Riot locks nearly 300,000 League of Legends and VALORANT accounts — Vanguard expands into ranked, TPM 2.0 waits behind

On July 31, 2026, I was in the studio of a sports radio station in Busan, adjusting the run-down for the evening program. On the secondary screen, a notice from Riot Games appeared: nearly 300,000 accounts across League of Legends and VALORANT had been actioned. Standing alone, that number sounds like a flood sweeping through the ranked ladder. But I have a habit of picking up a pencil before a microphone, and this time the most readable part was not the hundreds of thousands of accounts — it was the small print sitting behind them.

The clause they buried, I am only the person holding the shovel. This time what was buried was not a buy-out clause in a player contract, but a structural change in how Riot defines player identity.

What boundary Vanguard has crossed

Riot Games integrated Vanguard into League of Legends in September 2026, after a long period of deploying it only for VALORANT. Vanguard is a kernel-level anti-cheat client, meaning it sits deeper than most ordinary applications on a player's machine. Extending it to Riot's most populous title is a system-level change, not a champion-balance patch or a bug fix.

In the window from that integration date to now, nearly 300,000 accounts have been locked across both titles. The group actioned this time is not purely software cheaters. Riot has widened Vanguard's remit from hunting cheat software into controlling behaviour on the ranked system.

Three main behaviour categories are in scope.

Boosting is a service in which a highly skilled player logs into someone else's account to climb the ladder on their behalf, usually for payment. It is an economic transaction with supply and demand, not the mischief of a few individuals.

Hitchhiker is Riot's term for a player who uses their own account but queues together with an account being boosted. The key point: a hitchhiker violates no software rule, yet may still lose ranked points earned in the affected games.

Smurfing is playing on a secondary account. Riot states plainly that it does not treat smurfing as cheating by default, and enumerates eight legitimate use cases, including protecting the highest achievement on one's main account.

This is where I want to pause longer than most reports do. Riot's enforcement boundary is drawn by intent and behaviour, not by account count. That is a soft line, and soft lines are always the hardest to enforce consistently.

The change also needs to be placed in the right frame. The ranked ladder is not a purely recreational playground. It is the informal classification system for the entire amateur-to-professional pipeline. Academies, tier-2 teams, and scouts all use ladder standing as their first filter. When boosting corrodes that signal, the damage does not stop at the ordinary player's experience — it spreads to the quality of talent identification.

I once sat reading a scouting file from a tier-2 team in this region. The first criterion in the assessment was peak ladder rank on the server. If that tier is diluted by boosted accounts, an entire capability-evaluation system skews with it.

The 0.2 percent ratio and the denominator problem

I pulled out scratch paper and did a simple division. Estimates put League of Legends at roughly 120 million monthly players and VALORANT at roughly 20 million, a combined total of about 140 million. Nearly 300,000 locked accounts corresponds to about 0.2 percent.

The dead season, but numbers never die. The 0.2 percent ratio tells a very different story from the headline "Riot smashes 300,000 cheaters." It says this is a targeted system-health action, not a sweeping purge.

But the 140 million denominator is the suspicious part. The 120 million and 20 million figures are not attributed to any specific source — they appear as "estimates show." For a report that leans on a percentage as its pivot, an unsourced denominator is a serious provenance failure.

Then I thought about the China market. League of Legends and VALORANT in mainland China operate inside Tencent's ecosystem, with localised anti-cheat and account-verification infrastructure separate from the global Vanguard rollout. Does the 300,000 figure include, exclude, or remain separable from the China-server population? The available material does not answer.

If the enforcement figure is global-excluding-China, then the effective coverage rate against monthly active players is pushed higher than reality, because a large share of League of Legends players sit inside the China ecosystem. This is a potentially significant denominator error, and it changes how the entire message reads.

There is also a time variable. The September 2026 Vanguard integration means the nearly 300,000 figure is most likely a cumulative tally over roughly a quarter or less, not a full-year figure. Annualised, the enforcement intensity would read substantially higher than the initial impression.

The economics behind it also deserve a correct reading. Boosting exists because there is demand — players wanting prestige rank, seasonal rewards, ego satisfaction — and supply — highly skilled players needing income, especially at the bottom of the esports labour pyramid where pay is low and contracts are short. Enforcement raises the risk premium on the supply side but does not remove the demand. In gray markets, tightening supply typically pushes prices up rather than making the market disappear.

I have tracked ranked games on the Korean server for months, and what I consistently see is that boosted accounts carry a very specific fingerprint: win rate jumping sharply inside a narrow time window, then collapsing immediately after. Data does not lie, but it can only speak about behaviour, not motive. Riot moving to behaviour-based assessment means it is trying to read motive from behaviour — a far harder problem, and the place where false positives can surface.

One design point deserves credit. Riot applies loss protection when a cheater or a leaver is detected in a match. In expected-value terms, this reduces the penalty for unlucky games, compresses variance, and over large samples makes ranked points a marginally more accurate skill signal. It is a low-cost, high-visibility win — the kind of improvement players feel immediately, unlike account-lock numbers they only read in a news brief.

What is really buried is TPM 2.0

Most reports stop at the 300,000 figure. I consider that the least important part.

Riot has announced future plans covering multi-factor authentication, a TPM 2.0 requirement, and hardware attestation — binding accounts to physical devices — along with requirements that differ by player rank. The stated goal: making "one-time" accounts much harder to create.

Not a single unit is lost, but the price behind it may be an entire future. Here, players lose no money to play the game, but the price behind it is anonymity and access.

TPM 2.0 is a hardware security standard enabling device-level identity attestation. Once an account is bound to physical hardware, the cost of creating a new account spikes, and a lock becomes a platform-level penalty rather than an account-level one. As an anti-cheat tool it is powerful. As policy, it is a far bigger change than 300,000 locks, and it is receiving less attention than it warrants.

There is an even more troubling governance detail: the hitchhiker. Riot is asserting the authority to revoke ranked points from players who used their own accounts and broke no software rule. That is an expanded liability-by-association standard, and the most procedurally contestable element. A player who queued with a friend who happened to be boosted can lose points without knowing what they did wrong.

The available material provides no false-positive rate, no description of an appeals mechanism, and no independent audit of the 300,000 figure. Riot is simultaneously the rule-maker, the enforcement body, the data source for enforcement statistics, and the commercial beneficiary of enforcement. There is no independent arbitration layer in between. In traditional sport, appeal mechanisms and independent arbitration exist precisely for this reason, and esports lacking them is a structural gap.

On accessibility, hardware attestation raises a fairness question: players on public machines or internet cafes — a substantial group in many regions — may be structurally disadvantaged. And rank-differentiated verification requirements create a two-tier citizenship model inside one playground: the higher the rank, the stricter the requirement. In governance terms this is defensible because stakes are higher at higher ranks. But it also raises an equal-treatment question, and this is exactly the kind of discretionary rulemaking the source report has not examined.

The second systemic risk is that the gray market adapts rather than disappears. If League of Legends and VALORANT close their doors tighter, boosting providers may migrate to titles with softer enforcement. The cross-industry problem is then displaced rather than solved. As a market watcher, I want data on whether servers with different verification levels create an integrity arbitrage between regions.

One more group sits close to the enforcement boundary: professional and semi-professional players using alt accounts to practise champions. Riot states this group is protected, but ambiguous situations — two pros duo-queuing where one account gets flagged — can create headline risk for the whole club. It is a small but real risk, and it belongs in teams' internal management processes.

What to watch next

If this disclosure is a one-off, it will fade within weeks. If Riot turns it into periodic reporting with trend lines, it is setting an integrity-reporting standard for the whole industry, similar to how anti-doping reporting norms formed in traditional sport. The difference between a press release and a standard lies in repetition.

What I really want to see in the next six months is high-tier rank distribution data. If enforcement is effective, the high-elo tier will change shape in a measurable way. If not, players paid with privacy and access without receiving anything of equivalent value.

In parallel, academies and scouting departments should prepare to re-weight their evaluation criteria, shifting some reliance away from ladder rank toward scrim and tournament evidence. When an input signal changes in reliability, the evaluation process must change with it.

The ball rolls on the grass, but the transfer rolls on the desk. In esports, the clause rolls on the server. And this time, the clause worth reading is not in the 300,000 accounts already locked, but in the accounts not yet created — because they will no longer have a way to exist.