Nearly 300,000 ranked-cheating accounts locked: Riot delivers a verdict, but the official record is still missing its final page

In September 2026, when Vanguard — the kernel-level anti-cheat software long associated with VALORANT — was officially integrated into the League of Legends (LoL) client, the Southeast Asian gaming community split into two camps. The first welcomed what they considered a long-overdue crackdown. The second raised questions about the privacy implications of software that operates with deep access to the operating system. Four months later, a single number temporarily ended that debate: nearly 300,000 League of Legends and VALORANT accounts had been locked for ranked-system cheating. The figure of 300,000 sounds like a harsh verdict. Across forums, the word "cleanup" was used with visible excitement. But I — someone who has spent years documenting every referee decision in esports, from World Cup 2026 to regional qualifiers — look at this number with the caution of a match-recording secretary. Emotions may lean, but the footage does not. Context: This is not a balance patch First, the number must be placed in its proper context. Vanguard is not a champion-balance patch or a purely tactical change. This is a structural change: a kernel-level anti-cheat — previously exclusive to VALORANT since 2026 — has now become shared infrastructure for Riot Games' two largest titles. Previously, Vanguard focused only on detecting cheat software. Now, its role is expanding toward controlling ranked-system manipulation — including boosting, intentional deranking, and related behaviors. That is a meaningful shift: from fighting hacker tools to governing the conduct of the entire ranked ladder. The scale of the player base Riot is targeting is enormous. Independent estimates put League of Legends at roughly 120 million monthly players, VALORANT at around 20 million, for a combined total of about 140 million. The 300,000 accounts actioned therefore represents approximately 0.2% of the estimated monthly player base — a proportion so small that it hardly qualifies as a "cheating epidemic" in any statistical sense. This does not mean the enforcement is trivial. It means we are looking at a correct number while potentially misreading its weight. For someone who writes match records, separating the data presentation from the commentary is a mandatory rule. What the data says, and what the data does not say, are two entirely different matters. The original article noted the 0.2% ratio as a minor caveat — but that ratio is the most important figure in the entire release. There is also the timeline. Vanguard was integrated into LoL in September 2026. The disclosure of the 300,000 figure followed in late 2026. If so, this is likely a cumulative enforcement tally over less than one quarter — not an annual figure. When you read the record carefully, changing the denominator changes the intensity of the story entirely. The hitchhiker doctrine: a new liability standard without precedent The most consequential detail in the entire release is not the 300,000 number. It is a new governance doctrine Riot is establishing: the "hitchhiker" concept. Under Riot's definition, a hitchhiker is a player who uses their own account, plays legitimately, but queues together with an account being boosted — that is, an account that a higher-skilled player has logged into to raise its rank. Under the new policy, Riot asserts the right to revoke LP from hitchhikers in games involving boosted accounts, even when they have violated no software or conduct rule themselves. This is a significant expansion of liability-by-association into esports. From a governance perspective, it can be justified: the hitchhiker knows they are benefiting from an illegitimate transaction. But from a due-process perspective, this is the most sensitive point of the entire release. An innocent player can queue with a friend without knowing that friend has paid for boosting. Under the new doctrine, that innocent player — playing correctly on their own account, violating no software rule — can still lose LP. Riot published no false-positive rate. Riot described no appeals process. Riot released no figures on wrongly-revoked cases. I have witnessed some of the most controversial referee decisions at major tournaments: when a referee draws a red card based on a single camera angle, and then the appeals panel takes three days to review the full footage and overturns the ruling. In football, such a process exists. In Riot's new system, no such process exists in public documentation. And when an enforcement body is simultaneously the rule-maker, the enforcer, the sole data source, and the commercial beneficiary of enforcement, its silence about protective mechanisms becomes evidence in its own right. Smurfing: not automatically cheating The second part of the release will likely be the most contested in the community — not because it is harsh, but because it is unexpectedly lenient. Riot states clearly: smurfing — playing on secondary accounts at a rank below one's true skill — is not automatically considered cheating. Riot even enumerates eight legitimate smurfing use cases. These include: creating an alt account to protect one's highest achievement on the main account from the pressure of maintaining rank; practicing new champions or roles without affecting the main account's rank; reducing queue times in regions where high-rank queues are long; playing with friends of lower skill; experiencing the climb from the beginning again; content creators maintaining a separate play space; avoiding harassment at high ranks; and similar cases where no harmful intent exists. These eight cases send an important policy signal. Riot's enforcement boundary is not based on account count — it is based on intent and behavior. A player who smurfs for fun, to play with friends, or to practice, is in a safe zone. A player who smurfs to earn money via boosting or to intentionally destroy others' ranks is outside the safe zone. This is a deliberately soft boundary. And in any governance system, a soft boundary is always the hardest to enforce consistently. The gaming community — accustomed to the expectation that Riot would punish all smurfing — will have to recalibrate. This policy runs against the will of the majority, which is what I find interesting: it may be unpopular, but it acknowledges the complexity of player behavior in a way that many punishment systems do not. Riot spokesperson Phillip "mirageofpenguins" Koskinas was quoted on this issue. But the policy itself is clearer than any single quote: Riot is deliberately not waging a total war against smurfing, because smurfing is inherently tied to legitimate player needs. What they target is organized ranked manipulation — while players using alt accounts for personal reasons will be exempt. LP-loss protection: a small change with meaningful impact Alongside the punitive measures, the release introduced a player-experience change: when a cheater or a leaver is detected in a match, players on that team will not lose LP. This is a small technical change with significant psychological impact. In football, when a team is harmed by a wrong referee decision, there is no automatic points-compensation mechanism. In LoL, this LP-protection mechanism works like an automatic compensation rule: it acknowledges that some losses happen not because of player skill, but because the system was sabotaged by an external actor. Over the long run, LP protection reduces the variance of the climb. When unfair losses no longer cost points, LP over a large sample becomes a slightly more accurate skill signal. This is one of the rare changes where both players and publisher benefit. It generates no controversy; it simply makes the system fairer. The future verification regime: MFA, TPM 2.0, and two-tier citizenship The third part of the release, in my assessment, carries the greatest structural impact — yet receives the least attention. Riot announced plans to deploy MFA (multi-factor authentication), TPM 2.0 (Trusted Platform Module 2.0), and hardware authentication for accounts. The stated goal: making one-time throwaway accounts harder to create. This sounds technical, but it is essentially an identity policy: accounts will be bound to physical hardware on the player's machine. The most notable detail is that verification requirements will differ by rank. The higher a player's rank, the more stringent the identity checks they must pass. In governance terms, this creates a two-tier citizenship model within a platform: high-ranked players are first-class citizens; low-ranked players are second-class citizens. It can be justified on efficiency grounds — the higher the rank, the more severe the impact of cheating on ladder integrity. This is precisely where academy scouts and tier-two teams are watching. I have followed many transfer and scouting cycles in Southeast Asia. Teams at tier-two and academy levels still use ladder rank as a first-pass filter for new talent. If boosting corrupts the ladder signal, it corrupts the scouting process. Tightening verification at high ranks therefore has its own logic. But the equal-treatment question is unavoidable. This model is structurally analogous to tiered compliance regimes in traditional sport — for instance, whereabouts rules applying more heavily to elite athletes. In traditional sport, however, there is an independent arbitration system and a public appeals process. In the publisher-run esports ecosystem, those protective layers barely exist. And there is an unacknowledged side effect: binding accounts to hardware will structurally disadvantage players who use public computers, internet-café machines, or shared devices — a significant portion of the gaming population in many regions, including Southeast Asia. Is there an exemption for these cases? The release does not say. Based on my experience following matches and player ecosystems in this region, I can say that without exemptions, a segment of players will face access barriers they cannot control. The economics of boosting: enforcement does not eliminate the market Finally, the part most people overlook in this story: the economics of boosting. Boosting exists because of two fundamental supply-and-demand forces. On the demand side: players want high ranks for prestige, end-of-season rewards, or ego. On the supply side: highly skilled gamers — many of them semi-professional players or high-ranked players without stable income — are willing to sell rank-climbing services for money. This is a structural feature of the esports labor market: the bottom of the player pyramid is underpaid, and many seek supplemental income from gray-market services. When Riot tightens enforcement, the risk cost for boosting providers rises. They will raise prices to compensate. Boost prices rise, but demand and supply do not disappear. The gray market will reprice — not vanish. This is a classic outcome of supply-side enforcement in gray markets: enforcement succeeds in raising transaction costs, but it does not resolve the underlying motivations of supply and demand. This does not mean Riot is wrong to act. It means the 300,000 figure reflects an effort, not a final result. Industry observers should track not the number of banned accounts — but the price of boosting services on gray markets, and whether activity migrates to titles with looser enforcement. The regional question: what the 300,000 figure says and does not say One question I consider important, yet no article has raised it: does the 300,000 figure include the mainland China servers? League of Legends and VALORANT in mainland China operate inside the Tencent ecosystem, with localized anti-cheat and account-verification infrastructure distinct from the global Vanguard rollout. If the 300,000 figure is global-excluding-China, then the effective enforcement coverage rate — set against the 140 million denominator — needs to be reread: because a very large share of LoL's monthly active players sit inside the China ecosystem, the 0.2% ratio may overstate the actual coverage of this enforcement wave. This is not an accusation. It is an open question that anyone writing a match record must ask. And it reveals a structural problem in the industry itself: a publisher's global statistics typically do not include footnotes about regional operating scope. In football, when UEFA publishes disciplinary statistics, they are always broken down by competition and member association. Global esports still lacks such reporting standards. The contrarian view: the problem is not the punished cheaters Now let me swim against the crowd. Public opinion is praising Riot for cleaning up nearly 300,000 accounts. But referee data is not for condemning; it is for acquitting. If we apply the correct standard of a match record — examining all evidence before issuing a ruling — then the enforcement action itself generates more questions than answers. First, transparency mechanisms are entirely absent. There is no official false-positive rate. No public description of an appeals process. No independent audit of the 300,000 figure — all data comes from a single source, and that source is the enforcer itself. In football, when a referee shows a red card, the player can appeal to an independent panel. When Riot locks an account, what can the player do? The release does not answer. Second, the risk of power concentration. Riot now controls the entire vertical stack: game patches, tournaments, system-level access on player machines, and soon hardware-based identity attestation. In traditional sport, the rule-maker, the enforcer, and the commercial beneficiary sit in different organizations. In esports, they are one. That structure — not the 300,000 number — is the issue that needs monitoring. Third, a dangerous precedent: the "hitchhiker" term and the policy of revoking LP from legitimate players who queue with boosted accounts creates a doctrine of indirect liability that, over time, could extend to other conduct categories. If a player can be penalized for playing alongside a violating account, what is the next boundary? Playing with someone previously banned? Being friends with a frequently-reported player? An indirect-liability doctrine, without a clear appeals process, always carries the risk of scope creep. Fourth, there is a gap between audience emotion and statistical reality. The community sees 300,000 and concludes the ranked system just became extremely clean. But set against a denominator of 140 million monthly players, the 0.2% ratio suggests the ranked-cheating problem is far smaller than the impression forums create. I am not saying 300,000 accounts is trivial. I am saying we must read that number with the same precision we apply to any referee statistic: with verification, with a denominator, with a time window. What to track next What should we wait for in the coming quarter? Three signals, in order of importance. First: will Riot publish periodically? If the 300,000 figure is a one-off disclosure, we have no baseline to measure effectiveness. If Riot moves to periodic disclosure with trend lines, that would establish an integrity-reporting standard the entire industry can use — just as anti-doping organizations in traditional sport built their own reporting standards. Second: when will MFA and TPM 2.0 actually be deployed, and how specific will the rank-differentiated requirements be? At which rank threshold will formal verification begin? That will shape the experience of professional and semi-professional players — those maintaining both main and practice accounts. Professional clubs and academy teams should start standardizing account declaration and duo-queue hygiene policies, before an ambiguous case involving a pro player's alt account becomes a headline problem. Third: will there be a wave of backlash from wrongly-revoked hitchhiker cases? A single publicly visible error — even one — can generate more reputational pressure than the 300,000 account locks. The more automated the punishment system becomes, the more valuable a public appeals process becomes. A final match does not forgive carelessness, not even from the referee. In this governance chess game, Riot's next move will matter far more than the move we just witnessed. The 300,000 figure is a hard strike on the table. The real question is whether the system behind that strike — with audited error rates, a public appeals process, and fair exemptions — will be built to the same exacting standard. When you see a decision on the pitch, do not immediately ask whether it is right or wrong. Ask: what did the decision-maker see, and what did they not see? I learned that from 47 pages of my notebook. And with this case, the only thing I can say with certainty is: we have not yet seen the full footage. Every play is a line in the record, and I write none of them short — and Riot's record, as of this moment, still has many blank pages.