Nearly 300,000 League of Legends and VALORANT accounts locked: Vanguard expands its ranked-integrity remit

Opening: a signal from one client

In September 2026, Vanguard — the kernel-level anti-cheat client Riot Games had previously reserved for VALORANT — began running on the League of Legends client. I read that announcement on a morning in Beijing, my hands still on the operating-cost spreadsheet I had built for Shanghai SIPG in Q2 2026, when the entire Chinese league was suspended by COVID-19. Two events five years apart, sharing one structure: an organisation at the top of the system changes the rules, and the real price only surfaces at the bottom layer. By year-end, Riot Games disclosed that nearly 300,000 League of Legends and VALORANT accounts had been locked for ranked manipulation. It was repeated across the international press. I opened my spreadsheet, did the division, and realised the real story is not in the 300,000.

Context: the ranked ladder runs as a scouting pipeline

Before discussing the account bans, the ranked ladder needs to be put back in its correct place inside the ecosystem. For casual players, ranked is where LP and a little prestige are earned. For the industry, it is the informal scouting layer of the entire amateur-to-professional pipeline. Academies, tier-2 teams and scouts still use ladder position as an entry filter. An account that reaches Challenger through a boosting service manufactures a fake number on the ladder and injects a corrupted sample into the scouting pipeline. When I worked as a club financial analyst at Beijing Guoan, every player report had to be cross-checked against at least three live match contexts. That principle applies intact to ladder data: a rank only has value if it reflects the sequence of games actually played.

Boosting, as Riot Games defines it, is a service in which a highly skilled player logs into someone else's account and climbs the ladder on the owner's behalf. It is an organised transaction with a price, a buyer and a supplier. It exists because two cash flows meet: buyers want rank prestige and seasonal rewards, suppliers need income. For many players at the bottom of the esports labour pyramid, boosting is a real revenue source. In other words, this is a supply-and-demand problem, not a purely moral one.

The enforcement action does not stop at the boosted account. Riot Games extended it to a group it calls "hitchhikers": players who use their own accounts but queue alongside an account being boosted. These players may have ranked points earned in flagged matches revoked, even though they broke no software rule. This is the point I will return to in the contrarian section, because it changes the nature of individual responsibility inside the ranked system.

On the tooling side, Vanguard is a kernel-level anti-cheat client that drew privacy controversy when first deployed for VALORANT. Its move into League of Legends turns a single-title tool into platform-level governance infrastructure. This is a systemic change, and emphatically not a champion-balance or class-strength change. There is no gameplay patch in this story, and anyone trying to read a "meta shift" into it is inventing data.

Core analysis: reading the number through three layers of context

Layer one is proportion. Current estimates place League of Legends at roughly 120 million monthly active players and VALORANT at roughly 20 million, about 140 million combined. Dividing 300,000 by 140 million yields approximately 0.2%. An enforcement action covering 300,000 accounts sounds enormous, but set against the player base it represents about 0.2% — and that ratio, not the headline count, is the analytically valuable figure. I learned that principle from my 2026-18 pricing error, when I proposed Beijing Guoan pay 12 million euros for a midfielder based on La Liga key-pass and expected-assist data, ignored adaptation risk, and saw him resold for 8 million euros six months later. "The market does not forgive, it only records — and I paid for that with the 2026-18 season." An absolute number always needs a denominator before it is allowed to impress.

Layer two is the time window. Vanguard integrated into League of Legends from September 2026. The 300,000 figure most likely represents a cumulative tally over one quarter or less, not an annual figure. If so, the annualised enforcement run-rate is substantially higher, and Riot Games' operating cost is far larger than it first appears. "When the stands are empty, I hear every yuan of the budget clearly." Riot Games has published no time window, no per-title breakdown and no trend line against prior periods. Without those three, the 300,000 figure has directional value only, not audit value.

Layer three is the denominator. This is where much of the commentary skips. League of Legends in mainland China runs inside the Tencent ecosystem, with localised anti-cheat and account-verification infrastructure distinct from the global Vanguard rollout. Whether the 300,000 figure includes, excludes or can be separated from the China servers is unanswered in the published material. If the figure is global-ex-China, then real coverage against the player base is even lower than 0.2%, because a large share of League of Legends' monthly actives sit inside the China ecosystem. This is a potential denominator error, and it is large enough to change how the whole headline should be read.

One point must be stated plainly about sourcing: the 120 million, 20 million and 300,000 figures are all attributed to no independent source. The publisher is rule-maker, enforcement body and sole data source for its own enforcement activity. In club finance, a report like that gets flagged red on its first line. "I learned pricing from a mistake, and I never needed a second lesson."

Now the economics of the boosting market. The enforcement action hits the supply side: it raises the risk cost for service providers, making maintained multi-accounting and logging in as someone else more expensive. It does not touch demand. Buyers still want rank badges, seasonal rewards and community standing. Sellers still need income, especially at the bottom of the labour pyramid. When a grey market is squeezed on supply while demand holds, the familiar outcome is a higher price, not a vanished market. Supply-side enforcement usually reprices a grey market rather than eliminating it. That is the conclusion I draw after watching several similar crackdowns across account-market and in-game service models.

Three rule changes that genuinely matter

Change one is LP-loss protection. When the system detects a cheating player or a leaver, the remaining players do not lose LP in that match. Mathematically this intervenes directly in the expected value of ladder grinding: it trims variance caused by bad luck and, over large samples, makes LP a marginally more accurate skill signal. I rate this detail above the 300,000 figure, because it touches every match, not only locked accounts. "Spinazzola does not take free kicks, he stamps a new pricing rule." At Euro 2026 I identified a wide player with 10 successful crosses into the box in his first four matches, double the average of comparable wide midfielders, and drew a transfer-pricing formula from that small sample. LP protection is a signal of the same kind: small, concrete, and revealing a larger rule about how a platform prices fairness.

Change two is the "hitchhiker" doctrine. This is the most contestable and least discussed element. Riot Games is asserting the authority to revoke ranked points from players using legitimate accounts, playing with their own hands, with no cheating software installed. The standard of responsibility expands from individual conduct to teammate association. In governance language, that is liability by association. The problem is that without a clear evidentiary standard, an ordinary player queuing randomly with a flagged account can lose points without knowing why. Published material contains no false-positive rate, no appeals process and no evidentiary threshold.

Change three is the verification roadmap. Riot Games announced plans to add multi-factor authentication, TPM 2.0 and hardware authentication, with requirements potentially applied differently by player rank. The stated goal is to make "one-time" accounts harder to create. TPM 2.0 is a hardware security standard enabling device-level identity attestation. In operation, it binds an account to a specific physical machine. Economically, this strikes the entire account resale market — a grey economy sitting on top of Riot Games' intellectual property. "A tight budget does not create poverty, it creates precision." Here, hardware-verification infrastructure cost is spent not to generate revenue but to plug a value leak.

But there is an unstated consequence. Hardware-bound attestation creates a device-equity problem. A significant share of League of Legends players worldwide play in internet cafés, on shared machines or on low-spec hardware. Once accounts bind to devices, that group is structurally disadvantaged against players who own their own machines. This is a brand and access risk, and it appears in no official statement.

Alongside that, rank-differentiated requirements create a two-tier citizenship model inside one player community. In governance terms this is defensible: higher ranks carry higher stakes. In equal-treatment terms it raises a hard question. Traditional sport has an analogous model in whereabouts rules applied more heavily to elite athletes. But traditional sport has independent arbitration and a sports court. Here, the rule-maker, the enforcer, the data publisher and the commercial beneficiary are the same organisation.

Contrarian section: the thing to fear is not cheating

The popular framing casts Riot Games as the hero cleaning house. I do not oppose the action; a ladder polluted with noise corrupts the industry's own scouting input. But if I must pick one detail to track over the next twelve months, I skip the 300,000 and choose two others: liability by association for "hitchhikers", and hardware-bound identity.

First, both expand platform power in ways that are hard to reverse. Once a system can revoke points from legitimate players and bind accounts to a physical chip, the cost of extending scope to other conduct categories collapses. Anti-cheat becomes general-purpose behavioural enforcement infrastructure. That is a precedent, not an incident.

Second, both sit outside the reach of any appeals mechanism. No false-positive rate is published, no appeals process described, no independent audit performed. For an action touching hundreds of thousands of accounts, that transparency gap is larger than proportionate. In my crisis-governance work I always prepare the worst case first, and the worst case here is not a handful of players wrongly losing points. The worst case is that the appeal mechanism does not exist fast enough while the punishment mechanism is fully automated.

Third, the grey market will reprice rather than vanish. Boosting will cost more, suppliers will migrate to titles with softer enforcement, and part of the demand will survive intact. The industry-level problem is displaced, not solved. Anyone claiming the ladder is now clean is selling a sense of safety the data has not confirmed.

One more note on smurfing, because it will be the flashpoint in community discussion. Riot Games states explicitly that smurfing is not automatically considered cheating and enumerates eight legitimate use cases, including protecting one's highest achievement on a main account. Riot's Phillip "mirageofpenguins" Koskinas has spoken on the subject. The enforcement boundary therefore rests on intent and behaviour, not account count. That is a deliberately soft line, and it will be very hard to enforce consistently across tens of millions of players. The gap between community expectation and actual policy sits exactly here: most players want a blanket crackdown on smurfing, while the published policy protects many legitimate smurf cases.

One further detail worth recording, because it touches professional teams directly. Riot Games explicitly flagged suspension risk for both alt and main accounts of repeat boosters. For professional and semi-professional players maintaining practice accounts, hardware verification turns "account multiplicity" into a tracked attribute. Teams should standardise account declaration and duo-queue hygiene rather than wait for a loud case. Based on my experience tracking matches and transfer windows, reputational risk from one flagged alt account always exceeds the real damage.

Takeaway

The question after this week is not whether Riot Games is serious. It is serious, and the direction is right for platform health. The question is whether an industry should accept that the rule-maker, the enforcer, the data publisher and the commercial beneficiary sit inside one legal entity, while accepting liability by association and hardware-bound identity as technical costs that need no debate. If the TPM 2.0 roadmap materialises within eighteen months, we will get one of two outcomes: a more trustworthy ladder, or a layer of legitimate players pushed out because they do not own compliant hardware. My question for the scouting profession: once ladder data gets cleaner, will you stop using it as your only screening filter?