Riot Games Locks Nearly 300,000 Ranked Accounts: The Purge Begins at Kernel Level

On the night of September 12, 2026, I was sitting in an internet cafe in Manila when my phone buzzed. A coach from a Philippine youth team messaged me: "Client restarted, something is running in the background." I opened Task Manager on my own machine and saw it — Vanguard, the kernel-level anti-cheat software that once lived only inside VALORANT, now inside the League of Legends process. Four weeks later, the first number appeared: nearly 300,000 accounts locked for ranked manipulation. I opened the spreadsheet I use for every muscle tear, and realized the data column this time did not list tendons or muscles. It listed account names.

I do not write about injuries. I write about what the body screams when language is not enough. But this time, the body did not scream. The system did. And the way it screamed — through a layer of software running beneath the operating system itself — forced me to reopen my entire file on how esports platforms govern themselves.

Context — when the ranked ladder becomes the lifeline

The ranked system of League of Legends and VALORANT is not a professional tournament. It is an enormous amateur competitive structure beneath every professional league — where a 17-year-old in Cebu or Da Nang climbs from Bronze to Diamond, and where academy scouts scan data to find talent. The ladder is the arterial line carrying blood from the bottom to the top of an entire esport.

Ranked manipulation — "boosting" — is a service in which a highly skilled player logs into another person's account to raise its rank. It exists as a gray market with prices, sellers, and buyers. I have watched closed groups across Southeast Asia where boost prices are listed publicly like a menu. "Silver to Gold: price X. Diamond to Master: price Y." This is not a joke. It is a parallel economy running on Riot's back.

When Riot Games integrated Vanguard into League of Legends, it did not merely expand cheat-software detection. It converted Vanguard from an anti-cheat tool into a behavioral governance layer — one that can read not only which software is running, but which behaviors are occurring on an account. That is the turning point I believe the whole industry is watching.

Accompanying the bans was a small but notable change in player experience: LP protection. When the system detects a cheater or a leaver, legitimate players do not lose ranked points for that game. Mathematically, this compresses variance — making LP a marginally more accurate skill signal over large samples. A quiet but real victory.

Core analysis — three changes behind the number

I read this report the way I read a medical report: separating data from intent. Three data points matter more than the number 300,000 itself.

First, the "hitchhiker" doctrine. Riot states it may revoke ranked points (LP) from players using their own accounts, playing legitimately, but queuing alongside an account being boosted. This is an expansion of liability-by-association. You violated no software rule. You just played with a friend. But if that friend's account is being carried, you lose points.

The mechanism recalls how traditional sports federations handle associated liability — and the wrongful-conviction controversies that follow. Notably: no appeals mechanism is described, no false-positive rate, no published evidentiary standard. That is a transparency gap at a scale of 300,000 accounts, and it is the most legally and ethically vulnerable point in the entire story.

Second, smurfing is redefined. Riot states clearly that playing a secondary account is not automatically cheating. It enumerates eight legitimate use cases — including protecting one's highest achievement on a main account, or playing with lower-skilled friends. This is a soft, intent-based line rather than an account-count line. It is precisely the point that will draw the most community controversy, because a large share of players wants Riot to crack down on smurfing wholesale. The gap between community expectation and actual policy is wide here.

Third, and most buried: the hardware-authentication plan. Riot announced a roadmap including multi-factor authentication (MFA), TPM 2.0, and hardware authentication — aiming to make "one-time" accounts harder to create. TPM 2.0 is a hardware security standard enabling device-level identity attestation. Using it means accounts are bound to physical hardware — to the very machine you sit at.

Furthermore, verification requirements are tiered by rank. The higher the rank, the stricter the requirement. As a governance design this is defensible — higher stakes at the top of the ladder. But it also creates a two-tier citizenship model within the player base, where those at the top face more surveillance than those at the bottom. It is an equal-treatment question the material does not touch.

As someone who has tracked how team medical departments handle athlete data, I see a strange parallel. In traditional sport, elite athletes must comply with stricter whereabouts rules than amateurs. Here, high-ranked players face stricter identity verification. The line between reasonable governance and over-surveillance is always fragile.

Contrarian angle — the number is not the story

This is where I must challenge myself. I was drawn to 300,000 — big numbers always attract. But divide it by the player base and everything changes.

Estimates suggest roughly 120 million monthly League of Legends players and about 20 million for VALORANT. Combined, about 140 million. 300,000 divided by 140 million is about 0.2%. Two parts in a thousand.

More importantly — I cannot verify these figures. The 120 million, the 20 million, and the 300,000 all originate from a single source: Riot Games, simultaneously the rule-maker, the enforcer, the data provider, and the commercial beneficiary of enforcement. There is no independent audit. No arbitration layer in between. In that power structure, every number must be read as a claim, not a verified fact.

I thought I understood Eriksen's 90 seconds. An email from Copenhagen showed I had only read the cover. That lesson applies here: when the sole source is an interested party, I am permitted to read the number only as a directional signal. No more.

This does not mean Riot's action is wrong. It means the real story is not the 300,000 accounts locked today. It lies in whether Riot publishes figures periodically, whether there is an appeals mechanism for wrongful hitchhiker cases, and whether hardware authentication binds every account to a physical device. If all three materialize, the impact on players is far larger than banning 300,000 cheaters.

And when I look at the gray market, I think of a basic economic law. Enforcement does not erase demand, nor supply — it only raises the price. Players still want a prestige rank to show off. Highly skilled players at the bottom of the esports labor pyramid still need income. Locking 300,000 accounts raises the risk premium, pushes boost prices up, and does not make the market disappear.

The overlooked blind spot — while Europe looks elsewhere

Europe closes the pitch, I open my files — counting muscle tears in the dark. This time the file does not list player names. It lists server regions. And there is an unanswered question: which server regions fall within the 300,000 figure?

League of Legends and VALORANT in mainland China operate within a separate ecosystem with different account-verification infrastructure. If this figure excludes that server, the 0.2% ratio is miscalculated. And since a substantial share of monthly League of Legends players sits in that ecosystem, the error could be significant.

Football counts every hamstring tear, esports lives in its own medical darkness. But here, the darkness does not come from medicine. It comes from data not split by region, with no prior-period comparison, no trend line. A medical report without a control group is a worthless report. An enforcement report without baseline data is the same.

There is another systemic risk I want to flag: enforcement asymmetry across regions can create integrity arbitrage. If one server verifies more loosely, boost demand may migrate there — just as gold-farming and account trading concentrate in low-enforcement regions. The problem is not solved. It merely shifts.

What I am tracking

I apply my principle: every injury needs a timeline, a location, and three cross-checked sources. Here I have only one source. So I am tracking four signals.

One — publication cadence of enforcement data. If Riot publishes periodically with trend lines, it establishes an industry integrity-reporting standard, much as anti-doping reporting norms formed in traditional sport.

Two — the actual rollout of TPM 2.0. If it moves beyond test scope, account economics change permanently. And it raises an issue the material never mentions: players on shared machines, internet cafes, or older hardware become structurally disadvantaged.

Three — hitchhiker enforcement volume and false-positive rate. If a visible wrongful-revocation case emerges, public backlash will be significant, and professional teams could be dragged in when their substitute players accidentally queue with flagged accounts.

Four — boost market price signals. If prices spike or activity migrates to other titles, the displacement-not-elimination thesis is confirmed.

The next step

The body does not lie — it simply speaks a language the medical room has not yet translated. Systems are the same. 300,000 accounts is not a decisive purge. It is a body trying to say something — and what it is saying is not about the locked accounts, but about a future where player identity is bound to hardware, where playing with a friend can cost you points, and where one company is both judge and evidence provider.

The question is not whether Riot should fight cheating. The question is: when there is no independent arbitration layer between the rule-maker and the judge, who will record the wrongful cases the system does not count? And can a system that only counts its own successes ever count its own failures?