Nearly 300,000 League of Legends and VALORANT Accounts Locked: When Vanguard Steps Onto a New Front

The number 300,000 does not sit in the score column. It sits in the locked-account column. When I place it next to the monthly player-count column — roughly 140 million across the two titles — the ratio drops to 0.2%. That was the moment I stopped, spreadsheet in hand. Not because the number was small, but because the gap between the crowd's feeling and the reality of the data was once again that wide.

Over years of tracking esports data sheets, I learned one thing: most readers only read the headline, a smaller group reads the body, and very few scroll down to the source notes. The 300,000 locked accounts are the headline. The 0.2% ratio is the body. And the fact that every figure originates from the enforcing party itself — Riot Games — sits in the source notes almost nobody reaches. Data does not lie — the listener is simply not patient enough.

Context: September 2026 and Vanguard's change of employer

To understand why this number surfaces now, we need a timeline anchor. In September 2026, Riot Games integrated Vanguard — its kernel-level anti-cheat system, previously running only for VALORANT — into League of Legends itself. This was not a champion-balance patch. It was a system-level change: anti-cheat software now operates directly inside the League of Legends client, observing machine-level behavior at the highest privilege level of the operating system.

Two titles, one shared armour layer. And from that anchor, Riot began widening Vanguard's remit. Where Vanguard once hunted cheat software — tools that interfere directly in a match — it now points at a different class of violation: ranked-system manipulation. That means boosting, smurfing, and a new concept Riot itself named — the hitchhiker.

I have watched high-level ladders long enough to know that boosting was never a single-title problem. It is an underground economy running parallel to the official esports economy. A skilled player takes money to log into someone else's account and climb for them. It is a service relationship with sellers, buyers, prices, and a market. And when a platform as large as Riot announces 300,000 locked accounts, the real story is not the scale of the crackdown but its design.

Core Analysis: the four layers of one enforcement action

The 300,000 figure has a time-window problem. It was disclosed after Vanguard's League of Legends integration in September 2026. That means, absent a prior-period comparison, this figure is very likely a cumulative tally over roughly a quarter or less — not an annual figure. That distinction matters. If it is a quarterly figure, the annualized enforcement rate is substantially higher than first impressions suggest. If it is a one-off campaign number, it is merely a slice. Either way, the source article offers no prior-period baseline and no breakdown by title. One number is an accident. A cluster of numbers is a confession. Here, we have only one number.

The second layer is the hitchhiker policy. This is the part I consider most important and least discussed. By Riot's definition, a hitchhiker is a player using their own account, playing by the rules, but queueing alongside an account being boosted. The consequence: they may lose the ranked points — LP — earned in those games. Read that again. This player did not tamper with software. They did not hand over their account. They merely played with a friend. And they lose points for it.

This is an expansion of liability by association. Not the liability of the rule-breaker, but the liability of the person standing next to the rule-breaker. In any governance system, this is the most contestable class of rule, because it shifts risk from the guilty to the potentially innocent. And notably, the source article says nothing about an appeals mechanism, a false-positive rate, or the evidentiary standard used to classify a hitchhiker. Three hundred thousand locked accounts, and not one line about what you do if you are wrongly locked.

The third layer is smurfing. This is where Riot's policy runs against a large part of the community's expectations. Riot states plainly: playing a secondary account is not automatically cheating. It enumerates eight legitimate use cases — including protecting your highest achievement on your main account, or practising a new champion without affecting your main rank. A Riot staff member, Phillip "mirageofpenguins" Koskinas, is quoted on the matter. That means Riot's enforcement boundary rests on intent and behaviour, not on how many accounts a player owns.

This is a soft boundary, and I know from tracking account-enforcement cases that soft boundaries are always the hardest to enforce consistently. The same behaviour — playing a secondary account — can be legitimate in one case and a violation in another, depending on intent that only the enforcer can see. When the standard is set on intent, false positives rise. And when false positives rise, the demand for an independent appeals mechanism rises with them.

The fourth layer, and the most structural one, is the plan for hardware-level identity verification. Riot announced plans to roll out multi-factor authentication (MFA) and — more notably — TPM 2.0, a hardware security standard enabling device-level identity attestation. The stated goal: make one-time accounts harder to create. Additionally, verification requirements may be applied differently depending on player rank — the higher the rank, the stricter the requirement.

The key point to hold onto: the genuinely consequential development is not the 300,000 locked accounts, but Riot's shift from software anti-cheat toward hardware-bound account identity — a structural change far heavier than any single ban wave.

Look at the effect of TPM 2.0. When an account is bound to a specific physical device, the cost of creating a new account spikes. A banned cheater can create another account in minutes; that cheater cannot swap hardware in minutes. In theory, this is the most effective measure yet. In practice, it raises an access-equity problem. A non-trivial share of League of Legends players play in internet cafés, on shared machines, or on older computers that do not meet TPM 2.0. For them, a hardware-identity requirement is not an anti-cheat measure — it is a barrier to entry.

Alongside that is LP protection — protecting ranked points when a cheater or a leaver is detected on your team. This is the detail I judge to deliver the highest player-experience value at the lowest cost, and it is likely to improve community sentiment faster than the ban number itself. It addresses the exact pain ranked players face daily: losing because a teammate sabotaged the game, then losing points for it.

These four layers — the time window, the hitchhiker rule, smurfing, and hardware identity — form a clearly tiered system. The first three are operational adjustments. The fourth is a reconstruction of digital citizenship inside the game.

Contrarian Angle: when the enforcer is also the data provider

The crowd watches the number. I watch the rest of the sheet. And the rest of the sheet here carries a structural problem that cannot be skipped: every quantitative claim in this story comes from a single source — Riot Games. The 300,000 figure is not independently audited. The 140 million monthly players — roughly 120 million for League of Legends and 20 million for VALORANT — are given with no specific attribution, in the "estimates show" style. The 0.2% ratio I opened with is derived from those two unverified numbers.

This does not mean Riot is wrong. It means we are reading an enforcement narrative supplied by the enforcer itself, with no independent arbitration layer in between. In traditional sports governance, doping cases are not simply self-announced and self-confirmed by one party. There are independent anti-doping bodies, adversarial processes, audited data. Esports does not yet have that layer. And at the scale of 300,000 accounts, the absence of an independent verification tier is not a small detail.

There is a rarely mentioned paradox: the bulk of the League of Legends player base sits in an ecosystem operated differently — mainland China, run inside Tencent's ecosystem with its own anti-cheat and account-verification infrastructure, distinct from the global Vanguard rollout. Whether the 300,000 figure includes, excludes, or can be separated from the China-server population is left entirely unclear. If the ban figure is global but excludes China, then the enforcement coverage rate against the actual player base is pushed higher than the 0.2% the article computes.

And there is an underground economic problem that any read of the data reveals immediately. Boosting is not a phenomenon. It is a market. It exists because there is demand — players wanting prestige rank, rewards, or ego satisfaction — and supply — high-skill players, often at the low end of the esports income pyramid, needing money. A crackdown only raises the risk of supplying the service. It does not remove demand and does not remove supply. In gray markets, when the risk premium rises while demand holds, the result is usually not market disappearance but displacement: prices rise, transactions go quieter, and part of the activity flows to lower-enforcement titles. A platform's problem does not automatically become a solved industry-level problem.

There is one more counter-intuitive point: Riot's expansion of Vanguard's remit from hunting cheat software to controlling ranked-system behaviour sets a precedent. Once anti-cheat software can be used as general behavioural-enforcement infrastructure, the line between anti-cheat and player-conduct management blurs. Today it is boosting. Tomorrow it could be any other conduct the operator deems harmful. This is not a warning about intent — it is an observation about an available structure: the tool is already on the machine, and the power to widen its remit sits with one side.

Takeaway: the signal for the next cycle

Over the next 6 to 18 months, if Riot maintains steady disclosure of enforcement data, we will have something this industry has never had: a continuous data series on ranked-ladder integrity, rather than scattered press releases. That is what is worth tracking, not this cycle's 300,000 figure. And if the hardware-identity plan is actually deployed, the biggest question of the next cycle will not be "how many cheaters got banned," but "how many genuine players were wrongly banned, and do they have an appeal door". Football never lacks stories to tell, only people willing to count again. Here, the person willing to count again must be the reader, not the spokesperson.