower tiers of the esports income pyramid, who needs income outside of tournament play. When Riot locks boosting accounts, it touches a gray market that has existed for years rather than a handful of isolated behaviours.

Two technical details matter more than the headline number. First, the LP protection mechanism: players no longer lose ranked points in games where a detected cheater or a leaver was present. Second, the term hitchhiker, describing a player who uses their own legitimate account but queues alongside an account being boosted. Under the new policy, that group can lose LP even though they broke no software rule. And Riot states clearly that smurfing is not automatically treated as cheating. It lists eight legitimate use cases, including using a secondary account to practise champions or to protect the highest achievement on a main account.

The core of this story is not the 300,000. It is that Riot is converting Vanguard from a cheat-detection tool into behavioural enforcement infrastructure across the entire ranked system.

Viewed through the 0.2% lens, the picture shifts. A large absolute number creates the impression of a cheating epidemic; a relative ratio shows Riot is cleaning up a segment, not facing a systemic crisis. What matters is that the announcement carries no measurement window. Vanguard entered League of Legends in September 2026, so this is very likely a cumulative quarterly total rather than an annual one. If so, the annualised enforcement rate is far higher than the first impression suggests.

One more provenance check is required. Both the 300,000 figure and the estimates of 120 million League of Legends players and 20 million VALORANT players come from a single party: Riot Games itself. No independent auditor confirms them. In my trade, when a number has one source, and that source benefits commercially from publishing it, it always deserves an asterisk.

Behind the scenes, Riot is spending real money. It has announced plans for multi-factor authentication, hardware attestation through TPM 2.0, and verification requirements that differ by player rank. That is infrastructure spending with no direct revenue return. The economic justification sits in retention: in a free-to-play model, players who get cheated on churn out, and every churn event erodes the monetisation base. Riot calls it improving player experience, and on financial logic, that framing holds.

Rank-differentiated verification is the most analytically significant structural detail. It creates a two-tier governance model in which the higher you climb, the heavier the verification cost. In an industry where the ranked ladder is the primary scouting channel for academies and tier-2 teams, this has direct consequences. If ladder signals become more trustworthy, scouting quality rises. If enforcement intensity differs by server, scouting quality diverges by region, and talent flows toward wherever the data is cleanest.

As for the gray market, basic economics says supply-side enforcement tends to raise prices rather than remove demand. The appetite for rank does not disappear; the boosters who remain will charge more for the added risk. The market reprices, it does not close.

Fans leave the stands, but the money never stops moving.

The biggest blind spot in this enforcement wave is the hitchhiker doctrine. Riot is granting itself the authority to revoke ranked points from players using their own legitimate accounts, playing by the rules, simply because their teammate in that match was a boosted account. This is liability by association, and it is fundamentally different from locking a violating account.

The question I always ask about any large-scale purge: what is the false-positive rate, and what is the appeal process. The announcement contains neither. Three hundred thousand is a large enough number that a few percentage points of error equals thousands of wrongly punished players, with no channel to contest it.

On governance, the structure here is unusual: Riot is the rule-maker, the enforcement body, the sole data source on enforcement outcomes, and the commercial beneficiary. In traditional sport these layers are usually separated, with independent officials and a sports court. Publisher-run esports has no such intermediate layer.

TPM 2.0 hardware attestation opens another front. Binding account identity to a physical device means players on shared machines, internet cafe computers, or second-hand hardware face a systemic disadvantage. That is an access-equity problem, not merely a privacy problem. And in some markets, hardware identity binding intersects directly with personal data protection rules.

More broadly, Vanguard's expansion from software-cheat detection into ranked behaviour control sets a precedent. A monitoring layer running at kernel level, permanently present on user machines, can in principle be extended to other conduct categories later. That is a story about platform power, not simply about cheating.

From years of watching Riot's ban waves since Vanguard was exclusive to VALORANT, I have developed one professional habit: do not read the first number, read the structure behind it. This time the structure is hardware attestation, rank-tiered requirements, and a doctrine of associated liability without clear precedent.

Data does not lie, but it needs someone who knows how to listen.

What I will track over the next six months is very specific: whether Riot publishes enforcement data on a recurring basis with trend lines. If it does, the company will have inadvertently set an integrity-reporting standard for the whole esports industry, the way anti-doping reporting shaped traditional sport. If it does not, 300,000 remains a one-off communications moment, and the bigger question stays open: how much cleaner is the ladder really, or only cleaner in the parts we can see.

I start with a spreadsheet, and I still end with questions.