Riot Games locks nearly 300,000 League of Legends and VALORANT accounts over ranked cheating

A ranked session ended at nearly two in the morning, and what stayed with me was not the teamfight at minute 38. The post-game scoreboard showed four lines I still remember: my opponent's account had played 41 ranked matches that season, won 34, an 82.9% win rate, and 29 of those 34 wins were packed into nine consecutive days. A real player improving fast still produces noise — three wins, two losses, a stall at the next rank before breaking through. A boosted account produces almost no noise: a vertical line, a jump in rank, then a cold match history the moment it hits the milestone the buyer paid for.

Three weeks later, Riot Games announced it had actioned nearly 300,000 League of Legends and VALORANT accounts for ranked cheating. Most of the community read the headline as a clean victory, and in one sense it is: this is the largest enforcement wave the publisher has disclosed across two titles at once. But data does not lie — it learns to hide what matters most. What is hidden here is not the severity of boosting but a far larger structural shift: Riot is moving from anti-cheat software enforcement toward behavioural governance of the entire ranked system.

From Vanguard to the “hitchhiker” doctrine

The date to remember is September 2026. Before it, Vanguard — Riot's kernel-level anti-cheat — existed only inside VALORANT. After it, Vanguard was integrated directly into League of Legends. This is a system-layer change, not a balance patch: no champion lost damage, no item changed stats. What changed is what the League client is permitted to do on a player's machine.

Alongside that, Riot widened its definition of violations. Boosting — a high-skill player logging into someone else's account to climb for them — is an old offence and nothing new. The new part is the group Riot calls “hitchhikers”: players using their own accounts, playing with their own hands, but queueing alongside an account being boosted. They may lose the LP earned in affected matches despite breaking no software rule.

Riot also added LP-loss protection: players no longer lose points in games where the system detects a cheater or a leaver. Repeat offenders can see penalties extend to their main account. In the unshipped roadmap, the publisher names three directions: multi-factor authentication, hardware attestation via TPM 2.0, and rank-differentiated verification requirements — the higher the rank, the stricter the check. The stated goal is to make “one-time” accounts harder to create.

On scale, circulating estimates put League of Legends at roughly 120 million monthly active players and VALORANT at roughly 20 million, for about 140 million combined; nearly 300,000 actioned accounts equals around 0.2% of that. A note on sourcing: the 120 million and 20 million figures carry no independent verification, and the 0.2% figure is an analyst-derived division. Based on my experience tracking publisher data disclosures over several years, I always separate “sourced numbers” from “derived numbers” before using them as evidence.

Three layers of evidence that matter more than the headline

The timeframe is the most skimmed-over detail. Vanguard only entered League of Legends in September 2026, meaning the nearly 300,000 accounts were actioned in roughly a quarter, not a year. Annualised, the enforcement run-rate is far higher than the headline implies. One season is a sample. One decade is evidence. Here we have one sample, no time series and no prior-period comparison, so the correct conclusion is “intensity is rising”, not “the problem is solved”.

The consequence for the talent pipeline is rarely mentioned. The ranked ladder is not merely entertainment; it is the entry filter for the entire amateur-to-pro pipeline. Academies and tier-2 teams use rank and MMR as their first screening criterion before offering tryouts. When part of a rank is bought, the scouting signal is distorted exactly where it is most valuable: around the semi-pro threshold. A high-elo enforcement wave therefore is not only about fairness for casual players; it is a precondition for scouting data remaining usable.

Rank-differentiated verification is the most analytically interesting part. When verification requirements differ by player group, the publisher is running a two-tier governance model. Traditional sport has precedent: whereabouts rules and doping controls apply more heavily to elite athletes because their stakes and influence are higher. A similar argument can apply to ranked play. The cost is an equal-treatment question: high-elo players accept more friction in exchange for ladder credibility, while lower-ranked players receive no equivalent protection.

LP-loss protection deserves a mathematical reading rather than an emotional one. When players stop losing points in games containing a cheater or a leaver, the expected loss of a ranked grind falls, the variance of a match streak is compressed, and over large samples LP becomes a marginally more accurate skill signal. That improvement is small, but it is free and measurable, unlike the effect of an enforcement wave nobody has measured yet.

Then there is the detail on the opposite side of policy. Riot states clearly that smurfing is not automatically cheating, and enumerates eight legitimate smurf use cases, including preserving one's highest achievement on a main account while practising new champions. Phillip “mirageofpenguins” Koskinas, a Riot Games staff member, is the voice behind that position. Riot's enforcement boundary is therefore intent- and behaviour-based, not account-count-based. That is a soft line, and soft lines are hard to enforce consistently.

Finally, the structure of power. Riot is simultaneously rule-maker, enforcement body, source of enforcement statistics and commercial beneficiary of enforcement, with no independent arbitration layer in the frame. That is inherent to publisher-run esports. Throughout my tracking I found no data on false-positive rates, no description of an appeals process, and no evidentiary standard for classifying a “hitchhiker”. At a scale of nearly 300,000 accounts, that gap is a material transparency problem.

Locking accounts does not automatically clean the ladder

Variance is not the enemy — it is a mirror held up to the arrogance of prediction. The biggest distortion here is assigning causation to a correlation. The publisher locking many accounts and the ladder becoming cleaner are two different events, and nothing yet connects them. There is no before-and-after rank distribution, no match-quality index, no cross-server comparison. If I had to assign a confidence level to the claim “the ladder is now cleaner”, I would place it at low-to-medium, conditional on observing at least two more quarters.

The denominator problem is bigger still. League of Legends and VALORANT in mainland China run inside Tencent's ecosystem, which uses localised anti-cheat and account-verification infrastructure separate from the global Vanguard rollout. The announcement does not say whether the nearly 300,000 accounts include Chinese servers. If the figure is “global excluding China”, the 0.2% ratio against 140 million players overstates coverage, since a large share of League of Legends monthly actives sit in that ecosystem.

Market mechanics do not change with a press release. Boosting exists because there is demand — rank prestige, seasonal rewards, ego — and supply — highly skilled players with low incomes, particularly at the bottom of the esports labour pyramid. Tightening enforcement raises the risk premium; it does not erase demand or supply. What typically happens in gray markets is that prices rise, the number of sellers falls, revenue per transaction for the survivors rises, and some activity migrates to titles with softer enforcement. In an industry where fans routinely attribute an “unbeatable” status to a particular server or region, the rational expectation is not that the market disappears, but that it reprices and relocates.

One further consequence is unmentioned: TPM 2.0 hardware attestation binds account identity to a specific physical device. For players on shared machines, internet-café PCs or second-hand hardware, that is a real access barrier, not a barrier on paper. At the same time, device-bound identity sharply raises the cost of creating new accounts, tightens the account resale market, and raises the question of whether a “verified identity” transfers between titles. If it does not, multi-title players and content creators pay verification costs repeatedly.

For teams, the risk sits at the boundary. Professional players commonly maintain practice accounts, and that group is explicitly protected. But a duo-queue case involving a pro and a flagged account can generate unflattering headlines for an entire organisation. Standardising internal account declarations is far cheaper than managing a communications crisis.

Signals to watch in the next cycle

Whether the publisher turns enforcement disclosure into a periodic practice will be the first signal — one release is news, a series with trend lines is an industry standard. Next is the hardware verification roadmap: if TPM 2.0 requirements actually ship rather than remain an announcement, that is a far bigger change than banning accounts, because it binds player identity to physical hardware. Finally, wrongful LP revocations among “hitchhikers” will be the clearest reputational test.

Fans remember the goal; I remember the probability before the goal happened. In this story, the probability worth tracking is not that a boosted account gets locked, but that an ordinary player is misclassified as a violator once account identity is bound to hardware. The entire value of a ranked ladder rests on players believing the signal it produces is real. If Riot wants to keep that trust, publishing false-positive rates and a transparent appeals process will be worth more than any account-ban announcement.