Nearly 300,000 League of Legends and VALORANT Accounts Locked: Riot Hit the Cheaters, but the Swing Reaches Further Than That

Nearly 300,000 League of Legends and VALORANT Accounts Locked: Riot Hit the Cheaters, but the Swing Reaches Further Than That

1. The ban wave at 3:17 a.m.

3:17 a.m., Los Angeles time. I was sitting in front of a second monitor, rewinding a recorded Diamond-ranked match on the North American server. The game ran 34 minutes. The red-side jungler finished 19/2/11, climbed fourteen divisions in seven days, and the account was created twenty-three days ago. I did not need to watch minute thirty-five. No one gets seventeen times better in three weeks. The person behind that keyboard was not the account's owner.

Three weeks later, Riot Games announced a sweep: nearly 300,000 League of Legends and VALORANT accounts locked for ranked cheating. The community applauded. That reaction is understandable, and it is exactly the reaction I want to peel back layer by layer.

Inside that same announcement sat a line almost nobody quoted: the volume of actioned accounts equals roughly 0.2% of total monthly players. On one side, 300,000 sounds satisfying. On the other, 0.2% sounds tiny. Two figures, one document, and the gap between them is where the real story starts.

But the real story is not whether 300,000 is a lot. It is something far less discussed: Riot is preparing to change how it defines a player account. And that change will touch people who have never cheated once in their lives.

2. The community consensus: Riot just cleaned the ladder

The popular version of this story has a tidy shape: Riot dropped the hammer, nearly 300,000 accounts vanished, ranked play is cleaner, and honest players can grind in peace. It is a pleasant story. It has a hero, a villain, and an ending. Because it is pleasant, it travels faster than any analysis of the structure underneath it.

I understand why players want to believe it. I have sat inside thousands of ranked lobbies over seven years, and I know the feeling of watching a level-34 account with a 78% win rate crush a Master-tier lobby. That feeling is a particular kind of anger, the kind with nowhere to go because there is no one to name. When Riot publishes a number that large, it tells millions of people their anger has been counted and handled.

Consensus is dangerous for anyone doing analysis. When everyone agrees on a story, the gap sits in the assumptions nobody bothers to re-check. Four assumptions underpin the circulating version: that 300,000 represents a meaningful share; that it covers the entire player ecosystem; that enforcement targets only the guilty; and that what is being built behind it is simply a stronger anti-cheat tool.

All four have problems.

3. The division nobody wants to do

Start with the arithmetic. Riot reports nearly 300,000 accounts actioned. The denominators cited in the same document are roughly 120 million monthly League of Legends players and roughly 20 million monthly VALORANT players — about 140 million combined. The division yields about 0.2%.

The first thing to say about 0.2% is that it is not small in every context. For an anti-cheat operator, actioning 0.2% of the user base in one sweep is technically substantial. The problem lies elsewhere: the 120 million and 20 million figures carry no independent verification. They are estimates presented without provenance, and they come from the party doing the enforcement.

The second thing is that this denominator is almost certainly not operationally uniform. League of Legends and VALORANT in mainland China run inside Tencent's ecosystem, with anti-cheat and account-verification infrastructure deployed separately from the global Vanguard rollout. Whether those 300,000 accounts include, exclude, or are separable from the China server population is unanswered. If the figure is global-but-ex-China, then the 140 million denominator is inflated significantly, because a very large share of monthly League players sits inside that ecosystem.

This is a plausible denominator error, and it distorts the very ratio the article uses to reassure readers. The true rate could be higher or lower; without regional and title-level breakdowns, we cannot know.

The third point matters most: an enforcement wave is not a quality metric. Actioning 300,000 accounts over some window tells you two things — the detection system's capability and the prevalence of violations inside that window. It says nothing about the ladder's condition afterward. The source contains no rank-distribution data before and after, no recidivism rate, no regeneration rate for locked accounts.

We know how many doors were closed. We do not know how many windows remain open.

4. The time window: why September 2026 matters

One technical detail sits scattered inside the source material and is rarely emphasized: Vanguard was integrated into League of Legends in September 2026, after years of existing only inside VALORANT.

That detail changes how the 300,000 should be read. If the entire volume accumulated over roughly one quarter since Vanguard entered the League client, the underlying run-rate is far higher than a cumulative total suggests. If it accumulated earlier, the meaning shifts again. The source does not state a window. A number without a time frame cannot be compared to any other period.

Based on my experience tracking Riot's enforcement waves over the years, I see a stable pattern: publishers tend to disclose cumulative figures after a new tool is deployed broadly, because that is when the detection system has enough new data to produce a statistical jump. If that pattern holds here, 300,000 reflects new detection capability more than a new cheating surge. Those two readings lead to entirely different policy conclusions, and the source does not help distinguish them.

There is another layer. Extending Vanguard to League is a system-level change, not a balance change. It runs the game client at the operating system kernel level. That is a long-documented Vanguard characteristic, carrying privacy and system-access debate, plus friction for players on low-spec hardware or using peripheral software flagged as conflicting. The source never mentions this. The silence is meaningful: it shows the material was shaped mainly by the publisher.

5. The economics of boosting: prices rise, markets do not vanish

Boosting, stated plainly: a highly skilled player logs into someone else's account and climbs for them, usually for money. This is not an emotional phenomenon. It is a market with supply, demand, price, brokers, warranties, and service reviews.

The demand side is simple: players want rank frames to display, end-of-season rewards, eligibility for community tournaments with minimum-rank requirements, or simply the feeling of belonging to a tier they cannot reach alone. The supply side is just as simple and far less discussed: part of the high-skill population at the semi-pro and tier-two/three levels needs income. Boosting is one of the few ways to monetize skill directly in an ecosystem where prize money concentrates almost entirely at the top of the pyramid.

So what happens when a publisher enforces hard on the supply side? Prices rise. Higher risk means higher price. Operators who survive earn more per transaction because they are selling a scarcer service. Demand does not vanish, because demand comes from psychology and reward structure, not convenience. Supply does not vanish, because supply comes from income need among an underpaid tier of players.

Hard enforcement does not erase the boosting market. It reprices it, and pushes most activity somewhere harder to observe.

This pattern has been documented repeatedly in other gray markets, from account trading to carry services in open-economy games. Supply-side crackdowns work by raising cost, but that effect is bounded by demand elasticity. Here, demand is highly inelastic, because the reward for high rank is tangible while the psychological cost of buying a service is low when nobody is watching.

A second consequence goes unmentioned. If verification tightens in League and VALORANT, part of supply and demand migrates to titles with weaker enforcement. The industry-level problem is not solved. It is displaced. And displacement, in an ecosystem with dozens of competing titles, is usually harder to track than solving it in place.

6. The hitchhiker doctrine: you play by the rules, you still lose points

This is the section that made me stop longest, and the one I believe the community is most underestimating in legal consequence.

Riot introduced a new violation category: the hitchhiker. Definition: a player using their own account who queues alongside an account being boosted. Penalty: ranked points earned in affected games may be revoked.

Read that definition again. The penalized player used their own account. They installed no cheating software. They did not log into anyone else's account. They broke no technical rule. They played with a friend — and that friend was being boosted, possibly with or without their knowledge.

Riot is extending liability to a third party based on association rather than on that party's own violation. In governance language, this is the single largest expansion in the entire document, and it arrives with no description of an appeal mechanism, an evidentiary standard, or a false-positive rate.

Three questions need answers before anyone celebrates this doctrine.

First, what is the evidentiary standard for identifying a hitchhiker? If it is a threshold of shared games, then two close friends who play two hundred games together in a season sit in the danger zone if one of them is flagged for any reason. If it is subjective awareness, it can be neither proven nor disproven objectively.

Second, who absorbs the loss when errors occur? If a clean player loses points wrongly, do they get the points back or just an apology? The source describes no appeal process, no false-positive rate, no complaint-handling timeline.

Third, what happens to in-game social relationships? Group queuing is one of the strongest retention mechanisms in any competitive title. When playing with a friend becomes a latent risk, some players will reduce group play to protect themselves. That effect appears in no table of locked accounts, yet it may be larger than 300,000.

To be clear: I do not oppose punishing hitchhikers. If someone knowingly profits from a boosted account, they are participating in behavior that corrodes ladder integrity, and a penalty is reasonable. What I oppose is expanding associational liability without publishing any accuracy parameters, while the enforcement scale reaches hundreds of thousands of accounts.

Larger scale demands greater transparency. That is a basic governance principle, not an opinion.

7. Smurfing: a gray zone with conditional legalization

Buried in the same document is a detail that runs against most players' expectations. Riot states plainly that smurfing — playing on a secondary account below one's true skill — is not automatically cheating. They enumerate legitimate use cases, including practice accounts, privacy accounts, and accounts that protect a player's highest achievement on their main.

This is a wide gap between policy and community expectation. Many players, when they say clean up the ladder, mean action every alt account. Riot is not doing that. Riot is drawing a line based on intent and behavior, not on account count.

Theoretically, this is the right approach. Practically, it is the hardest approach possible, because intent is not a directly measurable property. You infer intent from behavior, and inference always carries error.

A Master-tier player opens a new account to play with Gold friends and gets flagged for smurfing. A semi-pro player uses an alt to practice new champions in a low-pressure environment, and that alt happens to match a booster's behavioral profile. These two cases sit very close together in data space and very far apart morally. An automated classifier will very likely merge them, because automated classifiers merge cases that look alike.

The source includes a quote from Phillip “mirageofpenguins” Koskinas of Riot Games on the smurfing question. A game explaining its smurfing policy by listing legitimate use cases is a good sign for communication. But a list of legitimate cases is not an algorithm. It describes a border region. It does not describe the border.

One warning for teams and players, including at the professional level. Pros routinely maintain practice accounts, and current policy protects that in principle. But the boundary between a legitimate practice account and a flagged account is defined by behavioral data. If a pro queues with an account already on a watchlist, the next story is no longer about an account. It is about an organization.

8. Hardware verification: MFA, TPM 2.0, and a two-tier citizen model

The most important part of the source is the forward-looking part, not the present-tense part.

Riot says it is preparing a set of account-verification measures: multi-factor authentication, hardware verification via TPM 2.0, and requirements that may apply differently depending on a player's rank. The stated goal is making one-time accounts harder to create.

Separate these three, because their consequences differ sharply.

Multi-factor authentication is the least controversial. It raises the cost of creating accounts at scale, and most players already know it from other services. It is sensible and relatively cheap.

TPM 2.0 is an entirely different matter. TPM 2.0 is a hardware security standard enabling device-level identity attestation. In practice, using it for account verification means binding an account to a specific physical device. When accounts bind to devices, the cost of creating a new identity rises exactly by the cost of owning new hardware.

As anti-cheat, this is extremely powerful. As social policy, it has layers worth weighing.

Hardware verification turns in-game identity from something abstract into an asset tied to physical property. It opens an unanswered question: what happens to players who do not own a private device?

In many regions, a significant share of League players access the game from internet cafés, shared machines, or borrowed hardware. For them, device-level attestation may become a structural barrier, and structural barriers never apply evenly. They do not distinguish clean players from cheaters. They distinguish players with their own device from players without.

Rank-differentiated verification adds another layer. When requirements vary by rank, the system operates as tiered governance: higher tiers face tighter constraints. In traditional sport this model has clear precedent, such as whereabouts rules applying more heavily to elite athletes. Logically, it is defensible, because the stakes at the top are larger.

But the model also raises an equal-treatment question the source never poses. If two groups pay the same price for a product but one group faces more verification friction to use it, the system is no longer neutral. It becomes two-tier. For a competitive system built on fairness, tighter scrutiny at the top may be acceptable, but it needs public justification rather than quiet deployment.

Notably, raising account-creation cost affects more than cheaters. It affects players returning after years away, players wanting to try a new title, and content creators who need multiple accounts. These groups appear in no cheating statistic, yet they are part of the player base.

9. Vanguard: from software-cheat detection to behavioral enforcement

Extending Vanguard from VALORANT to League is the first step in a larger logic. The second step is broadening Vanguard's scope from detecting cheating software to controlling ranked-system behavior. Boosting, hitchhiking, smurfing, rank manipulation — none of these require cheating software. They require people, accounts, and a system that permits transfer of account control.

When an anti-cheat tool expands from software detection into behavioral surveillance, it stops being an anti-cheat tool. It becomes platform-level rule-enforcement infrastructure.

This is where I think the community is misreading the story's nature. The story being told is about cheaters caught. What is being built is an infrastructure layer capable of enforcing rules across multiple titles, multiple behavior categories, and at device level. Once that layer exists, extending it to other behaviors becomes a policy question rather than a technical one.

I say this not as a warning about a conspiracy, but as a structural observation. Every enforcement tool tends to be used for progressively broader purposes, because the marginal cost of extending scope is lower than the cost of building the tool. That is the logic of all infrastructure.

One small but notable detail in the announcement: LP-loss protection when a cheater or leaver is detected. If a match is affected by a cheating account or a leaver, affected players may not lose points.

This is the best-designed measure in the entire document, and it is completely overshadowed by the 300,000 figure. Theoretically, LP protection reduces streak variance, making rank a marginally more accurate skill signal over large samples. It is also the only measure that directly improves the experience of clean players rather than punishing bad ones.

From a cost and communications standpoint, this is the biggest bright spot. It is cheap. It is visible. It improves sentiment in every affected match. And it generates no ethical debate about false positives or privacy. If I ran Riot's communications, this would lead the announcement.

It was placed at the end instead. Because 300,000 draws more attention.

10. A structural conflict of interest

There is a platform-governance problem the source never mentions, and it applies to all of esports, not just Riot.

Riot writes the rules. Riot enforces the rules. Riot supplies the data on enforcement. And Riot commercially benefits from enforcement, because players who leave over cheating are players who stop spending in the store. There is no independent arbitration layer anywhere in that chain.

In a system where the rule-maker, the enforcer, the data publisher, and the beneficiary are the same entity, every figure must be read as a claim, not as a verified fact.

This does not mean the figures are wrong. It means we have no independent way to confirm them, and in analysis, a fact that cannot be independently verified must be handled with corresponding caution.

Three things should exist for enforcement at this scale, and none exist in the source: a false-positive rate, a described appeal process, and a period-over-period comparison.

Each is measurable. The false-positive rate is a technical number. The appeal process is an administrative procedure. Period comparison is simple statistics. All three are absent not because they are hard to measure, but because they were not published.

And here is a note for everyone who covers esports, including me: if we accept figures from a single uninterrogated source and never ask about false-positive rates, we repeat the exact pattern that has damaged this industry's credibility in past cases. An industry that wants to be treated as a mature industry must be able to ask hard questions of the parties that supply its data.

I learned this late, and I learned it after being wrong. In my notebook there is a line from the winter of 2026, when every tournament stopped and I spent three months collecting stories from players at the lowest tier of the system: “The 2026 freeze did not cool my heart; it froze my heart in a stance ready to argue.” I wrote it to remind myself that skepticism is not a flaw. It is a discipline.

11. Hitchhikers and the lesson of one wrongful punishment

A story that is not in the source, but is the kind anyone who tracks ranked systems long enough encounters.

In 2026, while working as an esports competitor and tournament organizer, I sat with a group of semi-pro players reviewing a ban list from another sweep. One case kept us arguing for three weeks. A Diamond player was locked for abnormal access-location patterns. This person lived in an area with unstable network infrastructure and used connections from three different locations in the same week. The system read that as account sharing. In data terms, the conclusion was not wrong. In reality, it was entirely wrong.

That is why the hitchhiker doctrine needs close tracking. Every new rule creates a new class of wrongly affected people, and that class rarely appears in any published statistic.

I write about systems because I believe individuals are rarely the root. When a player declines, people blame them. When a team plays badly, people blame one person. But in most cases I have analyzed, the root sits in coaching, scheduling, team policy, budget allocation, or some misaligned incentive structure. This story is the same. The locked accounts are the outcome. The system is the cause.

And the system here has two faces. One is the boosting economy generated by income gaps inside the competitive ecosystem. The other is the enforcement system generated by a single publisher.

I do not write about the match. I write about what the match deliberately hides. Here, what is hidden is the entire economic layer of boosting, which no publisher wants to publish, because publishing it means admitting it is a structure rather than the misbehavior of a few individuals.

12. Industry transmission: scouting, betting, and other publishers

This story does not stop at ranked players. It travels in three directions.

First, scouting. The ranked ladder is an informal but crucial recruitment channel for the whole ecosystem. Academies and tier-two and tier-three teams everywhere use rank and ladder metrics as a primary filter. If boosting contaminates that signal, it does not merely ruin amateur experience. It damages an entire industry's talent-identification capability.

Boosting contaminates the scouting channel, and a contaminated scouting channel makes organizations sign the wrong people, pay the wrong prices, and miss players who cannot climb fast but have real potential.

Second, content and streaming. For years, part of the highest-value ranked content was built on accounts of unclear provenance. As enforcement tightens, that content group faces friction, and content built on genuine high-elo players gains relative advantage. This is a positive but slow effect, and it will appear in no Riot dashboard.

Third, data markets. Betting markets and match-analysis services depend on ranked-data reliability. A cleaner ladder makes data more trustworthy. Simultaneously, boosting pushed out of League and VALORANT may migrate to lower-enforcement titles, so the industry-level problem remains unsolved. It just changes address.

At the publisher level, this move raises the competitive bar. When one publisher runs two of the world's largest competitive titles on the same device-level anti-cheat infrastructure, others must answer questions about their own standards. For consumers, that is good. For competition, it is a new infrastructure-level barrier to entry.

One unanswered question deserves leaving open: whether the 300,000 is a one-off disclosure or the beginning of periodic reporting. If periodic, this publisher is setting an integrity-reporting standard for the industry, similar to how anti-doping reporting norms formed in traditional sport. If one-off, it is a media event.

The difference between those two scenarios is far larger than the difference between 300,000 and 250,000 accounts.

13. Where I might be wrong

I have held this position through several drafts, and I want to argue against myself before closing.

Weakness one: I am judging an enforcement wave by the absence of information. Missing false-positive data in the source does not mean it does not exist. Riot may publish it elsewhere or be preparing to. If so, my criticism becomes too heavy-handed.

Weakness two: I may be overstating the hitchhiker doctrine's impact. In practice, the number of players affected may be tiny, and most may be deliberate beneficiaries. If the false-positive rate is in the low single digits, the social cost is far lower than my concern implies.

Weakness three: I may be reading an enforcement campaign through a policy analyst's eyes while readers just want to know whether the ladder is cleaner. That is a fair gap, and I have no right to impose my reading.

Weakness four, the one I weigh most: if hardware verification genuinely slashes cheating, then eighteen months from now players will have a measurably better experience, and every concern of mine about process and privacy will look like noise from an over-sensitive analyst. I accept that possibility. I would rather ask early and be called too harsh than nod at a number nobody verified.

In football, no hot take is too early; only the analysis is published too late. In esports, the same holds.

14. What I will track, and what I will predict

Seven signals over eighteen months. First, the cadence of enforcement-data disclosure: a second release with trend lines would establish a new reporting standard. Second, the actual timing and scope of MFA and hardware attestation rollout: beyond test scope, this is the largest shift in account economics in years. Third, the specific rank threshold for tiered verification. Fourth, the volume of wrongful point revocations surfacing in the community. Fifth, high-elo rank distribution after enforcement. Sixth, price signals in the boosting market. Seventh, regional enforcement symmetry.

Three verifiable predictions.

One, boosting prices in League and VALORANT will rise noticeably within six months, and the market will not shrink correspondingly. I predict re-pricing, not disappearance.

Two, acceptance rates for hardware attestation will differ sharply by region, and that difference will reflect shared-computer prevalence, not willingness to follow rules.

Three, and this I believe most: within eighteen months, ladder-derived scouting signals will become more trustworthy, and academies will begin re-weighting their evaluation criteria. This is the campaign's largest positive consequence, and it will appear in no announcement.

Riot can lock accounts, but the clean player is the one I see in my dreams.

One closing question I cannot answer. If within three years every competitive account is bound to a physical device, are we building a fairer playing field, or a system where the right to participate depends on how much hardware you own?

The answer will not come from any press release. It will come from the people at the bottom of the ladder, who were never asked, and whom I always choose to stand beside.