300,000 League of Legends and VALORANT accounts locked for ranked cheating: Vanguard is rewriting the rules

Three hundred thousand. That is the number Riot Games cited when it announced how many League of Legends and VALORANT accounts were locked for ranked cheating, counted from the September 2026 integration of Vanguard into LoL. Not goals, not viewers, not sponsorship dollars. That is the number of accounts actioned. For an esports data analyst with 11 years of industry observation, that number is less shocking than it is vague. What time window does it cover? Which violations did it count? And more importantly, behind that number, what structural change is Riot making to how its two largest titles are governed?

Esports has no ball, but it still has rhythm and probability to measure. In LoL and VALORANT, that rhythm lives in millions of ranked games played every day. Each game is a data sample. Each banned account is a noise point removed from the system. But to understand what this enforcement wave means, I need to look at the long-term context of the ranked ecosystem, starting with Vanguard.

Vanguard was once VALORANT's specialty. It is a kernel-level anti-cheat, running deep in the operating system, before the game even starts. When Riot integrated Vanguard into LoL in September 2026, most of the community discussed the technical side: will weak PCs run it, will it conflict with peripheral software. But as I read Riot's published materials, this expansion is not purely technical. It is a shift from cheat detection to ranked-behavior control. Vanguard is no longer just finding cheats; it is helping to identify who is boosting, who is being boosted, and who is queueing with a boosted account.

Boosting is a service where a high-skilled player logs into another person's account and plays to raise its rank. It turns rank into a tradeable commodity. Hitchhiker is Riot's term for a player who keeps their own account but deliberately queues with a boosted account to be carried up. The new policy allows Riot to revoke LP from both sides in games where ranked manipulation is detected, even if the ride-along player broke no software rule. This is a liability-by-association doctrine, and it is the most contestable detail in the entire announcement.

The community has reason to be worried. A player who accidentally queues with a boosted account, without knowing the teammate used a paid service, can still lose LP. There is no false-positive rate published. There is no detailed appeals process described. Once 300,000 accounts have been actioned, even a 1% error rate means 3,000 potential wrongful cases. An enforcement system of this scale, attached to people's digital property, without transparent accountability, raises questions about its own quality.

Meanwhile, Riot explicitly states that smurfing — playing on secondary accounts — is not automatically cheating. It lists eight legitimate use cases, including testing champions on an alt to protect the highest achievement on the main account. The enforcement line is not based on account count, but on intent and behavior. In policy terms, that is reasonable. In enforcement terms, it is extremely difficult to apply consistently. A professional player using an alt for practice may be safe, but a streamer playing with viewers on a low-ranked alt can be accused by the community of boosting. Intent-based policy always leaves a gray zone.

Numbers do not lie; only readers lie on their behalf. Let the figure 300,000 speak for itself. Riot estimates LoL has about 120 million monthly players, VALORANT about 20 million, for roughly 140 million total. The actioned ratio is about 0.2%. In a headline, "nearly 300,000 accounts" sounds like an epidemic. In a data model, 0.2% is small if the sample window is a year. But "counted from September 2026" suggests the number may have accumulated in one quarter or less. If so, the annualized enforcement rate approaches one million accounts. The intensity is far higher than it first appears. That is the detail most news coverage missed.

I do not trust intuition; I trust a sufficiently long data series. When I separate each piece of the announcement, the most significant part is not the ban count, but three forward plans. First, multi-factor authentication for certain players. Second, TPM 2.0, a hardware security standard enabling physical device attestation. Third, verification requirements that differ by rank, meaning higher-ranked players face stricter identity checks. Combined, they form a new identity regime: accounts bound to hardware, harder to create, harder to resell, harder to evade.

This is the core insight: Riot is changing the cost of creating and operating an account in its ecosystem, and that is what makes this enforcement wave different. Before, a user could create a fresh account in minutes. With TPM 2.0 and hardware attestation, each new account becomes tied to a physical device. To create a throwaway account, you need a new device. The cost of account creation rises from near zero to the price of a computer or a motherboard. That changes the economics of the boosting gray market and account resale. When the cost of new accounts rises, barriers for cheaters rise, but so do barriers for legitimate players wanting to experiment.

Let me add another layer from my experience watching matches in North America over the past year. Boosting demand does not come from people aiming for pro play. It comes from players who want the end-of-season rank rewards, want a decorated profile, or believe the ladder is holding them in "elo hell." The supply side consists of high-skilled semi-professional players with high ranks but incomes too low to live as pro players. This economy exists because both sides have real incentives. Tighter enforcement raises risk, but it does not remove demand. I expect boosting prices to rise, and some activity to migrate to games with softer anti-cheat layers. The problem is displaced, not solved.

One detail mainstream reports do not mention: the 120 million and 20 million figures are not independently sourced. No outside organization confirms them. If these figures are inflated, the 0.2% ratio is even smaller. Conversely, if Riot includes the China servers — operated by Tencent with separate anti-cheat infrastructure — in the denominator but does not count locked accounts from that region in the numerator, the ratio is distorted in Riot's favor. I am not claiming that is what happened; I am saying the information available is insufficient to rule it out. A bad analyst turns an unverified number into an absolute truth.

What is actually at stake? Not a few hundred thousand accounts. It is the credibility of the ranked ladder as a talent-identification channel. In football, people use expected goals and pass counts to evaluate players. In esports, the ranked ladder is where academies and tier-two teams scout candidates. If a high-ranked account is merely the product of a boosting service, scouting based on rank leads to bad decisions. When Riot tightens this, ladder signals should become cleaner in theory. In return, scouts can trust rank slightly more, but in the short term, rank-based verification may reduce the visible population of high-ranked accounts, shifting percentile distributions. Anyone who reads data without this context will misread the relative strength of young talents.

I do not want to be a one-sided critic. Consider the LP protection initiative: in games where a detected cheater or an early leaver is present, Riot reduces or cancels LP loss for affected players. This is a small but psychologically significant change. It does not create highlights, but it lowers the sense of injustice — the thing that kills the motivation of ordinary ranked players more than any champion balance patch. When football pauses, PPDA still shows me who is really pressing. When LoL servers are down for maintenance, I look at LP policy to measure whether Riot is actually listening or merely performing.

The distinction I want to draw is between three affected groups. The first group is the account owner who paid for a boost. The second is the booster who performed the work. The third is the hitchhiker. Riot can easily justify action against the first two groups. But the third is a new legal standard, because it targets a player who broke no software rule, simply for queueing with a polluted account. If Riot wants to keep the community's trust, it cannot rely solely on algorithms to classify "active" versus "passive" behavior. It needs an evidentiary standard, an appeals process, and a public disclosure of error rates. Without those three, the hitchhiker doctrine will become the biggest legal blind spot in the history of esports anti-cheat.

There is also a group indirectly affected that few mention: professional players who maintain multiple practice accounts. Riot says it protects legitimate use, but the line between a legitimate alt and an account used to evade matchmaking is thin. A duo queue between two pros, where one is on an alt, could be flagged automatically. Without a clear declaration process, clubs will carry the reputational risk. I have repeatedly told teams I work with to standardize account declaration and duo-queue hygiene, before Riot does it for them with a system that lacks nuance.

The streaming and content sector will change as well. "Elo-boost" videos and smurf streams, once a profitable content niche on YouTube and Twitch, now face new risk. In contrast, streamers with genuine ranks and transparent match histories gain credibility. In a content economy distorted by highlight reels bought with money, this is a worthwhile correction, even if it is not among the goals Riot publicly states.

For esports bettors, a cleaner ladder means ranked match data becomes a more reliable input for models. But I also want to offer a warning: if boosting is pushed toward regions or titles with weaker enforcement, the gap in data quality between servers will become a variable that any model must handle. A good model knows where its data was born, and whether that data was touched by commercial services.

Another point: Riot says its goal is to make "one-time accounts" harder. That sounds excellent for integrity, but it also changes the experience of returning players. A player who quit for two years and comes back to find their old account cannot be verified because the hardware changed will face an unexpected barrier. I have seen many games lose veteran players because of infrastructure changes without a migration plan. I hope Riot understands that anti-cheat must not become a form of alienating legitimate players.

Now the biggest governance issue. Riot is simultaneously the rule-maker, the enforcer, the source of enforcement data, and the commercial beneficiary of enforcement. There is no independent appeals body. No published false-positive rate. No description of the complaint process. The deeper enforcement moves into hardware attestation, the larger the risk of excluding legitimate players using public computers, internet café machines, or older hardware without TPM 2.0. Riot does not address this group in the announcement. People see a strong action; I see an accountability gap.

The issue does not stop at individual rights. Hardware attestation could become an industry standard. When a major publisher demonstrates that device binding is feasible, others may follow. That creates a world where a player's digital identity does not carry across games, and being a multi-title player or creator becomes more expensive. This direction helps protect the integrity of individual leagues, but it is also a worrying signal for player freedom.

Back to the original question: are 300,000 accounts many or few? Numbers do not lie; only readers lie on their behalf. I would say the figure is both large and small. Large because it reflects an enforcement system running at a higher pace than anything Riot has disclosed before. Small because it does not touch the economic roots of boosting. But the most consequential detail is not the 300,000 figure. It is the phrase TPM 2.0 and rank-differentiated verification. That is where Riot is rewriting the rules for everyone, even players who have never cheated.

In moments of market shock, I often reopen old data and find what others overlooked. This time, the overlooked question is: who supervises the supervisor? When Vanguard becomes behavioral governance infrastructure for two games, the community needs a standard of periodic transparency, not just a press release with a big number. If Riot publishes enforcement data quarterly, with regional and title-level context, it will set an integrity-reporting benchmark for the entire industry, much like anti-doping reporting developed in traditional sport over decades. If not, the 300,000 figure remains a single, unverifiable point. For me, the next question is not how many accounts were locked, but when Riot will open its data for external verification. Data will answer, but only if it is disclosed honestly.