Nearly 300,000 LoL and VALORANT accounts locked: Riot expands its anti-cheat war

When Riot Games announced nearly 300,000 accounts locked for ranked cheating in LoL and VALORANT, I didn't take the number at face value. As a data analyst, I started with a spreadsheet. This figure, within an estimated 140 million monthly active players, is only 0.2%. But the key isn't the ratio—it's how Riot reached that number: Vanguard, the kernel-level anti-cheat, has been integrated into LoL since September 2026, and its scope is expanding from software-cheat detection to controlling behavior in the ranked system. My first xG spreadsheet taught me that every goal has a hidden story; here, 300,000 accounts is the story of a persistent war. Vanguard is not a new concept. It has been active in VALORANT since launch, known for its kernel access to detect cheats. Bringing it into LoL marks a turning point: Riot no longer treats anti-cheat as a per-game feature, but as a shared infrastructure layer. In their statement, Riot says they want to improve player experience and limit negative impacts. But reading the policies closely, they are targeting three specific behaviors: boosting (a high-skill player logging into another's account), hitchhiking (playing on your own account while queuing with a boosted one), and smurfing (playing on secondary accounts). Riot confirms smurfing is not automatically cheating, listing eight legitimate cases, including protecting one's highest achievement on a main account. This is a soft boundary, based on intent and behavior, and I think it will be hard to enforce consistently. The most striking point is how Riot handles 'hitchhikers.' They can revoke ranked points from players who used their own accounts, even without violating any software rule. This is a liability-by-association standard. From my data on other enforcement systems, such rules often create false positives, and no appeals mechanism or error rate has been published. This is especially risky for players who accidentally queue with a friend being boosted—they can lose LP with no way to prove innocence. Riot also plans to deploy MFA, TPM 2.0, and hardware authentication, with requirements varying by rank. The goal is to make 'one-time' accounts harder to create. If realized, this would fundamentally change the cost of account creation, not just for cheaters but for new players as well. With years of experience tracking matches and ranked systems, I see the biggest impact not in the 300,000 figure, but in Riot's foundation for hardware-bound identity. TPM 2.0 would bind accounts to devices, making evasion costly. This is similar to my home-advantage analysis: when crowds are present, it creates a small but stable edge. Similarly, hardware authentication will create an invisible barrier for players using internet cafés or shared machines, a large segment in some regions. This is a downside Riot did not mention in its official announcement. In esports, the ranked ladder is the primary talent source for academies and young teams. If boosted accounts appear at high ranks, they corrupt the signal scouts rely on. Tightening enforcement could improve data quality. But if enforcement is uneven across regions, scouting quality will diverge. I once wrote about how defensive data can predict upsets; similarly, this shift may affect teams that rely on ladder rankings for player discovery. Contrary to the common feeling that 300,000 is huge, I think it is quite small relative to the system's scale. The 0.2% ratio suggests Riot is not in a massive purge; they are targeting systematic behaviors like boosting, where one account can serve many. But the question is: does locking accounts solve the root cause? My gray-market data shows that when a system is tightened, it doesn't disappear—it moves. Boosting prices may rise, providers will find ways to evade, and part of the activity may migrate to titles with weaker enforcement. This is an arms race, not a one-time solution. Looking ahead, the most important change is not the number of locked accounts, but Riot's move toward hardware authentication. If implemented, it will redefine what 'a player' means. Is an account still your own if it's tied to a machine? That's the question that will shape the debate for seasons to come. Every dataset is a scripture, and I am a slow reader. I will follow Riot's deployment and whether they publish periodic data to measure enforcement effectiveness.