Nearly 300,000 League of Legends and VALORANT Accounts Locked: How Riot Is Rebuilding the Integrity Standard of the Ranked Ladder

On the night of October 22, 2026, news that Riot Games had locked nearly 300,000 League of Legends and VALORANT accounts for ranked cheating spread quickly through Southeast Asian community channels. I was sitting in front of my screen in Kuala Lumpur, reopening a personal tracking file of matches from September, when Vanguard was formally integrated into the League of Legends client. That scale is equivalent to the population of a provincial city in Vietnam. What kept me reading longer was a small line in the announcement: "hitchhikers" — accounts that played their own games and climbed on their own merit — could also lose ranked points simply for queuing alongside an account being boosted. It was the first time I had seen a publisher claim the right to punish based on association rather than on software behavior. The approach reminded me of VAR in football: a tool built to reduce error, which instead opened a new space for judgment, where the standard of "clear and obvious" becomes the most ambiguous thing on the pitch.

In esports, ranked cheating exists in three main forms. Boosting is a paid or arranged service in which a highly skilled player logs into another person's account to raise its rank. Smurfing is playing on a secondary account, usually at a lower rank than one's true skill. And "hitchhiker" is a concept Riot has newly written into policy: a player using their own account while queuing together with an account being boosted.

The technical context matters just as much. Vanguard is a kernel-level anti-cheat client, first deployed for VALORANT before being integrated into League of Legends in September 2026. Extending it to a second title turns a single-purpose tool into a platform governance layer. By estimates that have not been independently verified, League of Legends has roughly 120 million monthly players and VALORANT roughly 20 million, for a combined total of about 140 million. The original article itself calculates that 300,000 locked accounts represent only about 0.2% of that combined monthly player base.

What Riot did not provide was the time window. Measured from the September 2026 integration, 300,000 is a cumulative figure covering roughly one quarter or less, not a full year. Annualized, the enforcement run-rate would be substantially higher. The article also reports no reaction from the community, professional players, or independent critical experts — a notable omission for this type of news.

The core of the story sits in governance structure, not in the number of rulings. Riot is making three changes at once, and they carry very different weight.

The first change is the hitchhiker doctrine: Riot claims the right to revoke ranked points from players who used their own accounts and broke no software rule whatsoever. This is a standard of liability by association, expanding punishment beyond direct conduct. In traditional legal systems, liability by association always comes with requirements to prove intent and awareness. Here, the text does not specify the evidentiary standard used to classify someone as a "hitchhiker." The risk of false positives against players who unknowingly queue with a friend is real.

The second change is the hardware-verification roadmap: MFA, TPM 2.0, and device attestation, with requirements differentiated by rank. TPM 2.0 is a hardware security standard that enables identity attestation at the device level. Once an account is bound to a specific machine, the cost of creating a one-time account rises sharply. Based on my own experience tracking the account market, this is the larger change, far bigger than locking 300,000 accounts. It also touches legitimate players using shared machines at internet cafés, a large player group across Southeast Asia.

The third change is the tiering of requirements by rank. If verification requirements apply more strictly at higher tiers, Riot is operating a two-tier citizenship model within a single ladder. This makes economic sense — the higher the rank, the greater the incentive for exploitation — but it raises an equal-treatment question. In traditional sport, whereabouts rules also apply more heavily to elite athletes, so the model is not entirely new.

Alongside these, a detail that is easy to overlook carries high practical value: loss protection for ranked points when a cheater or a leaver is detected. This mechanism reduces the penalty for unlucky games, compresses variance, and makes ranked points a marginally more accurate skill signal over large samples. It is a low-cost, high-visibility change, yet it has received far less coverage than the 300,000 figure.

One further point: Riot states clearly that smurfing is not automatically treated as cheating, and lists a range of legitimate use cases, including protecting one's highest achievement on a main account. Riot's enforcement boundary is therefore drawn by intent and behavior, rather than by account count. This is a soft line, and soft lines are always the hardest to enforce consistently.

From the vantage point of someone who has competed and organized tournaments, I see the ranked ladder functioning as the de facto qualification system for the entire amateur-to-professional pipeline. Boosting corrodes the credibility of ladder-derived scouting signals, not merely the experience of casual players. When an academy recruits on rank, every boosted account is a poisoned data point in the talent-identification system. On the publisher side, Riot is absorbing the engineering and infrastructure cost of device-level authentication across two titles — a capital expenditure in platform integrity, justified by retention economics: players who are cheated leave, and churn directly erodes the monetization base of a free-to-play model.

The contrarian angle is that the biggest risk in this story is not cheating, but enforcement design. Across the source material, there is no false-positive rate, no description of an appeals mechanism, and no independent audit of the 300,000 figure. Every quantitative claim originates from the enforcing party itself. Riot is simultaneously the rule-maker, the enforcer, the data source, and the commercial beneficiary of enforcement. There is no independent arbitration layer in this structure. That is an inherent conflict of interest in publisher-run esports, and the source material does not address it.

Economically, enforcement raises the cost of boosting but does not remove demand for prestige rank or rewards, nor does it remove the supply of highly skilled players who need income. The standard outcome of supply-side enforcement in a gray market is repricing, not elimination. Boost prices are likely to rise. If other titles enforce more softly, the service flow will simply migrate there. One unresolved variable: League of Legends and VALORANT in mainland China operate inside Tencent's ecosystem, with distinct localized anti-cheat and account-verification infrastructure. Whether the 300,000 figure includes the China servers is an open question, and if it does not, the 0.2% ratio above is computed against the wrong denominator.

What is worth tracking over the next six to eighteen months is not the next batch of locked accounts, but the moment Riot publishes details on MFA, TPM 2.0, and the rank thresholds at which stricter verification applies. If that roadmap rolls out as described, the cost of owning an identity in League of Legends will change at a foundational level. The entire industry will have to answer a question it has never faced: whether a game account remains something anyone can recreate at will, or has become a hardware-bound form of identity that cannot be replaced with a few clicks.