Riot Locks Nearly 300,000 League of Legends and VALORANT Accounts: When Vanguard Steps Onto the Ranked Ladder

On September 12, 2026, I opened the League of Legends client on an old computer in my apartment in Mapo-gu, Seoul. Vanguard was already there. No welcome dialog, no red text, no announcement. Just a background process running at the kernel level, quiet like a night-shift gatekeeper nobody introduced.

Three months later, Riot Games published the results of its enforcement sweep: nearly 300,000 League of Legends and VALORANT accounts locked. I read that notice on a Tuesday morning in my usual cafe in Hongdae, next to students replaying matches on their phones. What made me stop was not the number. What made me stop was a word Riot used for the group of players whose ranked points it was about to revoke: hitchhiker.

Every match is a chapter, and I am only turning pages. But this chapter is written in administrative language, not in teamfights.

To understand what is happening, two concepts that the Vietnamese community often merges into one must be separated.

Boosting is a high-skill player logging into someone else's account to raise that account's rank. It is a paid or arranged service relationship. League of Legends and VALORANT both classify boosting as a competitive-integrity violation.

Smurfing is a player opening a second account, usually below their true skill level. Riot states clearly that smurfing is not automatically treated as cheating. It enumerates eight legitimate use cases, including protecting one's highest achievement on a main account.

Between those two concepts sits the hitchhiker: a player using their own account, playing by the rules, but queuing alongside an account that is being boosted. Riot says it may revoke ranked points from that group.

Vanguard is an anti-cheat running at the operating-system kernel level, first deployed for VALORANT and integrated into League of Legends in September 2026. This is a system-level change, not a balance patch. No buffs, no nerfs, no tactical meta shift in this story.

The professional team context is almost absent. No organization is named. No player is suspended. The only individual quoted by name is Phillip mirageofpenguins Koskinas, a Riot Games staff member answering on smurfing policy.

It is worth remembering that Vanguard drew privacy controversy while it was exclusive to VALORANT, because the software runs at the highest privilege level of the operating system. Extending it to League of Legends means tens of millions of personal computers, including many at internet cafes in Korea and Vietnam, now carry an additional permanent process. The source article does not mention this.

So this is a platform-governance story, not a competitive-performance story.

The crux is that the ranked ladder is not a purely recreational playground — it is the selection system for the entire pipeline from amateur to professional. When an account is boosted to Challenger, the damage extends beyond the nine people in that match. It injects a false signal into the talent market.

Based on my experience following matches across multiple LCK seasons, I have watched academy scouts use the ladder as their first filter. They filter by tier, by win rate, by games played at high elo. If the top of the ladder is diluted by boosted accounts, that filter loses its value. The real cost is not borne by the player who loses points — it sits with the academy that signs someone whose profile looks impressive but whose actual level does not match.

Riot announced a mechanism I consider more important than the 300,000 figure: ranked-point protection when a cheater or a leaver is detected in your game. This changes the expected-value calculus of grinding the ladder. Previously, a loss caused by a boosted teammate was an unrecoverable cost. Now it is reimbursed. Over large samples, this compresses variance and makes ranked points a marginally more accurate skill signal.

The second mechanism is more structurally interesting: verification requirements may be applied differently depending on a player's rank. Riot has not published the specific threshold, but the direction is clear — the higher you climb, the stricter the checks. This is a tiered governance model, similar to how traditional sports apply whereabouts rules more heavily to elite athletes than to recreational ones. That threshold, once published, will land exactly in the zone that academies and tier-2 teams watch most.

The third mechanism is the one I follow most closely and the one least covered in reporting: planned multi-factor authentication, TPM 2.0, and hardware authentication. TPM 2.0 is a hardware security standard enabling identity attestation at the device level. Applied at scale, it binds an account to a physical machine. Riot's stated goal is blunt: make one-time accounts harder to create.

If all three mechanisms are fully deployed, they change the economics of accounts at a far deeper level than locking 300,000 accounts does.

On relative magnitude: market estimates put League of Legends at roughly 120 million monthly active players and VALORANT at roughly 20 million, about 140 million combined. Nearly 300,000 locked accounts equals roughly 0.2 percent. The source article itself concedes this ratio is relatively small.

Here is a point I want to state plainly. The 120 million and 20 million figures are attributed to no source at all. The 300,000 figure also comes from a single party — Riot Games itself, which sets the rules, enforces them, publishes the enforcement statistics, and benefits commercially from enforcement. There is no independent auditor. In traditional sport, a body that organizes the competition, catches the violations, and publishes its own catch rate would face immediate challenge. In esports, that structure is the default.

A detail about the time window is also skipped. Vanguard was integrated into League of Legends in September 2026. The nearly 300,000 figure is most likely a cumulative tally over roughly one quarter or less, not an annual figure. Annualized, the real intensity is substantially higher than the first impression suggests. The source article offers no prior-period comparison and no breakdown by title.

One more unresolved variable: League of Legends and VALORANT in mainland China operate within Tencent's ecosystem, with localized anti-cheat and account-verification infrastructure. Whether the 300,000 figure includes Chinese servers is unanswered. If it does not, the 140 million denominator is inflated and the 0.2 percent ratio is even smaller in reality.

There is a transmission channel rarely discussed. Many retired pros and streamers built channels on boosting content or on smurfing at low elo. If hardware attestation is applied, that content category loses ground, and verified high-elo content gains relative value. On the data-market side, a cleaner ladder makes rank-derived signals more trustworthy — but it also pushes boosting activity toward titles with weaker enforcement.

The most contestable element in the whole story is not the account bans but the hitchhiker doctrine — liability by association.

Riot is expanding its authority to revoke ranked points from players using their own accounts, violating no software rule, not hiring boosts, not sharing passwords. They merely queued with a friend the system identified as boosted. The source article contains no information on false-positive rates, no appeals process, and no evidentiary standard for classifying someone as a hitchhiker.

That silence is worth noticing. A system that strips privileges from 300,000 accounts without publishing an error rate places all the risk on the accused.

By contrast, Riot chose a soft line on smurfing. It does not ban secondary accounts. It enumerates eight legitimate uses. That means the enforcement boundary rests on intent and behavior, not account count. It is a humane choice, and also the hardest choice to enforce consistently. The same act — playing a second account at a lower tier — can be valid champion practice or bullying weaker players, depending on intent no system can read.

And there is an economic reality enforcement does not solve. The driver of the boosting market is the income gap at the bottom of the esports labor pyramid. Sellers are high-skill players who need money, often at semi-pro or tier-2 level, where pay is low and contracts are short. Buyers are players who want a prestigious rank, seasonal rewards, or bragging rights. Enforcement raises the risk premium but removes neither demand nor supply. The typical outcome of supply-side enforcement in gray markets is higher prices, not a vanished market.

I do not predict outcomes, I only read the story being written.

There is one more layer. Hardware attestation via TPM 2.0 means an account is bound to a machine. For players at home, that is trivial. For players at internet cafes — a significant share of the League of Legends population in many regions — it is a structural barrier. Users of old machines, shared machines, or rented machines may be pushed out of the system not because they cheated, but because they lack means. The source article does not mention this.

And when Riot is simultaneously the rule-maker, the enforcer, the sole data source, and the commercial beneficiary of enforcement, there is no independent arbitration layer in the ecosystem. That is a structural feature of publisher-run esports, and it is not raised in this story.

From the empty stands, I learned to write for myself first. And what I write for myself this time is a question to track, not a conclusion.

If Riot publishes enforcement data on a regular cadence, with trend lines over time, it may inadvertently establish an industry integrity-reporting standard — much as anti-doping rules shaped traditional sport. If it publishes once and goes quiet, the 300,000 figure will drift into oblivion like a marketing campaign.

And if TPM 2.0 is genuinely rolled out at scale, the esports story turns into a different chapter altogether: the chapter about identity. An empty stadium is never truly empty, if we know how to listen — but a system full of identity may be emptier than we think.