Riot Games locks nearly 300,000 League of Legends and VALORANT accounts for ranked cheating: The truth behind the shocking number

On September 14, 2026, Riot Games officially integrated its Vanguard anti-cheat system into the League of Legends client — a tool that had already been operating on VALORANT. Since that moment, nearly 300,000 accounts across both titles have been locked or penalized for rank manipulation. The number was officially disclosed this week, instantly becoming the focal point of the global esports community. But behind that shocking figure, what is actually happening is far more complex than most people realize. First, it is essential to understand the nature of the issue. Boosting — the practice of a highly skilled player logging into someone else's account to climb ranks on their behalf — is not simply a technical cheat in the conventional sense. It is a form of ranked-system manipulation in which the boosting provider charges the client to elevate their rank, thereby distorting the skill signals on the leaderboard. According to Phillip "mirageofpenguins" Koskinas, Riot Games' competitive integrity policy staff, boosting creates a chain of dangerous consequences: it undermines the reliability of the ranking system while forcing legitimate players to face opponents misaligned with their actual skill level. A concept Riot Games introduced in this enforcement wave is the "hitchhiker" — a player who uses their own account but queues alongside a boosted account. The noteworthy point is that these hitchhikers violate no software rules whatsoever — they play on their real accounts, genuinely competing. However, Riot Games states it will reclaim LP (League Points) they earned in games featuring a boosted account. This is precisely the most contentious aspect of the entire policy: a player can be penalized for conduct that was not their own, simply for playing with a friend. Regarding the scale of the numbers, placing 300,000 accounts against an estimated 140 million monthly players across both titles — with League of Legends accounting for approximately 120 million and VALORANT around 20 million — the proportion of accounts actioned is only about 0.2%. The absolute number is shocking, but the relative rate is quite modest. A crucial detail most current reports overlook: the 300,000 accounts were recorded within the period since September 2026 — meaning on a quarterly basis, not annually. If this pace is sustained, the annual figure could be substantially higher, yet Riot Games has not disclosed data on a cyclical basis. This is one of the notable information gaps in their report. A more serious issue lies in the verification of sources. All quantitative figures in Riot Games' announcement — 300,000 accounts actioned, 120 million League of Legends players, 20 million VALORANT players — originate from the enforcing party itself. There is no independent audit, no third-party verification, and no comparative data from previous periods. In the context of refereeing, this is equivalent to a referee who simultaneously writes the rules, officiates the match, and reads the match report — a governance structure that any serious analyst must acknowledge as a risk factor. Beyond account-penalty measures, Riot Games announced a roadmap for account-verification system improvements that, in the assessment of many experts, will have a far greater impact than the 300,000 lock orders. Specifically, the plan includes Multi-Factor Authentication (MFA), TPM 2.0 (Trusted Platform Module — a hardware security standard enabling device-level identity attestation), hardware authentication, and rank-differentiated verification requirements. In theory, TPM 2.0 will bind accounts to specific hardware devices, making the creation of "one-time" accounts significantly more difficult. This means that smurfing (playing on secondary accounts) and boosting will carry substantially higher costs in the future. However, a detail equally significant is that Riot Games affirms smurfing is not automatically deemed cheating. They enumerate eight cases where smurfing is considered legitimate, including protecting one's highest achievement on the main account, or simply trying out a new role. This is a boundary drawn based on intent and behavior, not on account count. The problem lies here: intent is extremely difficult to prove. A professional player using a secondary account to practice new champions may be entirely legitimate, but if that account is flagged for boosting indicators, the line between achievement protection and fraudulent smurfing becomes blurred. Professional clubs currently lack standardized policies for declaring secondary accounts for their players — an institutional risk that remains unresolved. Returning to the "hitchhiker" issue, Riot Games' stance on reclaiming LP from players who competed on their own accounts raises serious procedural questions. Not a single piece of information in the report discloses the false-positive rate of the hitchhiker-detection system, the appeal mechanism for those whose points were reclaimed, or the evidentiary standard used to classify a player as a "hitchhiker." This is a significant governance gap. In the esports landscape, where legal and regulatory frameworks are still forming, extending liability to third parties who violate no software rules without an independent oversight mechanism is a path the community needs to monitor closely. One commonly overlooked angle is the economic impact of enforcement. The economic driver behind boosting is not merely passion or simple greed — it is the income gap in the lower tiers of the esports labor pyramid. Players at the lower tiers are often paid very poorly or lack stable income, and boosting provides an alternative revenue stream. When enforcement intensifies, the operational cost of boosting services increases — not the demand or supply disappearing. In economic terms, this is the classic gray-market scenario: enforcement policy only raises service prices, not eliminates the service. Market observers can track this signal through boosting prices on intermediary platforms to confirm whether activity is being pushed further underground or simply repriced. One measure Riot Games deployed simultaneously with the account locks is LP protection — players will not lose ranked points in games where the system detects a hacker or a leaver. This is a small but practically significant change. Under the current ranking system, a loss due to a teammate being caught hacking or voluntarily leaving still costs teammates LP — creating a cumulative sense of injustice. Eliminating this penalty directly improves the player experience, and may generate a far more positive reaction than the 300,000 locked accounts. Long-term, if the TPM 2.0 verification system is fully deployed, the hardware-identity structure will set a precedent for the entire industry. Other publishers may adopt similar models, leading to "device-verified identity" becoming an industry standard. However, this also raises privacy concerns: anti-cheat operating at the kernel level — meaning at the core of the operating system, with extremely deep access to the user's machine — has already generated privacy controversies in the VALORANT community, and expanding its operational scope to League of Legends does not diminish those concerns. Another less discussed issue: many League of Legends players, particularly in Southeast Asia, use public computers or internet cafes — a TPM 2.0 model binding accounts to devices could create significant access barriers for this group. One unresolved variable is the divergence between Riot Games' global ecosystem and mainland China's version. League of Legends and VALORANT in the Chinese market are operated under Tencent's ecosystem, with localized anti-cheat and account-verification infrastructure distinct from the global Vanguard rollout. Whether the 300,000 locked accounts include, exclude, or are separable from the China server population remains unresolved. If the figures are global-ex-China, then the effective enforcement coverage rate against the stated 140 million player base is overstated, since a large share of League of Legends' monthly actives reside in the China ecosystem. This is a potentially significant denominator error. In summary, the figure of nearly 300,000 accounts locked is real, but the true significance of this enforcement wave lies in three points that current media coverage has not adequately explored. First, the strategic expansion of Vanguard's scope from software-cheat detection to ranked-system behavior control — this is a significant strategic shift in how Riot Games governs its platform. Second, the "hitchhiker" doctrine — reclaiming points from innocent players — raises questions about procedure, fairness, and accountability mechanisms that the community must demand transparent answers to. Third, the TPM 2.0 and hardware-authentication roadmap is a much larger structural change than the lock orders, yet it has not received proportionate attention. The question for the global esports community is not "Is 300,000 a big or small number?" — it is "When a publisher simultaneously holds the power to write rules, enforce rules, and publish rule-enforcement statistics, who oversees them?" The answer, currently, remains absent.