Nearly 300,000 League of Legends and VALORANT Accounts Locked: the Real Battle Lies in Digital Identity

In September 2026, Vanguard — the kernel-level anti-cheat client that had previously lived only inside VALORANT — went live on the League of Legends client. I wrote exactly one line in my notebook: it has started looking at behaviour, not just at software. Four months later, Riot Games announced it had actioned nearly 300,000 accounts across the two titles for ranked cheating. Enough to send headlines running at full speed. But when I reached the final section of the statement — the part about multi-factor authentication, about TPM 2.0, about "one-time" accounts becoming harder to create — I understood that what is being opened up goes far beyond a single enforcement sweep. It is a redefinition of player identity, and it will touch people who have never cheated once.

The bare facts. Riot Games actioned nearly 300,000 League of Legends and VALORANT accounts. Three groups sit on the list. The first is boosted accounts — boosting meaning, simply, a highly skilled player logging into someone else's account to push its rank up. The second is the main accounts of repeat offenders, who now face suspension of their primary account, not merely their alt. The third is the most telling: "hitchhikers" — players using their own accounts, pressing their own keys, but queuing alongside an account that is being boosted.

On absolute scale, the picture needs a denominator. Estimates — attributed to no specific source — put League of Legends at roughly 120 million monthly active players and VALORANT at roughly 20 million. Together, about 140 million. Divide 300,000 by 140 million and you get roughly 0.2%. The original text itself concedes this ratio is "relatively small."

But one detail about time is left hanging: over how long those 300,000 accounts were actioned is not stated. If the starting point is September 2026, when Vanguard arrived in League of Legends, then this is an accumulation of about one quarter. The real run-rate is therefore far higher than the "one loud moment and then quiet" feeling. This is what I always check before writing: a quantitative level only means something when you know the window it was measured over, the instrument used, and who did the measuring.

Across many years of watching matches on grass pitches and in electronic arenas alike, I have noticed a recurring pattern: every enforcement sweep is told through the largest absolute number available, while the description of the mechanism gets pushed to the bottom of the piece. This is far from the first time I have seen it, and far from the first time I have had to read to the last line myself.

The hitchhiker doctrine. Across the whole document, this is the heaviest governance point. Riot is asserting the right to revoke ranked points from players who used their own accounts and broke no software rule whatsoever. Liability is being extended into association: you did nothing wrong, but you stood next to someone who did. For a platform where every prior penalty attached to the direct behaviour of the account holder, this is a turning point. The first question I ask, rather than "is this fair?", is "what evidence is used to classify someone as a hitchhiker?"

The text does not answer. There is no false-positive rate, no description of an appeals process, no evidentiary standard. At a scale of 300,000 accounts, this transparency gap is far larger than the cheating it targets.

Smurfing is not automatically cheating. Riot says it plainly: playing on a secondary account is not deemed cheating by default, and it enumerates eight legitimate uses — among them preserving your highest achievement on your main, or practising a new champion without dragging down your main's rank. This means Riot's boundary rests on intent and behaviour, not on account count. A boundary like that is very hard to enforce consistently, and the community will be the first place it is tested. I have seen the same thing on a football pitch: the offside law is clear on paper, and the argument lives in the instant the referee has to judge intent.

The ranked ladder is a scouting pipeline. Few people notice it, but the ranked ladder in League of Legends and VALORANT plays the same role as youth leagues do in football: it is where academy and tier-two scouts go to find people. Boosting corrupts that signal at the root. An account boosted to a high rank does not prove its owner has the skill. If teams screen on rank, they are screening on noisy data. Worth noting: enforcement concentrating at high ranks — precisely where scouting happens — may temporarily shrink the visible high-elo population, skewing percentile distributions for a while and forcing scouting departments to re-weight their evaluation criteria. This is a side effect the original text does not mention, and to my mind it matters more than the number of accounts locked.

Point protection when cheating is detected. When the system detects a cheater or a leaver, the remaining players do not lose ranked points. This is a technically small change with a large perceptual one. It compresses the variance of a match string, making ranked points a marginally more accurate skill signal over large samples. I rate this as something that builds goodwill faster than 300,000 bans, because it touches the daily experience rather than a press release.

Hardware identity. This is the least noticed and most important part. Riot announced plans for multi-factor authentication, TPM 2.0 — a security chip bound to physical hardware — and hardware attestation, alongside a structural detail: verification requirements may be applied differently depending on a player's rank. Higher-ranked players must prove who they are more strictly than lower-ranked players. The model has its own logic: higher stakes, higher requirements, much as whereabouts rules in elite sport weigh more heavily on top athletes. But it also creates two tiers of "citizenship" within a single player community, and raises an equal-treatment question the document does not touch.

If hardware attestation proceeds as planned, accounts will be bound to a specific machine. The cost of creating a "one-time" account spikes, and the account-resale market — a gray economy that contributes nothing to the publisher — comes under direct pressure. The flip side sits with players on shared machines in internet cafés, a population that is far from small in many regions. For them, hardware attestation is a real barrier, not a hypothetical one. The document contains no carve-out for this group.

Risk for professional players. Pros routinely keep alt accounts to practise champions, and Riot explicitly says this is protected. But when behaviour classification runs on large data, a pro's alt still sits close to the enforcement boundary. A case of a pro duo-queuing with a flagged account could become a bad headline for an entire club, even if the pro did nothing wrong. Teams should standardise account declaration and duo-queue hygiene before that happens, not after.

The sourcing problem. Every quantitative figure in this story comes from one side: Riot Games. Riot makes the rules, enforces them, supplies the enforcement statistics about its own enforcement, and stands to benefit over time as players become more attached. There is no independent audit layer. To me, a source talking about itself is always worth reading — but it must be read as a source, not as something already verified. A 0.2% ratio self-calculated by the enforcing party, over a denominator with no named origin, is directional data, not audited data.

The economics of a gray market. Boosting exists because there is supply and demand. Demand comes from the appetite for rank prestige, seasonal rewards, and ego. Supply comes from highly skilled players who need income — and at the bottom of the esports labour pyramid, that income is precarious. Tightening raises risk, and raising risk tends to raise prices rather than erase demand. The likeliest outcome is that the market reprices, migrates to less-tightened titles, and persists in another form. The transfer market is not a fish market, but a place where dreams are priced — and the boosting market is the same thing, one tier lower.

The counterintuitive angle sits here. The common read is "Riot just cleaned out 300,000 cheaters." That read skips two things.

First, 300,000 is a large absolute number but a small ratio, and the crackdown does not prove the ladder is cleaner — because there is no post-enforcement ladder-quality data. An action being enforced does not equal a problem being solved. I learned this from matches played before empty stands during the pandemic. An empty stadium does not erase the roar — it only moves into our memory. The same applies here: the boosting market does not vanish when squeezed, it moves house, into places fewer people watch.

Second, what actually changes player rights is not the 300,000 locks but hardware-bound identity and hitchhiker-style liability by association. One touches privacy and access. The other touches the basic principle that punishment must attach to behaviour. Neither is discussed enough, because the headline has been captured by the number of locked accounts. In a story like this, the section pushed to the bottom is usually the section worth reading most.

There is a principle I keep from the time I mispronounced a player's name three times on air: the storyteller does not own the match, nor the character. Three mispronunciations, to remember that football belongs to no one, not even the narrator. The same applies here. Riot does not own the definition of fairness simply because it writes the rules. And fans should not let a press release define, on their behalf, what a "clean" ladder looks like.

What I want to track over the next six to eighteen months is not how many more accounts get locked, but three things. Whether Riot publishes enforcement data periodically with trend lines. Whether hardware attestation is rolled out at scale with a carve-out for players on shared machines. And whether a wrongful point-revocation case surfaces clearly enough to spark an argument. If none of the three happens, those nearly 300,000 accounts will remain just a headline, while the layer of digital identity being built behind them stays exactly where it is, unchecked.

Between the real arena and the virtual one, only the names differ, not the hearts. Fairness works the same everywhere: it only holds when someone is patient enough to stand outside and look in.