Nearly 300,000 League of Legends and VALORANT Accounts Locked for Ranked Cheating: The 0.2% Figure Is the Real Story

In September 2026, I opened the League of Legends client and saw a small process starting up with the system. Vanguard. Until then I had only encountered it on VALORANT. No press release, no media event, just a kernel-level software layer appearing on my machine every time I logged in. I recorded that date in my personal tracking sheet, under the column "system change", and closed the laptop.

One quarter later, Riot Games announced it had actioned nearly 300,000 accounts across both titles for ranked cheating. The same announcement contained two data points. The first one everyone reads: nearly 300,000. The second sits near the bottom, almost entirely skipped: that figure equals roughly 0.2% of an estimated 140 million monthly players.

For someone whose job is reading tables of numbers, the second data point is the one worth analysing. Numbers do not lie, but they do sulk — and they sulk hardest when they are placed in the wrong part of the story.

To read this announcement correctly, it has to be separated from the news category it does not belong to. This is not a balance patch story, not a transfer story, not a tournament result. This is a platform governance story: a publisher expanding its anti-cheat system's remit from detecting cheat software to controlling behaviour on the ranked ladder.

Four concepts need rebuilding before any analysis. First, boosting: a highly skilled player logs into someone else's account to raise that account's rank. Second, hitchhiker: a player using their own account but queuing alongside an account being boosted — a group that may lose ranked points despite breaking no software rule. Third, smurfing: playing on a secondary account below one's true skill level; Riot states explicitly that this is not automatically treated as cheating, and enumerates a set of legitimate use cases, including protecting one's highest achievement on a main account. Fourth, LP protection: players do not lose points in games where a cheater or a leaver is detected.

Alongside that, Riot announced future plans including multi-factor authentication, TPM 2.0 hardware standards, device-level verification, and verification requirements that may be applied differently depending on a player's rank. This is the most skimmed-over section, and the one with the greatest structural weight.

Core analysis

The time window is the first ambiguity. The 300,000 figure was released after Vanguard was integrated into League of Legends, meaning it reflects a cumulative enforcement tally over roughly one quarter or less, not a year. Annualised, the real enforcement rate is substantially higher than the first impression suggests. But even that annualisation is inference: the announcement provides no trend line, no prior-period comparison, no breakdown by title. A dataset with no comparison baseline is a dataset that is not yet sufficient for conclusions.

The denominator is the second ambiguity, and the more serious one. The estimates of 120 million monthly League of Legends players and 20 million monthly VALORANT players are attributed to no source at all. That is a provenance weakness for the 0.2% ratio — the figure used as the framing device for the entire announcement. Worse, an unresolved variable sits underneath: League of Legends and VALORANT in mainland China operate within the Tencent ecosystem, with localised anti-cheat and account-verification infrastructure distinct from the global Vanguard rollout. If the 300,000 figure is global-ex-China, the 0.2% ratio is computed against a materially wrong denominator. This is an open question, not a conclusion — but it has to be asked.

The biggest change in the entire announcement is not the number of locked accounts. It is the hitchhiker doctrine. Riot is asserting the authority to revoke ranked points from players who used valid accounts, installed no cheat software, and did not touch the servers. This is an expanded liability-by-association standard, and the single most contestable element on procedural grounds. In football, the equivalent would be a player being carded because a teammate committed the foul — except here there is no independent referee to adjudicate.

The second notable point is the smurfing boundary. Riot does not equate account count with cheating; it places the enforcement line at intent and behaviour. In principle, that is the right choice. Operationally, it is the hardest line to enforce consistently, because it requires distinguishing intent between two accounts with identical activity histories.

The third point is the two-tier governance model. Verification requirements may be applied differently by rank. Logically this holds: the higher the rank, the greater the economic and reputational stake, and the greater the cheating risk. But it also creates a system in which players' rights and obligations are no longer identical across the ladder.

The fourth point, and arguably the most underrated, is TPM 2.0. This hardware standard turns an account from a software entity into one bound to a physical device. The direct consequence is a sharp rise in the cost of creating throwaway accounts. The indirect consequence is that the entire account resale market — a gray economy that generates no revenue for Riot — gets squeezed. Commercially, this is a sound investment, because in a free-to-play model players who are cheated against churn, and churn means losing the monetisation base. Anti-cheat investment is, by nature, churn-prevention investment.

Based on my experience watching matches at tier-2 events and regional qualifiers in Southeast Asia, I have repeatedly seen scouts use solo and duo queue rank as a screening filter. It is a cheap, fast, systematic filter. When boosting erodes the accuracy of ranked standing, it does not merely ruin the experience of ordinary players — it corrupts a talent-identification channel for the entire development pipeline. The cost of ranked cheating therefore does not sit with the players who get dragged up a division. It sits with the scout who is handed bad data.

The contrarian angle

The problem with this announcement is not cheating. The problem is enforcement design.

Across the entire announcement there is no false-positive rate, no description of an appeals mechanism, and no independent audit layer for the 300,000 figure. Riot is simultaneously the rule-maker, the enforcement body, the supplier of data about its own enforcement, and the commercial beneficiary of the outcome. This structure exists across most publisher-run esports, but the scale of application here — hundreds of thousands of accounts, including a cohort that broke no software rule — makes the audit gap far more notable than in a routine enforcement move.

The second systemic risk is displacement, not elimination. Tighter enforcement raises risk for boosting service providers. When risk rises, price rises. When price rises, the operators who survive a ban wave may see higher revenue per transaction. Demand — rank prestige, seasonal rewards, competitive ego — does not change. Supply — the income needs of lower-tier players in the esports labour pyramid — does not change either. An enforcement action that only touches the risk side, without touching supply or demand, reprices the market rather than removing it. If League of Legends and VALORANT become too hardened, that flow tends to migrate toward titles with softer enforcement.

Defence is the only thing that never pretends. A good anti-cheat system must survive the reverse question: how often is it wrong, and who is accountable when it is wrong. This announcement answers the first question with silence and the second with silence.

Progressive conclusion

Data is not for predicting the future; it is for seeing the present clearly. The present shows Riot building a platform-governance layer that extends beyond cheat-software detection, and that layer will reshape the cost of owning an account. What matters in the next cycle is not a new ban number, but four signals: the high-elo rank distribution after enforcement, boosting service pricing in the gray market, the actual TPM 2.0 rollout roadmap, and the degree of enforcement symmetry across server regions.

I do not trust emotion, I trust systems — but I always check the system. And this system still has not given me enough data to check.