Riot Games Locks Nearly 300,000 League of Legends and VALORANT Accounts for Ranked Cheating

I still remember that September 2026 evening, sitting in my small Hamburg apartment, headphones plugged into my computer, watching a Diamond-ranked streamer. Not for highlight reels. I counted the hesitation before each champion lock-in. Three seconds. Four seconds. Five seconds. Someone else was playing with this person's hands. Viewers in chat began naming the figure behind the screen, and I understood I was witnessing what Riot Games calls boosting — not through terminology, but through the hand rhythm of a person who did not belong to that match. I am a rhythm keeper, not a judge. But the first beat is heard, not stepped. And my ears detected something drifting off-key in League of Legends ranked.

On November 12, 2026, Riot Games announced it had locked nearly 300,000 accounts across League of Legends and VALORANT since Vanguard — a kernel-level anti-cheat — was integrated into League of Legends in September 2026. VALORANT had long used Vanguard. The move converted Vanguard from a single-title protective tool into a platform-level governance layer for two titles.

Nearly 300,000 sounds enormous. Yet estimates put the two titles at roughly 140 million monthly active players combined — around 120 million for League of Legends and 20 million for VALORANT. The actioned accounts represent roughly 0.2%. Notable to anyone in the industry, but not a tidal wave.

One caveat: both the 300,000 figure and the 140 million figure originate from Riot Games. No third party has audited them. And a substantial share of League of Legends players sit within Tencent's mainland China ecosystem, which uses separate anti-cheat and account-verification infrastructure distinct from global Vanguard. Whether the 300,000 includes Chinese servers remains unanswered. If it does not, the actual ratio is smaller still.

I spent years observing training sessions at FC St. Pauli, learning to watch details that repeat hundreds of times rather than chase explosive moments. A coach never announces how many of his players cheat. He announces the squad list and lets others infer who was dropped. Riot Games does the opposite. They publish the number, publish the policy, and let the community interpret. But when the rule-maker is also the scorekeeper, interpretation needs another layer of data — one this announcement does not supply.

If you follow training sessions at St. Pauli as I do, you understand that a team operates on small rules. Substitutes run three extra laps after training. The left back always checks his shoulder before receiving the ball. Those rules are not written, but break them and you lose your place. Riot Games has just announced similar new rules for ranked.

The first is the hitchhiker. Riot's term for players who queue alongside a boosted account while using their own. They install no cheat software, share no passwords, violate no technical clause. But they may lose League Points (LP) for having played with a boosted account. This is the single largest change in the entire announcement: Riot is extending liability by association to technically legitimate players.

Pause on this detail. Historically, Riot sanctions targeted concrete conduct: shared accounts, tampered software, traded accounts. Hitchhiker is a new category — liability inferred from a relationship, not from direct action. A player can lose LP because their duo partner in some ranked match was not the true account owner. That player may not have known. That player may simply have been playing with a friend. No appeals process is described. No false-positive rate is published. At a scale of 300,000 accounts, this is a significant transparency gap.

The second is the smurfing policy. Riot states explicitly that smurfing is not automatically cheating. The company enumerates eight legitimate secondary-account use cases, including protecting one's highest achievement on a main account, practising a new role, or playing with lower-ranked friends. Phillip mirageofpenguins Koskinas, a Riot spokesperson, emphasised that Riot's boundary rests on intent and behaviour, not account count. This is a deliberately soft line. But soft lines are hard to enforce consistently — and that difficulty creates asymmetry between the banned figure and the real standard.

The third is the multi-layer verification plan. Riot intends to deploy multi-factor authentication (MFA), TPM 2.0 hardware security modules, and rank-differentiated verification requirements. The stated goal: make one-time accounts harder to create. If implemented, the cost of creating a new ranked account changes permanently.

And here is what most coverage skips. It focuses on 300,000. But 300,000 is a past figure. TPM 2.0 is a structural change for the future.

Riot is also rolling out LP-loss protection when a cheater or leaver is detected — a small detail with large meaning for player experience. When you are no longer docked points for bad luck, the expected value of each ranked match rises, and over time LP becomes a more accurate skill signal.

I once stood in the corridor of a tier-3 tournament venue in Berlin in 2026. No crowd. A young competitor sat alone after a loss, eyes still on a dark monitor. I did not interview him. I only counted how many times he placed his hands on the keyboard and withdrew them — seventeen times in four minutes. I do not analyse matches; I remember every face when the match ends. Sometimes the most fragile thing is not defeat, but the stretch after the screen goes dark.

Riot announced the sanctions in November 2026, with 300,000 accounts actioned in roughly one quarter since Vanguard's integration. Annualised, the real enforcement rate is higher than the headline suggests. The more important matter lies in the threshold for entering a ranked match, shifting from having an account to having hardware-bound identity. The ranked ladder has always been the scouting channel for the entire amateur-to-professional ecosystem. When ladder signals become more trustworthy, academies and tier-2 teams gain better evaluation tools. But if enforcement is uneven across regions, talent-identification quality will diverge by server.

What most coverage overlooks is TPM 2.0's long-term consequence. If Riot succeeds in binding accounts to physical devices, the cost of creating a new account spikes. Good for anti-cheat. But it creates another problem: internet-café players — a substantial share of the League of Legends community in many regions — will struggle because they use shared machines.

I have seen this in Hamburg. Small net cafés in student neighbourhoods where high-schoolers play League of Legends after class. If each account is bound to a device, those kids are pushed off the pitch, not because they cheat, but because they cannot afford their own computer.

And rank-tiered verification creates a two-tier system: higher ranks face stricter checks, lower ranks receive leniency. In governance terms, this makes sense. In fairness terms, it raises questions about digital citizenship in games.

The boosting market will not vanish. It will reprice. As risk cost rises, boosting service prices will rise, and some demand will migrate to titles with weaker enforcement. Riot may win a battle, but the war continues. And when the pitch is empty, I understand whom I keep rhythm for — players who never appear on a leaderboard, yet sit there every evening, waiting for a fair match. That is the signal I will track in the months ahead: whether Riot publishes periodic data and sets a transparency standard for the industry, or stops at a single announcement.