Riot locks nearly 300,000 League of Legends and VALORANT accounts: the real concern is the hardware verification layer

In September 2026, I opened the League of Legends client on an old machine in Shenzhen to rewatch a ranked game played by a semi-pro competitor I had been tracking for two years. The client booted about two seconds slower than usual. A small line of text appeared: Vanguard had been integrated. I noted the timestamp in my notebook, because once this kernel-level anti-cheat crossed over from VALORANT to League, the definition of a "legitimate account" would never be the same again.

Four months later, Riot Games announced that close to 300,000 accounts across the two titles had been locked. Nine out of ten readers stop at the headline number. Hard truth: the number is the least important part of the story.

Everything I know about sport, I learned from my mistakes on air. The first lesson is this: when one party writes the rules, enforces them, publishes the enforcement statistics and profits from enforcement, the person reporting it has a duty to read the press release one beat slower than everyone else.

Vanguard, boosting, and three words nobody read

Vanguard is an anti-cheat that runs at the operating-system kernel level. It launched with VALORANT in 2026 and was integrated into League of Legends in September 2026. That it detects cheat software is obvious. That it has begun intervening in ranked-ladder behaviour is the part worth discussing.

Riot defines boosting as a service in which a highly skilled player logs into someone else's account to climb on their behalf. Smurfing is playing on a secondary account, typically below one's true skill level. A hitchhiker is a player using their own account who queues alongside an account being boosted.

Three concepts, three very different levels of liability. Most reports I read collapsed all three into a single word: cheating.

Riot has held its line that smurfing is not automatically treated as cheating, and enumerates eight legitimate smurf use cases, including practising champions and preserving the highest achievement on a main account. Riot staffer Phillip "mirageofpenguins" Koskinas has answered this publicly. That is the crux: Riot does not sentence accounts by count, it sentences on intent and behaviour. A soft line like that is extremely hard to enforce consistently.

At the same time, Riot announced LP protection: players no longer lose ranked points in games containing a detected cheater or a leaver. It also outlined a future roadmap — multi-factor authentication, TPM 2.0, hardware attestation, and verification requirements that differ by rank tier.

On relative scale: League of Legends is estimated at around 120 million monthly active players, VALORANT at around 20 million, roughly 140 million combined. Three hundred thousand out of 140 million is about 0.2%.

Three layers that actually changed

The first layer, and the most contested, is the doctrine of liability by association. Riot asserts the right to revoke ranked points from players who used their own accounts, broke no software rule, and merely queued with an account under boost. This is an expansion of liability to a third party. In any judicial system, expanding liability always comes with three questions: what is the evidentiary standard, what is the false-positive rate, and is there an appeals mechanism. The announcement answers none of them.

The second layer is hardware attestation. The plan to use TPM 2.0 and device verification means an account becomes bound to a specific machine. The stated goal is to make "one-time" accounts harder to create. But the market reality in Vietnam and China is different. A large share of League players in both countries play at internet cafés, on shared machines, switching seats every session. If accounts are hard-bound to hardware, those players are not in the cheating category, but they are in the losing category. That is a fairness problem no report has mentioned.

The third layer is a two-tier governance model. Verification requirements may be applied differently depending on rank tier. Logically that is defensible — the higher the tier, the greater the incentive to game the system. But it creates two tiers of citizenship inside one system.

And this connects to what I care about most: the ranked ladder is not purely an entertainment playground. It is the de facto scouting channel for the entire amateur-to-professional pipeline. When boosting pollutes rank signals, what suffers is not only player experience but the accuracy of talent identification.

I have tracked ranked games of numerous semi-pro competitors on Southeast Asian servers for three years, logging rank movement week by week. Last season, one account jumped from Platinum to Diamond in eleven days, with a 71% win rate across fifteen straight games, and showed no sign of cheat software. The fastest way to pollute a scouting channel is not hacking. It is paying someone to climb for you.

That U19 tournament taught me one thing: an editor's silence is a crime. If today's reporting only repeats the 300,000 figure without asking about the false-positive rate, without asking about the appeals mechanism, without asking about internet-café players, then it is the same silence, just a different sport.

The gray market does not vanish, it reprices

There is one thing no report touched: why does boosting exist? Demand comes from players who want rank badges and seasonal rewards. Supply comes from highly skilled players who need income — and at the bottom of the esports labour pyramid, that income is thin.

Hardware attestation raises the operating cost of boosting services. It does not eliminate demand, and it does not eliminate supply. In any gray market, squeezing supply produces one predictable outcome: prices rise, and the surviving operators earn more per transaction.

There is also a geographic variable the announcement leaves unanswered. League of Legends and VALORANT in mainland China run inside Tencent's ecosystem, with separate anti-cheat and account-verification infrastructure. Whether the 300,000 figure includes Chinese servers, nobody has confirmed. If it does not, the 140 million denominator is seriously distorted, and the 0.2% ratio becomes even more meaningless.

I might be wrong

Fans hate the truth, but I did not go on air to be loved. So I will name where I could be wrong myself.

Perhaps Vanguard genuinely works, and the privacy cost is one the community can accept in exchange for a cleaner ladder. Perhaps binding accounts to hardware will not cause the internet-café problems I fear, because Riot will carve out regional exceptions. Perhaps I am reading too much into a routine enforcement notice, and the three layers I just dissected are technical details, not structural change.

But if I am right, the signal will show up where it can be measured. Not in the number of locked accounts, but in the price of boosting services, and in whether an appeals mechanism is published within the next twelve months.

Do not tell me to analyse objectively. I follow the ladder, and people who follow the ladder are not objective.

What to watch

A testable prediction: within twelve months, either Riot publishes periodic enforcement data with trend lines, or the hardware verification plan runs into backlash from the internet-café player communities of Southeast Asia and China. If neither happens, I have misjudged the severity of the identity-verification layer.

A cleaner ladder is a good thing. But when the rule-maker, the enforcer, the data publisher and the beneficiary are the same company, the question is no longer who got locked out. It is who audits the lock.