Vanguard Steps Into League of Legends: 300,000 Accounts Locked and the Real Price of a Hardware-Bound Identity

September 5, 2026. I was sitting at the last row of PCs in an internet cafe in Bupyeong, Incheon, and I did not boot up a game. I watched.

Four people sat next to one another. Three of them laughed and talked normally, their accounts carrying real names and a match history as thick as a property deed. The fourth stayed silent. His account name was a meaningless string of characters. He played well in a way that was uncomfortable to watch, the kind of good that makes everyone around him forget which rank they were standing in. After every win, he did not review his stats. He just opened a second chat window on his secondary monitor, typed a few lines, and closed it.

That was September 2026, the exact month Vanguard — Riot Games' kernel-level anti-cheat software — was pushed from VALORANT into League of Legends. I did not know exactly what that kid was doing that night. But I knew one thing: four months later, Riot Games announced it had locked nearly 300,000 accounts across League of Legends and VALORANT for cheating in ranked play.

That number, if you only read the headline, sounds enormous. And it is exactly the kind of number a transfer-market story likes to open with. But I learned something back in 2026 — the year I was wrong three times in 72 hours, after rushing to report that Lee Myung-joo was heading to Japan without verifying the source, then having to write three consecutive corrections by hand and getting every article cut by my editor for a month. I learned that a rumor is not evidence, and a number is not a story.

300,000 accounts is not the story. The real story sits somewhere else.

Context: when the underground market of the ranked ladder becomes the target

Throughout my career as a transfer reporter, I have been trained to see everything through the lens of a deal: who buys, who sells, who takes the commission, who carries the risk. But there is one market I ignored for years, and it is the largest market in all of esports: the market of climbing the ranked ladder.

This is a structure outsiders rarely see. At the bottom layer, amateur players need a pretty rank to sell themselves to an academy team. In the middle, academies and tier-2 teams use the very ladder as their primary scouting filter — they scan Elo first and watch scrims second. At the top, professional players maintain alt accounts to practice champions, practice agents, and sometimes just to play without being watched. That entire pyramid rests on a single assumption: that the ranked ladder reflects true skill.

That assumption has just been sold off.

Riot Games has locked nearly 300,000 accounts across League of Legends and VALORANT for ranked cheating. If you take the estimated combined monthly player base of the two titles — roughly 120 million for League of Legends and 20 million for VALORANT, about 140 million combined — the rate lands around 0.2%. The original report was published by Riot itself, and even the author added his own caveat that 0.2% is a relatively small number.

But I do not want to stop at 0.2%. In this profession, the biggest trap is trusting a percentage provided by the enforcing party itself. I once sat in the corridors of the Russia World Cup in 2026, listening to a Portuguese scout read out a 12-million-euro release clause for a young East Asian talent, then wrote an article within two hours and published it four hours before the European outlets. That time I was right. But I have also been wrong, and both times taught me the same lesson: when a number comes from a single source, and that source profits from the number, the number carries directional value, not audited value.

Riot Games in this story plays four roles at once. It writes the law. It enforces the law. It supplies the enforcement data. And it is the commercial beneficiary of enforcement. Four roles in one entity, with no independent arbitration layer in between. That conflict-of-interest structure is not unique to Riot — it is an inherent feature of the publisher-run esports model — but it is enough for me to put a question mark over every number in this news item, including the 300,000 itself.

And here is the first point I want to plant a flag on: the 300,000 figure does not cover any time window that has been clearly stated. Vanguard was only integrated into League of Legends in September 2026. If the figure accumulates from that point, it represents one quarter, at most a quarter and a half. That completely changes how you read the intensity of enforcement. Annualized, the real account-locking run rate would be substantially higher than the headline suggests.

Core: classifying behavior, and where the boundary has been bent

There are three behavior groups Riot targets in this enforcement wave, and how they define each group is the most interesting part to dissect.

The first group is boosting — a paid service where a highly skilled player logs into another person's account to raise that account's rank. This is an activity with a clear economic relationship: one side sells skill, the other buys prestige. On paper it is easy to identify because it involves cross-device, cross-location, cross-timezone logins.

The second group is smurfing — playing on a secondary account at a rank below one's true skill level. And this is where Riot says outright what much of the community does not want to hear: smurfing is not automatically considered cheating. Phillip "mirageofpenguins" Koskinas, a Riot Games staff member, was quoted saying that Riot lists a set of legitimate uses for secondary accounts — including preserving your highest achievement on your main account. In other words: Riot's enforcement boundary is a boundary of behavior and intent, not a boundary of counting accounts.

The third group, and the most controversial one, is the hitchhiker. Riot defines a hitchhiker as a player who uses their own account, violates no software rule, but queues together with an account being boosted to benefit from the results of those matches. The penalty for a hitchhiker can be revoking ranked points — LP — earned in the affected games.

Read that again. A player uses their own account. Installs no cheating software. Does no cross-device login. Simply queues with a friend who is being boosted. And Riot asserts the authority to strip that person's ranked points.

This is the single most consequential rule change in the whole story, and it is buried under the 300,000 headline. Riot is expanding third-party liability to a party with no evidence of wrongdoing of its own. In the language of traditional sports law, this is a liability-by-association standard, and it belongs to the category of rules hardest to defend before an independent arbitration panel — if there is an independent arbitration panel.

But the story does not stop there.

On the flip side, Riot has also introduced a protective mechanism few noticed: when a match contains a detected cheater or a detected leaver, affected players may not lose LP. This is a structural change to the ranked grinder itself. It changes the expected-value calculus of the serious player: it lowers the penalty for unlucky games, compresses variance, and over a long statistical sample makes LP a marginally more accurate skill signal. For a ladder used as a scouting filter, this is infrastructure upgrading, not just a gift to players.

The economic heart of the underground market, and why enforcement cannot erase it

I want to say plainly what the original report does not: boosting services exist because there are buyers, there are sellers, and the gap between them is money.

The buyer needs a pretty rank. Not because a pretty rank helps them win — because a pretty rank is a signal of prestige. In an ecosystem where scouting happens through the ranked screen before it happens in the scrim room, a Diamond or Ascendant account carries social and professional value. Some buy rank for vanity. Some buy rank for end-of-season rewards. Some buy rank because they believe there is no other way to be seen by an academy team.

The seller needs money. And this is the part that the highest level of esports analysis still avoids saying out loud: the people selling boosting services are usually tier-2 and tier-3 players paid low wages. They have high skill, they have time, and they have an income need. The labor pyramid of esports has a very wide bottom and a very poor bottom. Boosting is one of the shortest paths to turning skill into cash.

When Riot locks accounts and raises the risk of boosting, what happens?

Demand does not disappear, because rank prestige still has value. Supply does not disappear, because skilled players still need income. What disappears is the market's low-risk property. This is an old law of every gray market: enforcement from the supply side raises prices, it does not collapse the market. The sellers who remain move to quieter channels, higher prices, and the margin per deal may actually rise.

In other words, the 300,000-account ban wave is likely to make boosting more expensive, not to make it disappear.

And that is why I say the real story is not the initial number.

The real plan: hardware-bound identity and a two-tier citizenship model

Among the information points in the original report, there is a group of details placed near the end, almost as an appendix. It is Riot's plan for the future of account verification: multi-factor authentication, or MFA; TPM 2.0 — Trusted Platform Module version 2.0, a hardware security standard that enables identity attestation at the device level; and verification requirements that may be applied differently depending on a player's rank.

Read that last phrase again. Verification requirements applied differently depending on rank.

This is a two-tier governance model. Players at low ranks face one level of verification. Players at high ranks face another, heavier level. In traditional sport this is nothing unusual: whereabouts rules apply more heavily to elite athletes, doping tests apply more densely to high achievers. But in esports, where the entire system rests on an online account, tying the level of verification to rank means Riot is concentrating enforcement cost precisely on the tier where scouting and semi-pro life happen.

And TPM 2.0 is the real bomb.

If TPM 2.0 is deployed in the strict technical sense, accounts will be bound to physical hardware. One account, one machine. The stated goal — making it harder to create one-time accounts — sounds modest in a press release, but its consequences are anything but modest. It collapses the entire economic model of the account resale market, because an account is no longer a good that can change hands.

In gray-market economics, this is a far bigger shift than locking 300,000 accounts. Locking accounts clears the table. Binding identity to hardware changes the rules of the whole casino.

But I must also state the downside, because that is the duty of someone who was wrong three times in 72 hours.

Binding accounts to hardware creates an access-equity problem. In some regions, a large share of League of Legends players play on shared machines — internet cafes, shared home computers, second-hand devices. These players may be systematically disadvantaged by device attestation, even though they have never cheated in a single match. This is a business and public-relations risk the original report does not mention at all.

And there is one more detail I always keep in mind when reading global numbers: the regional operating model. League of Legends and VALORANT in mainland China are operated inside Tencent's ecosystem, with localized anti-cheat and account-verification infrastructure distinct from the global Vanguard rollout. Whether the 300,000 figure includes, excludes, or can be separated from the China server population — the original report does not answer. And if the figure is global-minus-China, then the 140-million monthly player denominator is overstated, because a large share of monthly active League of Legends players sit inside the China ecosystem. That means the 0.2% ratio may be wrong. Not wrong out of malice. Wrong because of the denominator.

The contrarian angle: this is not a cheating story, it is an enforcement-design story

I have spent most of this piece talking about the underground market economy and the hardware-identity plan. Now I want to state what I believe is the real conclusion of the whole story.

The biggest risk in this report is not cheating.

Cheating is an old problem, present since the ladder was invented. The biggest risk is enforcement-design risk — specifically, two governance choices Riot is making simultaneously, both of which carry procedural and privacy exposure the original report does not acknowledge.

The first choice is the hitchhiker doctrine. When you assert the authority to revoke the points of a player using their own account who has violated no software rule, you are expanding liability to a third party. The problem is not whether hitchhiking deserves punishment — it does. The problem is how you distinguish an intentional hitchhiker from a player who unknowingly queued with a boosted account. The original report names no false-positive rate. No appeals mechanism. No evidentiary standard Riot uses to classify someone as a hitchhiker. At the scale of 300,000 accounts actioned, this is a serious transparency gap.

The second choice is hardware attestation and rank-tiered verification. In governance terms it can be defended — higher rank, higher stakes, stricter requirements. But it also raises an equal-treatment question, and this discretionary style of rulemaking is exactly what the original report examines only shallowly.

And let me not skip a detail I deliberately saved for here.

Across the entire original item, there is not a single voice from the community, from a professional player, or from an independent critical expert. The entire substance comes from a single source: Riot Games. The only balancing voice is the author's own note, in which he admits 0.2% is a relatively small number. That structure — a single source plus a small self-balancing note — is the signature of a report shaped by a publisher briefing. I am not saying the author is wrong. I am saying that kind of sourcing structure is enough to orient, not enough to audit.

There is one more detail that nagged at me throughout writing this, and I choose to state it even though it sits at the level of inference.

When you expand a kernel-level anti-cheat client from one title to another, and at the same time expand its scope from cheating software to in-ranked behavior, you are setting a precedent worth tracking closely. Anti-cheat stops being a cheat-detection tool. It becomes general-purpose behavioral enforcement infrastructure. Today it detects boosting. Tomorrow it could detect other categories of violation. This is a governance signal, not an accusation, but it is a signal to track.

Meanwhile, much of the community is arguing about smurfing. And here is a notable paradox: Riot states clearly that smurfing is not automatically cheating and lists legitimate uses, while community expectation is a blanket crackdown. The gap between community expectation and Riot's actual policy on smurfing is the largest gap, and it will be the flashpoint of debate over the coming weeks.

Finally, a side story I cannot skip. Inside Riot's classification system there is a group of players hiding behind two abbreviated letters: LP. League Points. The ranked ladder's unit of currency, and the entire protective mechanism for detected cheaters or leavers revolves around that currency. People only cry when the spreadsheet is closed — and in this case, the spreadsheet is not the player's, it is the system's.

The structural read: real winners and real losers

Breaking apart this enforcement wave, I see the distribution of benefit and harm as follows.

The clearest winner is the honest ranked player, and the competitive-integrity ecosystem. When Riot frames the measures as a player-experience improvement and LP protection, they are right. If the ladder is cleaner, ladder-derived scouting signals are more trustworthy, and the whole pipeline from amateur to pro gets a better quality of input.

The clearest loser is the boosting service operator, the paying boost client, and the hitchhiker account. These three groups take direct losses: lost accounts, lost LP, lost main accounts.

But there is a fourth group no one notices: genuine players who queue with a friend being boosted and do not know. This is the false-positive point the original report skips. Meanwhile, a fifth group — professional players maintaining practice accounts — sits near the enforcement boundary. The original report does state clearly that practice accounts for champion and agent practice are protected. But ambiguous cases, such as a pro queuing with a flagged account, could create bad headlines for a club. It is low risk, but it is real risk.

In the long term, there is an effect I want in the tracking file: if enforcement intensity is heaviest at high ranks, the short-term observable effect may be a contraction in the visible high-Elo population — boosted accounts locked or leaving the ladder. That could temporarily distort the ladder's percentile distribution and MMR calibration. Tier-2 and academy scouting departments, which rely on rank as a screening filter, may need to re-weight their evaluation criteria toward scrim and tournament evidence.

Signals to track: when the casino changes its rules, where does the money go?

Before closing, I want to sketch the signals I will track over the next 6 to 18 months, because that is the only way to find out whether my judgment is right or wrong.

The first signal is the cadence of enforcement data disclosure. Is the 300,000 figure a one-off disclosure or the start of periodic reporting? If Riot publishes repeatedly with trend lines, it could establish an industry-wide integrity-reporting standard — comparable to how anti-doping reporting norms developed in traditional sport.

The second signal is the actual rollout of MFA, TPM 2.0 and hardware attestation. Track it through client patch notes and account policy pages. If requirements deploy beyond test scope, this is a major shift in account economics, and the privacy debate escalates.

The third signal is the price and movement of the boosting market. If prices spike or activity migrates to titles with softer enforcement, my displacement thesis is confirmed.

The fourth signal is hitchhiker enforcement volume and false positives. Track community reports, Riot support statements, and pro-player anecdotes. Any visible wrongful revocation will trigger a procedural backlash.

The fifth is ladder quality post-enforcement. Measure through third-party rank-distribution trackers. Anomalous distribution shifts at high Elo will validate or refute enforcement effectiveness.

And the sixth signal, the one I consider most important: regional symmetry. If one server has softer verification, boosting demand may migrate there, just as gold-farming and account trading concentrate in low-enforcement regions. Competitive-integrity arbitrage between servers is one of the least-discussed structural risks in the whole ecosystem.

Close: when identity becomes a hardware good

I go back to that evening of September 5, 2026, in the internet cafe in Bupyeong.

That night I did not know what the silent kid with the meaningless account was doing. Four months later, when the 300,000 number appeared on my screen, I understood something the headline did not say: the story is not how many accounts were locked. The story is that Riot Games is preparing to bind player identity to physical hardware, and locking 300,000 accounts is only the warm-up for a world in which there are no one-time accounts left to sell.

In that world, the ladder is cleaner. Scouting is more accurate. But in that world too, players on shared machines are disadvantaged, players who queue with a boosted friend can lose points, and a company that writes the law, enforces the law, supplies the data, and profits from it remains the only party that decides the boundary between game and fraud.

You can be glad the ladder is cleaner. But you should also start rereading the terms of service with the eyes of someone who understands that one day, your account will belong to the machine you are sitting in front of. And when an account belongs to the machine, the next question is no longer who cheats. The next question is who is allowed to play.