Nearly 300,000 League of Legends and VALORANT Accounts Locked: Riot Is Tightening From Software All the Way to Hardware

Nearly 300,000 League of Legends and VALORANT Accounts Locked: Riot Is Tightening From Software All the Way to Hardware

On a Saturday night I was sitting in an internet café on Pham Ngoc Thach Street in Binh Duong. Machine number 14. A boy of maybe seventeen, headset slung around his neck, was retyping his password for the fourth time. The screen showed a single line: account locked. He turned to me — the only person in that row who looked older — and asked a question I could not answer: "Hey, is Vanguard a virus?"

I could not answer because I had just finished reading Riot Games' announcement. Nearly 300,000 League of Legends and VALORANT accounts had been actioned for ranked cheating. Three hundred thousand names erased from the ladder. Read casually, it sounds like a purge.

But when I pulled out my laptop and did the division, those 300,000 accounts amount to roughly 0.2% of the combined monthly player base of the two titles. One fifth of one percent. Picture a 50,000-seat stadium, and exactly one hundred people escorted out.

Three hundred thousand locked accounts are only the visible part. What Riot is installing inside that boy's hard drive is the submerged part.

Context: from an anti-cheat tool to a platform governance layer

Vanguard is not a new name. It is the kernel-level anti-cheat software Riot Games built for VALORANT years ago. Its defining feature is simple: it does not live inside the game, it lives inside your machine. It starts with Windows, it holds deeper system access than almost anything else you have installed, and it runs even when the game is closed.

The significant detail is that in September 2026, Riot integrated Vanguard into League of Legends itself. For a title that has lived more than fifteen years and holds the largest player community in Riot's catalogue, injecting kernel-level software is a system-level change, not a balance patch.

Alongside that, Riot announced enforcement against nearly 300,000 accounts across League of Legends and VALORANT. The violation categories were named clearly: boosting — where a highly skilled player logs into someone else's account to climb the ladder; "hitchhikers" — players using their own accounts but queuing together with an account being boosted; and multi-account abuse. For repeat offenders, Riot was explicit: not only the alt account is actioned, the main account can be suspended too.

On market scale, the figures cited are roughly 120 million monthly League of Legends players, about 20 million for VALORANT, and around 140 million combined. It must be said immediately: none of those numbers is tied to an independent source. They appear as estimates.

One easily overlooked detail is also the brightest point of the whole crackdown: when the system detects a cheater or a leaver in a match, clean players do not lose League Points. It sounds small, but it is the most valuable change for ordinary players.

I came to esports by a roundabout road. Since football went dormant, I learned to dream in data. In 2026, empty stadiums, empty commentary booths, I sat on Zoom commentating FIFA Online 4 matches with colleagues as if they were real. Those sessions taught me one thing: when the crowd is gone, when nobody is watching, everything runs on a different rulebook — and that rulebook is usually written by whoever owns the system, not by the players.

What is actually happening inside those 300,000 erased names

Start with the time window, because it changes how the whole story reads.

Vanguard arrived in League of Legends in September 2026. If this enforcement wave is the cumulative result since that date, then 300,000 accounts is not a year's work — it is roughly a quarter's work. Put differently, if that pace holds, the annual figure would be considerably higher. That is my inference, not something Riot published. But the way they declined to state the window is exactly how a press release reads better than its substance.

Second, and more important: the denominator.

League of Legends and VALORANT in mainland China operate inside the Tencent ecosystem, with localized anti-cheat and account-verification infrastructure distinct from global Vanguard. Whether those 300,000 accounts include China servers, I have no answer from the source material. If they are excluded, the 0.2% figure is miscalculated — because a very large share of monthly League of Legends players sits inside that ecosystem. And when the denominator is wrong, every conclusion drawn from it is wrong in turn.

Third, the power structure.

Riot is simultaneously the rule-maker, the enforcement body, the publisher of enforcement statistics, and the commercial beneficiary of enforcement. There is no independent arbitration layer in between. For someone in my trade, this is the most sensitive point — not because Riot is doing wrong, but because nobody can verify that they are doing right. I do not recite numbers, I tell stories with numbers — and sometimes the story is better than the numbers.

Fourth, and this is the element I consider most shocking in the entire announcement: the hitchhiker doctrine.

Riot asserted the right to revoke ranked points from players who used their own accounts, did not touch any software, did not boost anyone — who simply queued alongside a friend being boosted. Put plainly: this is an expansion of liability by association. You broke no rule, but you are punished for sitting next to someone who did.

In any legal system, this is the hardest category to enforce fairly. The problem is how to distinguish someone who unknowingly queued with a booster from someone knowingly hitching a ride. Answering that requires an evidentiary standard, a false-positive rate, and an appeals process. Riot's announcement names none of the three. For an enforcement wave touching 300,000 accounts, that silence is a material transparency gap.

Fifth, and this is where the community misreads most: smurfing.

Riot stated clearly that playing on a secondary account is not automatically cheating. They enumerated a set of legitimate uses, including protecting one's highest achievement on a main account. That means Riot's enforcement boundary is intent-based and behavioural, not account-count-based. That is a soft line, and soft lines are the hardest to enforce consistently.

In Vietnam, I have watched this play out in League of Legends communities. A portion of veteran players keep two accounts: one for serious climbing, one for playing with friends or testing new champions. They make no money from it. When Riot says verification may be applied differently depending on rank, those players sit right against the line.

Sixth, and this is the part that genuinely matters, buried at the end of the announcement: the future verification regime.

Riot mentioned multi-factor authentication, the TPM 2.0 standard — a hardware-level security specification — and the goal of making "one-time" accounts harder to create. On top of that, verification requirements may differ by rank.

Translated into ordinary language: your account may become bound to the specific machine you are using. To create a new account and evade a ban, you would need to change computers, not just email addresses. If that materializes, it fundamentally changes the economics of account creation in League of Legends and VALORANT.

And it creates a very Vietnamese problem.

In our country, a significant share of League of Legends players reach the game through internet cafés. Shared machines. Low specifications are common. Peripheral software is varied, and much of it conflicts with kernel-level anti-cheat. If hardware attestation is applied, players on shared, old, or rented machines will face a structural disadvantage — and they are the most vulnerable group in the community, not the paid boosters. Riot has said not one word about them.

Seventh, the economics of the boosting market.

I will construct a hypothetical, and I stress: this is a hypothetical I built myself, not information from Riot. Suppose there is a Challenger-level player who once competed in semi-pro qualifiers and never signed a contract. Boosting income may exceed his competitive income. For him, 300,000 locked accounts is not a warning — it is a price change. Supply is squeezed, service prices rise, and he still has customers, because demand does not disappear.

But strike that assumption immediately, exactly as it deserves to be struck: Riot has published no data on the boosting market, on pricing, or on players migrating to other titles. Everything above is a thought exercise, not a forecast. I wrote it only to show one thing: banning a behaviour does not erase the behaviour, it only makes it more expensive.

And demand has very concrete reasons — ranked borders, seasonal rewards, and above all prestige in the eyes of friends. None of those things gets locked with an account.

Eighth, the talent identification pipeline.

This is where the story leaves the casual player behind. The ranked ladder is not merely a place to climb for fun. It is the de facto selection system for the entire amateur-to-professional pipeline. Academies, semi-pro teams, scouts — they all filter candidates there.

If boosting corrupts the ladder's signal, it does not merely ruin the experience for casual players. It corrupts talent identification. From that angle, Riot enforcing hardest at the highest ranks — where scouting happens — is a defensible decision. But it also produces an immediate consequence: the visible high-elo population may contract in the short term, temporarily distorting rank distribution and MMR calibration.

If enforcement intensity differs between servers, talent identification quality diverges between servers. And where there is divergence, traffic flows to the softer side.

Ninth, back to the bright spot: LP protection.

When you lose a match because a teammate left or a cheater was in the game, you lose no LP. Technically, this compresses the variance of the climbing process. Over a large sample, ranked points become a marginally more accurate skill signal. This is the quietest change and probably the one that improves player sentiment more than locking 300,000 accounts ever will.

Where I might be wrong

I have been wrong in the loudest possible way before.

In 2026, before the World Cup final, I wrote that Messi should not be given the Ballon d'Or, based on data about his failed duels in the group stage. An entire nation called me a traitor. Then Messi won the tournament, and I had to write a self-correction. That piece reached half a million views — the highest of my career.

The day I mispronounced a player's name, the country remembered me longer than it remembered the match. I learned that a mistake handled with grace generates a bigger wave than a victory. So this time, I will state my possible errors up front.

If 0.2% is accurate and stable across years, then all my anxiety about a "cheating epidemic" is inflated. One fifth of one percent is not a crisis. Perhaps Riot is correctly addressing a small problem, and the noise comes only from how it was packaged for the press.

If TPM 2.0 remains a test and is never broadly deployed, then most of this article is about a future that does not arrive.

And if Riot's real driver is retention — because players who get cheated against quit, and quitting means lost revenue in a free-to-play model — then their motive is entirely sound commercially. I do not object to that. I only want it said out loud.

One second on live broadcast is enough to burn ten years of composure. But a well-written press release is also enough to make people forget whose press release they are reading.

What I will be tracking

Over the next six to eighteen months, four things will tell us whether this crackdown is a turning point or just a news cycle.

First, whether Riot publishes enforcement data periodically. If it does, it is establishing an integrity-reporting standard for the industry — the way anti-doping reporting shaped traditional sport. If it publishes once and goes quiet, this was a communications campaign.

Second, boosting prices. If supply is genuinely squeezed, prices must rise. If prices hold, the market has found a detour.

Third, the fate of internet café players. If hardware attestation is deployed without an exception for shared machines, we will have a tier of players pushed out of the system for reasons other than cheating.

Fourth, other titles. Boosting is a trade, and trades migrate. As League of Legends and VALORANT become harder to breathe in, traffic will flow to wherever enforcement is lighter.

The biggest comeback never happens on the pitch; it happens in the commentary booth. This time, the comeback happens inside the hard drive.

The question I leave behind, and I genuinely want an answer from policymakers rather than fans: when an account is bound to hardware, and a veteran player of fifteen years shares a machine with his younger brother, and the younger brother violates the rules — who gets locked out?