Nearly 300,000 Accounts Locked for Ranked Cheating: Riot Changes the Rules, but the Number Is Not the Story

In September 2026, Vanguard — the kernel-level anti-cheat shield that Riot Games had previously reserved for VALORANT — was embedded directly into League of Legends. Since that marker, nearly 300,000 accounts across the two titles have been locked.

I read that figure three times, then reopened my academy tracking notebook. Not to verify whether Riot was telling the truth. But to answer a different question: what is this number actually measuring?

Divide 300,000 by the estimated combined monthly active players of both titles — roughly 140 million, of which League of Legends accounts for about 120 million and VALORANT about 20 million — and the result lands at approximately 0.2%. One-fifth of one percent. When the crowd looks up at the bright screen, I dig beneath the dust of old data. And the dust here is thicker than the headline.

One thing must be stated up front: the 120 million and 20 million figures have no specific origin in the original report. Every quantitative claim in this story — from the number of locked accounts to the player-base size — emanates from a single party: Riot Games itself. No independent audit. No third-party confirmation. This is the source weakness that anyone who works with numbers must annotate before citing.

The September 2026 marker also hints at the time window. The figure of nearly 300,000 is very likely a cumulative total over roughly one quarter, not over a full year. If so, the annualized enforcement rate is substantially higher than the headline's impression suggests — a detail left unstated, yet one that completely changes how the campaign's intensity should be read.

The report circles three behavioural categories. First, boosting — a paid service in which a highly skilled player logs into someone else's account and carries the rank upward. Second, smurfing — playing on a secondary account, usually at a rank below true skill. Third, and this is the point that matters, hitchhiking: a player using their own account, but queuing alongside an account being boosted.

The most consequential detail in the entire story is not the 300,000 figure, but the hitchhiker doctrine. Riot asserts the authority to revoke ranked points from players who used their own accounts, violated no software rule, and did so only because they queued with a flagged account. This is an expansion of liability by association — a new procedural standard, and the most contestable element of the entire announcement.

Alongside that, Riot published a future verification roadmap: multi-factor authentication, TPM 2.0, hardware attestation, and requirements applied differently depending on ranked tier. The stated goal is explicit — making one-time accounts harder to create. If realised, what changes is not the in-game rulebook, but account identity at the device layer.

Another technical detail receives less attention but carries high operational value: when the system detects cheating or a leaver, affected players do not lose ranked points. By design, this is a variance-compression change — over large samples, ranked points become a marginally more accurate skill signal. For an academy observer like me, that class of improvement is worth far more than a noisy account-ban wave.

What Riot states clearly and firmly: smurfing is not automatically treated as cheating. The publisher enumerates eight legitimate use cases for secondary accounts, including protecting one's highest achievement on a main account. Phillip mirageofpenguins Koskinas, a Riot Games staff member, is the spokesperson for this position. Riot's enforcement boundary is therefore drawn by intent and behaviour, not by account count — a soft line, and precisely because it is soft, extremely hard to apply consistently.

Now to the part I consider the story's largest blind spot.

Riot is simultaneously the rule-maker, the enforcement body, the provider of data about its own enforcement activity, and the commercial beneficiary of that enforcement. No independent arbitration layer sits in between. The report contains not a single line about false-positive rates, appeal processes, or the evidentiary standard used to classify someone as a hitchhiker. Those three things are absent at a scale of 300,000 accounts, and that absence is not small.

Every prophecy lies in the sediment the crowd rushes past. The sediment here is the economics of the boosting market. Demand comes from rank aspiration, seasonal rewards and ego. Supply comes from highly skilled players who need income — some of them sitting at the base of the esports labour pyramid, where wages are low enough that rank-carrying services become a more rational income than competing professionally. Enforcement does not erase demand, nor supply. It raises risk, and higher risk means higher prices. The most plausible outcome is not a market that disappears, but one that reprices — with part of the activity migrating to titles with softer enforcement.

There is another consequence the report does not mention. If enforcement concentrates most heavily at high ranks — exactly as tier-based verification design implies — then in the short term the visible high-elo population may contract, temporarily distorting percentile distributions and skill-rating calibration. For academy scouting departments and tier-2 teams that use ranked standing as a screening filter, this is worth tracking: the signal from the ladder will be cleaner over the long run, but noisier in the short run.

I do not drill into the moment; I drill into the sedimentation process of a talent. In this story, the moment is 300,000 locked accounts; the sedimentation is that player identity is being pushed from the software layer down to the hardware layer.

That is what will reshape how an account is created, sold, inherited and trusted. The question I leave behind is not whether Riot should do this. The question is: when a publisher holds the law, the verdict and the counting house, who checks the count?