Riot locks nearly 300,000 League of Legends and VALORANT accounts: the ranked purge and the forgotten 0.2%

Two lines sit next to each other in the summary Riot Games published after Vanguard was integrated into the League of Legends client in September 2026. The first line records nearly 300,000 accounts actioned across League of Legends and VALORANT. The second line records the matching ratio: roughly 0.2% of an estimated 140 million monthly players. I read the first line three times and the second line seven times. Some matches the naked eye cannot see have to be told by the numbers, and here the numbers are telling a different story than the headline the community is sharing. Three hundred thousand is a large figure by reflex. Placed against 140 million monthly players, it shrinks to two parts in a thousand. That ratio does not say cheating is absent. It says the way we measure cheating has a problem, and the way Riot is widening its definition of cheating is the part worth tracking over the next twelve months. This is a platform-governance and competitive-integrity story, not a performance story. Vanguard is a kernel-level anti-cheat client, first deployed for VALORANT and integrated into the League of Legends client in September 2026. That expansion turns a single-title tool into a shared governance layer across two products, and that is a structural change rather than a balance change. The accounts actioned are not only users of cheat software. Riot describes three behaviour classes. The first is the booster: a highly skilled player who logs into another person's account to climb ranks, usually as a paid transaction. The second is the boosted account. The third is the hitchhiker, Riot's term for a player who uses their own account but queues together with an account being boosted. For outsiders, boosting sounds like a small community scandal. For the industry, it is infrastructure. The ranked ladder is the amateur competitive structure that underpins the entire pipeline from grassroots players to academy rosters. Academies and tier-2 teams use ladder rank as their first screening filter, long before any tryout. When accounts at the top of the ladder can be bought, that filter loses its measurement value. I started treating statistical tables as datasets in 2026, sitting beside youth matches in Seoul with a notebook, recording passes one by one. In 2026, when global football stopped, I spent the time computing PPDA for every K League team and learned a principle I still use: a metric only means something when it comes with a sample size and a time window. Based on my experience tracking rank distributions on the Korean server across several seasons, one thing the headline fails to transmit is that an enforcement wave is not measured in absolute numbers. It is measured in accumulation window and in the denominator used to divide. Here the denominator is weak. The 140 million monthly players figure is assembled from two estimates: roughly 120 million for League of Legends and roughly 20 million for VALORANT. Neither carries a source in the source material, appearing only as general estimates. Spreadsheets do not lie, but readers have to learn how to listen. A ratio computed from an unsourced denominator has directional value only, not audit value. The 0.2% should therefore be read as a relative magnitude, not an audited report. The time window is also unset. The September 2026 Vanguard integration supports one inference: nearly 300,000 is a cumulative figure over roughly a quarter or less, not an annual figure. Annualised, the run-rate would be substantially higher than the headline implies. Extrapolation is also error-prone, because enforcement intensity typically decays after the first phase once easil-detectable accounts have been cleared. I mark confidence here as medium, and the underlying assumption as constant enforcement intensity across quarters. Behaviour classification carries the highest analytical value. The three groups do not bear equal damage. Boosters risk their main accounts, multiple alt accounts, and repeat-offender flags. Boosted accounts lose climbed rank and seasonal rewards. Hitchhikers lose ranked points earned in affected games but keep their account standing. These three levels form a liability ladder that Riot is drawing without a published comparison table. The LP-protection mechanic is the quietest change but it touches player expectations directly. When a game is detected to contain a cheater or a leaver, players on the losing side do not lose ranked points for that game. Statistically, this compresses the variance of a climbing streak. Over a large sample, ranked points become a marginally more accurate skill signal, because less noise comes from uncontrollable games. This is the kind of design change players feel immediately but that is hard to prove with data, because nobody publishes the share of affected games. Smurfing is stated clearly, and this is the most misunderstood detail in community discussion. Riot asserts that playing on a secondary account is not automatically treated as cheating. They enumerate eight legitimate uses for secondary accounts, including protecting a highest achievement on a main account and practising off-pool champions or roles. Phillip Koskinas, a Riot Games staff member, is the quoted voice on this point. The enforcement boundary therefore sits on intent and behaviour, not on account count. That is a soft line, and soft lines are the hardest to enforce consistently. The most significant part of the story sits in the future, not in the ban wave. Riot discusses multi-factor authentication, TPM 2.0, hardware authentication, and requirements that may be applied differently depending on player rank. The stated goal is to make one-time accounts harder to create. If this reaches user machines, accounts become bound to physical hardware and the cost of creating a new identity rises sharply. A stray number can be a truth hiding where nobody looks, and here the stray number is the 0.2% while the hidden truth is hardware-bound identity. One denominator gap remains unaddressed. League of Legends and VALORANT in mainland China operate inside Tencent's ecosystem, with anti-cheat and account-verification infrastructure distinct from the global Vanguard rollout. The source material does not say whether the nearly 300,000 figure includes, excludes, or is separable from the China server population. If the enforcement figure is global-ex-China, then effective coverage against a 140 million base is overstated further, since a large share of League of Legends monthly actives sit in that ecosystem. This is a potential denominator error, flagged as an open question rather than a claim. The most contestable clause in the whole action is not the punishment for boosters. It is hitchhiker liability by association. Riot is asserting the authority to revoke ranked points from players using their own accounts, breaking no software rule, purely because they queued with a friend being boosted. That standard extends enforcement to third parties and raises an evidentiary question. How do you separate an innocent queue partner from a willing beneficiary? The source material supplies no evidentiary standard. The larger gap sits in the appeal mechanism. There is no false-positive data, no appeals-process description, and no independent verification of the 300,000 figure. For an action of that scale, the absence of all three is a weighty transparency gap. In any other governance system, an entity that makes the rules, enforces them, supplies the enforcement statistics, and commercially benefits from enforcement would be required to maintain an independent arbitration layer. Riot simultaneously holds patch control, tournament control, client-level system access, and soon hardware-level identity attestation. This is the most complete vertical stack in esports governance today. Hardware attestation also creates a two-tier player model. Rank-differentiated requirements concentrate enforcement cost at the top of the ladder, where scouting and semi-pro visibility occur. Logically this is defensible, much as whereabouts rules apply more heavily to elite athletes in traditional sport. It also creates an equal-treatment question and engages data-privacy regulation in some jurisdictions. Players on shared machines or internet-cafe hardware, a large group in some regions, will face a structural disadvantage once accounts are bound to devices. The source material does not mention them. The gray market will most likely reprice rather than disappear. Demand behind boosting comes from rank prestige, seasonal rewards, and ego, while supply comes from the income gap at the lower tiers of the esports labour pyramid. Enforcement raises the risk premium for suppliers, pushes service prices up, but removes neither demand nor supply. The familiar outcome of every supply-side enforcement wave in a gray market is that per-transaction revenue rises for the few operators who survive. If one server enforces more softly, boosting activity may migrate there, the way account trading concentrates in low-enforcement regions. For the talent pipeline, the transmission direction is clearer but takes time. If ladder integrity improves and is sustained, scouting signals drawn from rank become more trustworthy and academies gain a cleaner filter. Tier-2 teams that rely on ladder ranking as a first-pass screen may have to reduce its weight and increase the weight of scrim and minor-tournament evidence. Based on my experience tracking matches and datasets, this is the kind of adjustment youth recruitment departments are slowest to make, because they have built their processes around a single metric for years. A secondary risk touches professional players directly. Many pros maintain separate accounts for champion or role practice, and this group is named as having legitimate uses. It also sits right on the enforcement boundary. A duo queue between two professionals, where one account is flagged, is enough to generate a bad headline for a club even when nobody broke a software rule. Clubs have no standard practice for account declaration and duo-queue hygiene, and that is an internal governance gap worth patching before an incident. They told a girl not to talk tactics, so I drew charts instead. The same principle applies here. When an enforcement wave is announced, the right question is not whether it is large or small, but which denominator is being used, which time window is being counted, and who is the independent verifier. For this story, the answers are: an unsourced denominator, an undisclosed window, and no independent verification layer. Signals to track in the next cycle sit at four points. The publication cadence of enforcement data, to establish whether this is a one-off disclosure or the start of periodic reporting. The actual rollout of TPM 2.0 and hardware attestation onto user machines, because that is the real structural change. The specific rank threshold in tiered verification requirements, because the threshold determines how concrete the two-tier model becomes. And the rank distribution at the top of the ladder after each enforcement wave, because clearing accounts at high elo can temporarily distort percentile distributions and affect hidden skill-rating calibration. What I will do next is simple. I will build a weekly rank-distribution tracker on the Korean server, benchmark it against September 2026, and log every new Riot disclosure. If the cadence becomes periodic, the industry gains its first integrity-reporting standard, similar to how anti-doping reporting norms formed in traditional sport. If it stays a one-off, this story closes within weeks, while the thing that truly changes how tens of millions play will pass quietly inside a patch note nobody reads closely.