Nearly 300,000 League of Legends and VALORANT Accounts Locked: Riot Games Is Rewriting the Digital-Citizenship Rules of Esports

Inside a closed group of paid rank-boosters, there was a conversation I read at the start of the month. A person claiming Grandmaster level skill, who had spent three years earning a living by climbing the ranked ladder for paying clients, wrote briefly: "I quit. Riot locked my main account too." Below, dozens of replies confirmed the same: "Me too," "Got wiped yesterday," "Anyone still taking orders?" Those lines reflected a purge that Riot Games itself had just announced: nearly 300,000 League of Legends and VALORANT accounts locked for involvement in ranked-ladder manipulation. The payment structure is where the soul of any deal lives. In this story, however, the structure being changed is not a contract but the way Riot defines who counts as a legitimate citizen of the ranked ladder. 300,000 is a nice headline number. But the source article itself supplied the corrective ratio that shrinks it considerably: roughly 0.2% of the combined monthly player base of both titles. With estimates of about 120 million League of Legends players and 20 million VALORANT players, that figure suggests the ban wave is more symbolic than a comprehensive sweep. Yet stopping at the percentage would miss something far more consequential. Some context is needed for readers who do not follow esports closely. Vanguard is a kernel-level anti-cheat client, meaning it runs at the core layer of the operating system, where it holds the deepest possible access to a user's machine. Riot deployed Vanguard for VALORANT years ago, and only in September 2026 integrated it into League of Legends. This is a system-level intervention, not a champion balance patch. What Riot is targeting in this round is not pure software cheating but social cheating: boosting, the paid service where a highly skilled player logs into a client's account to raise its rank. In Vietnam, the practice is called cay ho. Boosting exists as a genuine gray market, priced by tier: a few hundred thousand dong for a routine rank segment, several million for a Grandmaster target. In esports, the ranked ladder serves a role analogous to the qualification system of a professional tournament. Boosting corrupts the scouting signal, because academies and tier-2 teams use rank to screen young talent. An account dragged upward by someone else creates a false signal, and the damage does not stop at the casual player experience. The most interesting element of the new policy is not the boosted accounts but a new concept: hitchhikers. Riot coined the term to describe players who use their own legitimate accounts while duoing with an account being boosted. Under the new policy, hitchhikers can lose League Points - the ladder currency in League of Legends - even though they broke no software rule themselves. This is an expanded liability-by-association standard, and it raises legal and ethical questions worth examining. Imagine an ordinary player who duos with a close friend every evening. That friend quietly pays to be carried, or is simply flagged on a boosted account. The ordinary player loses ranked points, possibly losing weeks of accumulated progress, despite having pressed every key personally. Riot has published no information on false-positive rates, no appeal mechanism, and no evidentiary standard for classifying someone as a hitchhiker. For a purge touching nearly 300,000 accounts, the absence of those three pieces is a transparency gap disproportionate to the scale of the action. Alongside hitchhikers, the smurfing policy moves in a surprisingly opposite direction. Riot states explicitly that smurfing - playing on a secondary account at a lower rank than one's true skill - is not automatically considered cheating. Riot's representative, Phillip "mirageofpenguins" Koskinas, listed eight legitimate use cases for secondary accounts, including preserving one's highest achievement on a main account. This means Riot's enforcement boundary rests on intent and behavior, not on how many accounts a person owns. This is a flexible policy design, but a very hard one to enforce consistently. How do you distinguish a player using a smurf to preserve a personal record from one using a smurf to boost for pay? At the raw data level, the two behaviors look identical. Riot is betting it can read the intent behind the behavior. That is a governance gamble, not a mechanical rule. Another structural detail that received little media attention: verification requirements may be applied differently depending on a player's rank. In plain terms, higher ranks face stricter identity checks. In traditional sports governance, this model is familiar: whereabouts rules in athletics or football weigh more heavily on elite athletes. But it also creates what might be called a two-tier citizenship model within a single player ecosystem, raising an equal-treatment question. Separately, the protection of points when a cheater or a mid-game leaver is detected is an improvement with concrete calculable value. It reduces variance in the ranked experience, making LP a slightly more accurate skill signal over large samples. Technically, this is a direct, cheap benefit for legitimate players, and it may do more for community sentiment than the 300,000 figure itself. But what truly shapes the future of esports sits at the end of the policy. Riot announced a shift toward multi-factor authentication, hardware-level attestation via TPM 2.0, and the goal of making one-time accounts harder to create. This is a far larger structural shift than banning a few hundred thousand accounts. It turns account identity from a string of characters on a server into an attribute bound to a player's physical hardware. After this step, the cost of a fresh account will spike. From an economic standpoint, Riot is spending heavily on platform-integrity infrastructure: Vanguard running on a second title, plus MFA and hardware attestation. The business logic is churn prevention rather than direct revenue. Cheated-on players quit, and in a free-to-play model with microtransactions, churn cuts straight into the monetization base. Riot's own framing - improving player experience and limiting negative effects - fits a churn-prevention investment thesis. A commercial side effect follows: hardware-level verification raises the cost of account creation, thereby suppressing the account-resale market - a gray economy that has never benefited Riot. This is the first time a major publisher has turned device identity into a ranked-ladder governance tool rather than a mere antivirus sales feature. On the power-governance axis, Riot occupies a singular position: simultaneously the rule-maker, the enforcer, the sole data source for enforcement statistics, and the commercial beneficiary of the enforcement itself. Every quantitative claim in the source article - 300,000 accounts, 120 million League players, 20 million VALORANT players - originates from a single self-interested party, with no independent audit. This is a serious provenance weakness, especially since the 0.2% ratio is itself derived by the article's author from those unsourced estimates. An unanswered question concerns the China servers, operated under Tencent's model with anti-cheat and verification infrastructure distinct from the global Vanguard rollout. Whether the 300,000 figure includes, excludes, or can be separated from that server population remains open. If it is a global-ex-China figure, the effective enforcement ratio is even smaller, since a large share of League of Legends' monthly actives sits in the China ecosystem. This is the point I want to stress, because it touches the structure of the data: every scale figure depends on the sample definition, and every sample definition is set by the party with an interest. The contrarian angle of this story is not whether Riot is right to act - it is doing something directionally correct for platform health. The contrarian angle is that what was sold to the public as a great victory is small in scale, while what genuinely changes the game was quietly presented at the bottom of the announcement. Headlines like "Riot crushes 300,000 cheaters" create the impression that the ladder has been cleaned. But if the article's own figure is just 0.2% of the player base, that impression is a form of perception swap: turning a symbolic campaign into a claim that the problem is solved. And the gray market will not vanish. The supply and demand of boosting are not resolved by a ban order. Demand comes from the desire for prestige and rewards. Supply comes from the income needs of skilled non-professional players - exactly the people I have met across eighteen years covering this industry. When the supply of cheap accounts is squeezed, boosting prices rise rather than demand collapsing. That is the familiar outcome of any supply-side enforcement in a gray market. A separate risk deserves mention. Hardware-level enforcement opens its own exposure. Players using shared machines at internet cafes - a substantial population, especially in Asian markets including Vietnam - will be structurally disadvantaged when accounts are bound to a specific physical device. The line between anti-cheat and excluding poorer players blurs if Riot does not design for these situations. We commentators are sometimes the ones holding the scissors that cut people into fragments. As I retell this story, I ask myself whom I am calling a cheater. A young person in Saigon boosting for rent is a cheater by the rules, yet in his own economy, it is a real job with real demand and real income. Riot has the right and the reason to shut that down. But the gap between the rule-maker and those who must live under the rule remains a gap that journalists have a duty not to blur. What I want readers to carry away is not a sense of victory but a list of signals to watch. First, the cadence of enforcement data disclosure: if Riot reports periodically with trend lines and period comparisons, 300,000 becomes the starting point of an industry integrity-reporting norm, comparable to how anti-doping regulations shaped traditional sports reporting. Second, the actual rollout of MFA and TPM 2.0 - if genuinely deployed, this is a bigger structural change than the ban wave, and the community will argue bitterly over privacy. Third, the hitchhiker enforcement volume and false-positive rate, since that is where political and legal risk concentrates. Fourth, post-enforcement ladder quality: if rank distribution at high tiers shifts abnormally, that may confirm or refute real-world effectiveness. Fifth, the price of boosting services - an indirect but relatively sensitive indicator of whether the market is migrating or genuinely shrinking. After 2026, I do not believe in what is called sustainability - only in the capacity to absorb a hit. That holds for both club finances and the identity structure of esports. Riot is building a harder fence around the ladder, and that will almost certainly force other publishers to respond. The question to track is not whether they succeed in shutting down the boosting market, but whether a hardware fence inadvertently turns a wave of legitimate players into the excluded. If you are an ordinary player, tonight you can sleep a little easier, knowing a few cheaters have been removed from your queue. But if you are someone pushing yourself at a high rank, the real question is not whether Riot can catch boosters, but who you are deemed to be under the new system, and who holds the power to decide it.