Nearly 300,000 League of Legends and VALORANT Accounts Locked: Riot Redraws the Ranked-Cheating Line

On September 12, 2026, Vanguard — the kernel-level anti-cheat client previously confined to VALORANT — began running inside the League of Legends client. By the time Riot Games disclosed its figures, nearly 300,000 accounts across both titles had been locked or actioned. Divide that by an estimated 140 million monthly active players and you land near 0.2%. It took me three days of re-reading the source material to locate the genuinely interesting part, and it is not the 300,000.

In my ranked-tracking ledger, Korean ladder games at Diamond and above have always shown one anomaly: the standard deviation of individual performance metrics runs unusually high compared with other servers at the same tier. Throughout the 2026 season I logged that pattern without being able to explain it. When Vanguard expanded into League, an old hypothesis resurfaced — a slice of the high-rank band was being operated by people who were not the account owners.

Boosting — a service in which a highly skilled player logs into someone else's account to climb the ladder — has been a gray market for years. It underwrites a layer of low-income semi-pro players while injecting profiles into the ladder that do not reflect true skill. For anyone working in scouting, that is input-data contamination. The ranked ladder is not a casual playground; it is the de facto qualification system for the entire amateur-to-professional pipeline. Corrode it and you corrode talent identification.

Riot is not only locking boosted accounts. The new regime also targets "hitchhikers" — players using their own legitimate accounts, queued alongside an account being boosted, who may lose ranked points despite breaking no software rule. This is the most consequential change in the entire announcement: liability by association through queue behaviour, rather than liability for interfering with the system. The whole history of esports anti-cheat has run on the opposite principle — punish the act, not the relationship.

Alongside that, Riot now protects LP in games where a cheater or a leaver is detected. It sounds minor, but it intervenes directly in the expected value of grinding ranked: it compresses variance and, over large samples, makes LP a marginally more accurate skill signal. In my data, changes of this kind rarely generate headlines, yet they produce measurable distribution shifts within two or three seasons.

On smurfing, Riot is explicit: playing a secondary account is not automatically cheating. It enumerates eight legitimate use cases, including protecting one's highest achievement on a main account and separating identity when playing casual modes. Phillip "mirageofpenguins" Koskinas, a Riot staff member, is the only named individual in this story — and he addressed smurfing, not boosting. The enforcement boundary is therefore intent-based and behavioural, not account-count-based. A soft line, and soft lines are the hardest to apply consistently.

The under-discussed part sits in the forward plan: multi-factor authentication, TPM 2.0, hardware authentication, and requirements that may differ by rank. If fully deployed, the cost of creating a "one-time" account rises sharply, and account multiplicity itself becomes a tracked attribute rather than an administrative footnote. Three major competitions, one model, countless truths — except this time the model is being applied to player identity, not to the meta. For professionals maintaining practice accounts, that boundary is far narrower than they assume.

There is one assumption I want to flag: the 140 million denominator.

Neither the 120 million nor the 20 million figure is attributed to any specific source in the underlying material — both are described only as estimates. And League of Legends in mainland China operates inside Tencent's ecosystem, with separate anti-cheat and account-verification infrastructure. If 300,000 is a global figure excluding China while 140 million includes it, then the 0.2% ratio is calculated in a direction favourable to the publisher. I have no proof of that. I am only saying it needs verification before it becomes a headline.

Second, there is no data on false-positive rates, no description of an appeals mechanism, and no independent audit. At a scale of 300,000 accounts, that transparency gap is larger than the number itself. And one structural fact deserves to be faced directly: Riot is simultaneously the rule-maker, the enforcing body, the source of enforcement statistics, and the commercial beneficiary of enforcement. No independent arbitration layer exists.

Finally, the most basic economic logic: enforcement does not erase demand, it raises its price. Buyers want prestige rank, seasonal rewards and status. Sellers need income. Prohibition raises the risk premium, pushes boosting prices up, and can push activity toward titles with softer enforcement. When the crowd goes quiet, the data speaks for itself — but this time the data has not spoken yet.

What is worth tracking over the next six to twelve months is not the ban count but three signals. Whether Riot publishes enforcement data periodically with trend lines, or whether this was a one-off disclosure. Which rank threshold will carry hardware-verification requirements, and whether internet cafés and shared machines get a carve-out. And whether the high-rank distribution shifts abnormally once boosted accounts disappear. We do not predict the future; we read probabilities already written. If Vanguard genuinely expands from fighting cheat software into governing ladder behaviour, this is the first precedent for a new layer of esports governance. In esports, a single millisecond is a tactical opening — and a nominal account can be a data opening too.