Nearly 300,000 League of Legends and VALORANT Accounts Locked for Ranked Cheating: Behind the Number Lies a Redefinition of Power

In September 2026, Vanguard was integrated into the League of Legends client. As of now, Riot Games has announced the handling of nearly 300,000 accounts across its two titles — League of Legends and VALORANT — for ranked-system manipulation. That number, against an estimated combined monthly active player base of roughly 140 million, amounts to a mere 0.2%.

I read this on a morning in Binh Duong, at my usual coffee shop on the corner, and a question surfaced that I always ask whenever a publisher announces a ban figure: Who is doing the counting, and what does the counter gain from the number just released?

Data never lies; we simply haven't asked the right question. In this story, the right question is not 300,000. It lies elsewhere — in what the press release does not mention.

Context: A war that changed targets

To understand why this event matters more than it appears, one must revisit Vanguard's own history. It is anti-cheat software operating at the kernel level — the deepest privilege a program can hold on a personal computer. Initially, Vanguard was designed exclusively for VALORANT, the tactical shooter Riot launched in 2026. At the time, integrating kernel-level software into a game client triggered a wave of controversy over privacy and system access.

In September 2026, Riot brought Vanguard into League of Legends. This was the turning point. Not because League of Legends lacked anti-cheat before — but because Riot decided to apply the same technical standard to both titles, converting Vanguard from a single tool into a platform-level governance layer.

And here is the core point: Vanguard is expanding its remit from combating cheat software to controlling ranked-system manipulation. This is no longer a fight against hacks. It is a fight against boosting, against parasitic accounts, against behaviors previously treated as gray areas.

From my industry-observation standpoint — eighteen years covering esports from Korea to Vietnam — this is a philosophical turning point in governance. Publishers previously handled only clear-cut violations: hacks, cheats, exploit abuse. Boosting — the service whereby a highly skilled player logs into another's account to climb ranks — always existed in a gray zone, theoretically banned but practically hard to enforce.

Riot has just declared that gray zone is no longer gray.

Data analysis: What does 300,000 say?

Let us begin with the number. Nearly 300,000 accounts actioned. Impressive on a headline. But placed against the player base, it shrinks considerably.

Estimates place League of Legends at roughly 120 million monthly players. VALORANT at roughly 20 million. A combined 140 million. The ratio of 300,000 to 140 million is about 0.2%.

But this is where I — as a data journalist — must stop and flag a structural data problem. All three of these figures come from a single source: Riot Games itself. No third party verifies. No independent audit. No baseline for prior-period comparison.

When I wrote my PPDA series on V-League in 2026, I hand-recorded data from 182 matches on video. It took six months. But I knew exactly where my data came from, I knew the margin of error at each measurement, and I could walk anyone through every step.

Here it is different. The 300,000 figure carries no specific time window. It carries no breakdown by title — how much League, how much VALORANT? It carries no trend data — this quarter versus last?

A number without a comparison sample is a number whose trend cannot be assessed. And a number from a single source with a direct interest in the number looking large is a number to treat as directional data, not audited data.

One point I can infer from the timing fact: Vanguard was integrated into League of Legends in September 2026. If 300,000 was announced recently, it represents roughly one quarter of operation — possibly less. This changes the intensity reading. Annualized, the number would be substantially higher.

This is a technique I learned from studying the empty-stadium Bundesliga matches in 2026. When I analyzed 252 matches from May to June, I recognized that home-win rate fell from 43% to 29% — but more importantly, I had to understand the time window of the sample I was analyzing.

With 300,000 accounts, we are talking about a fraction of the whole, processed within a short window. What does that mean?

It means Riot may be at the start of a long campaign, and this number will keep rising.

A test case: Donnarumma and the principle of models

Before going deeper, I want to pause on an old story. In 2026, I published research on 342 penalties across five European leagues. Key finding: Donnarumma dove right 72% of the time against right-footed takers. I predicted Italy would beat Spain on penalties. It was called fortune-telling. Result: Italy won 4-2 on penalties, and Donnarumma saved two right-side shots.

Why mention this in an article about account bans?

Because the principle is the same. A model only has value if it predicts verifiable outcomes. With 300,000 accounts, Riot is implicitly offering a model of violation behavior. But it publishes no false-positive rate, describes no appeals process, states no evidentiary standard for classifying an account as parasitic.

This is the methodological crux: an enforcement model with no published error rate is an unverifiable model — and an unverifiable model cannot improve.

My Donnarumma model was verifiable. I predicted, I waited, I checked. Riot gives us no such opportunity.

Moreover, there is a detail I must stress: the appeals process. In football, when a referee errs, there is VAR. When VAR errs, there is a disciplinary committee. When the committee errs, there is the Court of Arbitration for Sport. Each layer is relatively independent.

In esports, and especially in this case, Riot is simultaneously rule-maker, enforcement body, sole data source on enforcement, and commercial beneficiary of enforcement. There is no independent arbitration layer.

This is a structural issue inherent to publisher-run esports, and it is raised in no press release.

The new doctrine: Liability by association

This is the part I consider most important in the entire story, and the part buried under the 300,000 headline.

Riot has expanded its violation definition to include a new category: "hitchhikers" — players using their own legitimate accounts while queuing alongside a boosted account. They keep their accounts, but League Points (LP) earned in those games may be revoked.

This is a doctrine of liability by association. You break the rules not because you did anything wrong, but because you played with someone who did.

In traditional sports history, there are precedents — teams punished for individual fans' rioting, players suspended over relatives' betting. But in those cases, there was always due process, always an opportunity to rebut, always an independent adjudication layer.

Here, there is none. No false-positive rate disclosed. No description of how to distinguish an unwitting player queuing with a boosted friend from a deliberate parasite.

Imagine the practical consequence. You are a serious player, Diamond rank, and you regularly duo-queue with someone you met through a Discord community. That person pays for a boosting service — something you do not know. Riot detects the account. You lose LP from every game played together. No appeal. No explanation.

This is not a hypothetical. It is the logical consequence of a liability-by-association doctrine applied without procedural safeguards.

I wrote 'Low pressing is not cowardice' in 2026 and was called a soulless statistician by a veteran coach. But my PPDA index was verifiable against video. Anyone could rewatch and count. Riot's parasitic doctrine lacks equivalent transparency.

This is the point where I must be blunt: a disciplinary system with no appeals mechanism is not a disciplinary system; it is a power system.

The blurred border: Smurfing and the paradox of tolerance

While Riot expands liability toward hitchhikers, it takes the opposite stance on smurfing.

Smurfing — playing on a secondary account at a rank below one's true skill — is not automatically treated as cheating. Riot even enumerates eight legitimate use cases for secondary accounts, including "protecting their highest achievement on their main account" and "practicing new champions or agents."

This creates an interesting paradox. The same behavior — a high-skill player on a non-main account — can be forgiven or punished depending on intent. And intent cannot be measured directly.

The publisher is betting it can infer intent from behavior. It can distinguish a pro practicing on a smurf from someone deliberately deranking to bully newcomers. Theoretically feasible. Practically extremely hard.

This is where the community will argue most. A substantial share of players wants a blanket smurfing ban. Riot says no. The gap between community expectation and actual policy is a wide one, and it will fuel much debate in the coming months.

From a data standpoint, this is a reasonable decision. If Riot banned secondary accounts absolutely, it would lose a large pool of legitimate players — those holding multiple accounts for valid reasons. Enforcement cost would spike, and the false-positive rate would be unacceptable.

But from a communications standpoint, it is a hard sell. Riot is telling the community it understands the smurfing problem but chooses not to solve it thoroughly. That is a technically honest position but easily misread emotionally.

The future: When identity is bound to hardware

This section is, I believe, the most structurally important, and the least covered by media.

Riot plans to deploy multi-factor authentication, TPM 2.0, and hardware authentication. In short: it wants to bind accounts to players' physical devices.

TPM 2.0 is a hardware security standard enabling device-level identity attestation. Applied to a game account system, it means one account is tied to one specific machine. To create a new account, you need new hardware. To move your account to another machine, you need a complex verification process.

This is a far bigger change than banning 300,000 accounts. Fully deployed, it redefines the economics of account creation.

Currently, the cost of creating a League of Legends account is near zero. You download the game, register an email, and you have a new account within ten minutes. This is why boosting services can operate at high margins — they can create and discard accounts at minimal cost.

If TPM 2.0 is applied, that cost spikes. Not in direct money, but in technical barriers. Every new account needs new hardware or a complex verification process. This transforms the economic equation of the boosting market.

But it creates new problems too.

First, access. In many regions — including Vietnam — a significant share of players access the game from internet cafés, where multiple people share a machine. If accounts are hardware-bound, these players are structurally disadvantaged.

Second, privacy. Binding identity to hardware means the publisher can track players' physical devices. In some jurisdictions, this intersects with personal data protection regulations. Riot's statement does not address this aspect.

Third, fairness. Riot plans rank-differentiated verification. Higher rank, stricter requirements. A tiered governance model — logically sound (higher stakes at higher ranks) but raising equal-treatment questions.

I have seen similar models in traditional sport. Whereabouts rules apply more strictly to elite athletes than amateurs. But in traditional sport, independent international bodies oversee. In esports, there is no equivalent.

Contrarian angle: The market will not disappear, it will reprice

This is the judgment I consider most important, and the one most contrary to popular intuition.

When a gray market is heavily enforced, it does not vanish. It reprices.

The mechanism is simple. Enforcement raises risk for boosting providers. Higher risk demands higher risk premium. Boosting prices rise. But demand does not fall, because demand comes from fundamental drivers that do not change: rank prestige, seasonal rewards, player ego, and — most importantly — the income of skilled but low-paid players at the bottom of the esports pyramid.

I have personal experience with the fringe economics of esports. In my early career I organized tournaments and observed the amateur transfer market. What I realized: whenever there is a skill gap and an income gap, an intermediary market forms to exploit it. Prohibition changes the market's form, not its existence.

With boosting, demand drivers are strong. An average player wants a Gold badge to show friends. Another wants Platinum before season's end for rewards. A third wants entry to a community tournament requiring a minimum rank.

Supply drivers are equally strong. Tier-2 and tier-3 players in many regions earn below a living wage. Boosting is an attractive side income.

Riot's enforcement raises costs for both sides. But it does not address root causes. In economics, this is supply-side enforcement — it restricts supply but does not touch demand. Standard result: prices rise, the market narrows in volume but does not vanish, and remaining operators may earn higher per-transaction revenue.

And there is a second possibility: migration. If League of Legends and VALORANT become harder to exploit, boosting operators may shift to lower-enforcement titles. The industry-level problem is not solved — it is displaced.

I once tweeted a comparison table on empty-stadium Bundesliga matches in 2026, and The Analyst shared it as scientific evidence of home advantage. In that case, data showed a real systemic effect. I could verify it by comparing home-win rates before and after the pandemic. Anyone could replicate the analysis.

With the boosting market, we have no equivalent data. No one measures boosting prices before and after Riot's campaign. No one tracks operator migration. No one measures effects on low-tier esports labor supply and demand.

This is the largest data gap in the entire story. And it is a gap only independent audit can fill.

Transmission: From ranked ladder to scouting pipeline

If analysis stops here, we miss this fight's most important impact.

The ranked ladder is not just a game. It is the de facto selection system for the entire amateur-to-pro pipeline. Academies and tier-2 teams use ladder rank as their first screening filter. Scouts track players at the highest ranks to find new talent.

If the ladder is manipulated — by boosting, by hitchhiking, by any form — the scouting signal is corrupted. A Challenger-ranked player may genuinely deserve it, or may have paid a service to get there.

This is why I argue Riot's anti-ranked-manipulation fight matters more than the 300,000 figure. It concerns the quality of a global scouting channel.

But this impact is conditional. It is only positive if enforcement is maintained consistently across regions. If one server has softer enforcement, the boosting market migrates there, and scouting quality on that server declines relatively.

And here is an important open question. League of Legends and VALORANT in mainland China operate within the Tencent ecosystem, with distinct anti-cheat and account-verification infrastructure. Does the 300,000 figure include, exclude, or separate from the China server population?

Available information does not answer this. And if the figure excludes China, the 0.2% ratio is significantly miscalculated, since a large share of League's monthly actives sit in the China ecosystem.

This is the kind of sampling error I always guard against in my work. When I analyzed 182 V-League matches, I had to ensure my sample represented the whole league, not just a part. Had I watched only Long An's matches, my PPDA index would have held no representative value.

With Riot, the question of the 300,000 figure's geographic scope is a question of sample representativeness. And it is unanswered.

The Croatia lesson: A well-governed variance

In 2026, I staked my career on a probability model named Croatia.

I was assigned as an analysis reporter at the Russia World Cup thanks to my V-League data series. After the quarterfinals, I predicted Croatia would beat England because their average xG was 2.3 versus England's 1.1, despite Croatia playing multiple extra times. Colleagues laughed, saying football is not mathematics. Croatia won 2-1 after extra time.

Croatia was not a miracle, but a well-governed variance.

Why bring this up? Because it directly relates to how I read the 300,000-account story.

Riot is trying to govern the ranked system's variance. It wants to minimize the impact of random factors — boosting, hitchhiking, leavers — so the ladder more accurately reflects true skill.

This is a laudable goal. The problem is method.

When Croatia beat England, I knew why. I had a probability model, xG data, and a step-by-step explanation. Most importantly, I could verify against results.

With Riot, we have no public model. No underlying data. No independent verification. We only have a statement that nearly 300,000 accounts were actioned.

Data never lies; we simply haven't asked the right question. And the right question here is: if we cannot verify the model, how do we know it is working correctly?

Progressive conclusion: A signal for the next cycle

What I track in the coming months is not the 300,000 figure.

I track whether Riot publishes periodic enforcement data. If it does, it creates an industry integrity-reporting standard comparable to how anti-doping reporting developed in traditional sport. If it does not, 300,000 fades into oblivion as a single incomparable data point.

I track the fate of TPM 2.0 and hardware authentication. If deployed, it changes the economics of account identity in ways never seen in esports.

I track the number of wrongly enforced hitchhiker cases reported by the community. What is an acceptable false-positive rate when we are revoking ranked points from players who broke no software rule?

And finally, I track boosting-market prices. Not because I endorse it, but because it is the only measurable indicator of this campaign's real effectiveness. If prices rise, enforcement works on supply, but demand remains. If prices fall or stay flat, enforcement is failing. If the market migrates to other titles, the problem is not solved — merely relocated.

We think we understand the game, until the data table opens our eyes. And in this case, the table we need most — on false-positive rates, appeals processes, and gray-market migration — has not been published.

The question is not whether Riot is doing the right thing. The question is whether we can know it, when the sole data source is the enforcer itself.

And that is a question no press release can answer.