When Vanguard Outgrew Anti-Cheat, Riot Games Locked Nearly 300,000 Ranked Accounts

In a ranked match at two in the morning, I sat in front of my screen and watched the LP number tick upward after a teamfight I did not understand winning. My opponent, an anonymous name with a 78 percent win rate across his last thirty games, vanished from the lobby like a ghost leaving no trace. Three months later, that account no longer existed. I did not know what had happened to it, until the number nearly 300,000 appeared.

That is not the number of a pure anti-cheat crackdown. It is the number Riot Games published in a competitive-integrity notice, after integrating Vanguard — the kernel-level anti-cheat system already familiar inside VALORANT — into League of Legends beginning in September 2026. Nearly 300,000 accounts locked across both titles. But when the ratio was computed, the source itself acknowledged that the figure accounted for only about 0.2 percent of the estimated combined monthly player base.

This is where the story becomes more interesting than a headline.

Context: A System Expanding Its Own Power

Vanguard was born alongside VALORANT, carrying the mission of detecting cheat software at the deepest level a game client can reach. Its migration into League of Legends is not a balance patch, nor a tactical meta change. It is a system-level change: the way the League client behaves on user machines is being reshaped. And according to the notice, Vanguard's remit is expanding from purely detecting cheat software toward controlling ranked-system manipulation behavior.

That is a meaningful shift. When you defeat a cheat tool, you fight something outside the rules. When you move into controlling ranked-system manipulation, you intervene in how humans interact with the system — and there, the border between a genuine offender and someone dragged along begins to blur.

Three concepts need to be named correctly here. First is boosting: a high-skilled player logs into another person's account to lift that account's rank. Second is smurfing: playing on a secondary account, usually at a rank below true skill. Third, and this is the most notable part, is the hitchhiker: a player using their own account but queuing together with an account that is being boosted. Under the new policy, this person may have their ranked points revoked, even though they violated no software rule themselves.

This is what I call liability-by-association. And it is one of the most contested elements in this entire story.

Core Analysis: The Number, the Ratio, and the Trap of Absolute Magnitudes

When someone tells you that nearly 300,000 accounts have been locked, your brain processes it as a large-scale catastrophe. But the 0.2 percent ratio places that number in its proper position. If the estimate is about 120 million monthly League of Legends players and about 20 million VALORANT players, the combined figure is roughly 140 million monthly users. Three hundred thousand divided by one hundred forty million is about 0.2 percent. Notably, both of those estimates are not attached to any specific source — they appear as floating assumptions, without independent verification. This is a provenance weakness any serious report must acknowledge.

But wait. There is a timing detail that receives little attention. The Vanguard integration into League of Legends occurred in September 2026. If the nearly 300,000 figure is cumulative from that point onward, then it is not an annual figure, but one covering roughly a quarter or less. That completely changes how the intensity of the enforcement should be read. Annualized, the real run-rate would be substantially higher. This is a weak but important signal — and in my experience tracking enforcement waves, numbers not framed by time are usually misread in both directions.

The second thing worth analyzing is the distinction between smurfing and boosting. Riot states clearly that smurfing is not automatically deemed cheating. They enumerate eight cases of secondary-account use considered legitimate — including protecting one's highest achievement on the main account. This means Riot's enforcement boundary is intent-based and behavioral, not account-count-based. That is a deliberately soft line, and precisely because it is soft, it will be hard to enforce consistently.

Meanwhile, the LP protection mechanic when a cheater or a mid-game leaver is detected is a change with greater impact than its appearance suggests. It changes the expected-value calculus of ranked grinding: players are punished less for unlucky games, making LP a marginally more accurate skill signal over large samples. This is one of the least-discussed but practically most valuable points for ordinary players.

Contrarian Angle: The Real Story Is Not the Account-Lock Number

If you only read the headline, you would think this story is about Riot cleaning up the ranked ladder. But the real story lies in a final passage of the notice, mentioning multi-factor authentication, TPM 2.0, and hardware authentication, alongside the goal of making "one-time" account creation harder.

This is the game-changing shift.

TPM 2.0 is a hardware security standard enabling device-level identity attestation. When you bind an account to physical hardware, you do not merely change anti-cheat. You change the economics of account creation. I have observed more than once how hardware verification measures create unintended consequences: players on shared computers, internet cafes, or older devices become structurally disadvantaged. This is an equity and privacy issue the notice does not mention.

At the same time, verification requirements are said to be applicable differently depending on a player's rank. In other words, the higher you climb, the more your identity is scrutinized. In governance terms, this is defensible — stakes at the top are far higher. But it also creates a two-tier citizenship model within the player base, and that is exactly the kind of discretionary rulemaking the notice itself seems unwilling to dissect.

There is a deeper structural issue too. Riot is simultaneously the rule-maker, the enforcement body, the sole data source for enforcement statistics, and the commercial beneficiary of that enforcement. There is no independent arbitration layer. This is an inherent conflict of interest in the publisher-run esports model, and it is not acknowledged in the source material. Across the entire document, there is no false-positive rate, no description of an appeals process, and no independent verification of the 300,000 figure. Given the scale of the action disclosed, this lack of transparency is a material gap.

Economically, it must be understood that the driver of boosting lies in the income gap at the bottom of the esports labor pyramid. Enforcement raises the risk premium, but does not remove demand (players wanting high rank, rewards, ego) or supply (highly skilled players needing income). By the ordinary logic of gray markets, supply-side enforcement tends to raise prices rather than make the market disappear. If cheap boosting accounts become scarce, service prices will rise, and the per-transaction revenue of surviving operators may increase. This is a paradox any enforcement program must confront.

This also raises a question of regional asymmetry. League of Legends and VALORANT in mainland China are operated within Tencent's ecosystem, which has localized anti-cheat and account-verification infrastructure distinct from the global Vanguard rollout. Whether the 300,000 figure includes, excludes, or is separable from the China server population is an unresolved question. If the figure is global-ex-China, then the effective enforcement coverage rate against the 140 million player base is overstated, and this may be a significant denominator error.

Takeaway: Hardware Identity and the Price of Maturity

There is a line I always keep in mind when writing about moments like this: "We call it randomness, but the universe calls it a script." Riot expanding Vanguard from an anti-cheat tool into a cross-title behavioral governance layer is not random. It is a script written long ago, and we are merely reading its latest chapter.

What I firmly believe, after six years observing this industry, is that what is being built here is not merely an anti-cheat fence. It is the establishment of an integrity-reporting norm for the whole industry. If Riot publishes enforcement data periodically, they could create a de facto reporting standard, similar to how anti-doping reporting norms developed in traditional sport. But whether the 300,000 figure is a one-off disclosure or the beginning of periodic reporting, the document does not say.

If the hardware verification system is fully deployed, the cost curve of creating a new account will steepen sharply. Over a multi-year horizon, this could reduce both the population of legitimate returning players and casual experimenters, not just cheaters. That is an unacknowledged side effect.

And there is an escalation signal worth tracking: Vanguard's expanded remit into ranked-system manipulation control sets a precedent for anti-cheat clients as general-purpose behavioral enforcement infrastructure. In the future, that same infrastructure could be applied to other conduct categories. This is a signal the industry must watch carefully.

There is something people often forget when discussing large-scale crackdowns. It is the story of those who do not appear in the report. The player who accidentally queued with a boosted account, woke up, and found their ranked points evaporated despite never touching cheat software. The player using a practice account to preserve their highest achievement on their main, now standing near the enforcement boundary. "The silent empty chair tells the longest story." In this case, the empty chair belongs to a player who violated nothing at all.

I once wrote that when the crown touches the ground, the echo does not belong to the king. Here too. When a governance system expands its power, the first echo does not belong to the deservedly punished, but to those caught in the gray zone of rules not yet clearly defined.

Finally, what must be remembered is that the line between protection and control is thin. A clean ranked ladder is a prerequisite for the growth of the entire amateur-to-professional pipeline — where academy teams and scouts still rely on ladder signals to find talent. If the integrity of the ladder improves, the quality of talent identification improves with it. That is a real benefit. But if enforcement is uneven across regions, that quality will diverge by server, and the problem will be displaced rather than solved.

Locking nearly 300,000 accounts is a correct direction for platform health. But the real question is not how many accounts were locked, but who will be held accountable when a new rule accidentally touches someone who did nothing wrong. A better ranked ladder is something to look forward to. But a fair governance system is measured not only by how many are removed, but by how it treats those who remain.