Riot locks nearly 300,000 League of Legends and VALORANT accounts: The blind spot is the hitchhiker doctrine

In 2026, while still competing and organizing tournaments, I sat behind an online qualifier in Ho Chi Minh City. There was an account with a strange name, a clean match history, but its champion picks and movement tempo did not resemble any player at that rank. A friend who coached told me: "That is a rank-boosted account. The real owner is three tiers higher." At the time I did not understand the business model behind it. Only when I started tracking the ranked ladder daily did I see it was a market with supply, demand, and a price list. High-skill players needed money, people with money needed a rank badge. In between sat the platform, holding the roles of referee, rulemaker, and revenue collector.

In September 2026, Riot Games integrated Vanguard into League of Legends after years of deploying it on VALORANT. Vanguard is a kernel-level anti-cheat that operates at the deepest layer of the operating system. Riot has now announced it locked nearly 300,000 accounts across the two titles for ranked cheating. That figure comes with another calculation: an estimated 120 million monthly League of Legends players and 20 million VALORANT players, roughly 140 million combined. The enforced-account ratio lands near 0.2%.

This is a platform-governance story, not a champion-balance or tournament-result story. Based on my experience tracking the ranked ladder and working in tournament media, how the number is read matters more than the number. 0.2% sounds small, but it only means something if the denominator is right and the time window is stated. The Riot material shows Vanguard was integrated into League of Legends in September 2026, meaning the near-300,000 figure is likely a cumulative tally for roughly one quarter, not a year. If so, the annualized enforcement rate is substantially higher. There is no prior-period comparison, no split by title, and no detailed timeline.

What Riot actually did goes beyond scanning for cheat software. Vanguard is being shifted from a cheat-software countermeasure into behavioral enforcement infrastructure across the entire ranked system. Three groups are targeted. The first is boosting: a high-skill player logs into someone else's account to climb ranks, usually for a paid transaction. The second is smurfing: playing on a secondary account, typically below one's true skill. The third is hitchhiking: using one's own account but queuing alongside an account being boosted.

Riot draws a clear line on smurfing. Smurfing is not automatically treated as cheating. The company lists eight legitimate use cases, including protecting one's highest achievement on a main account. Phillip Koskinas, a Riot Games staff member, is the quoted voice on this issue. That means the enforcement criterion rests on intent and behavior, not account count. Such a soft line is hard to apply consistently, but at least it is stated.

With hitchhikers, Riot goes further. A hitchhiker breaks no software rule. They may still lose the ranked points, or LP, earned in games involving a boosted account. This is the single most notable element of the whole story. The hitchhiker doctrine extends liability to a third party based on queue association, not on a committed violation. In sports history, liability-by-association penalties have always been where disputes arise, because they force the governing body to prove the punished party's state of mind.

Alongside that, Riot announced a set of protections for legitimate players. When the system detects a cheater or a leaver, the remaining players do not lose LP. This is a low-cost, high-experience-value change, because it reduces the variance of a ranked grind. Over the long run, if applied consistently, it makes LP a slightly more accurate skill signal.

The forward-looking plan is where attention belongs. Riot mentions adding multi-factor authentication, TPM 2.0, and hardware authentication. The stated goal is to make "one-time" accounts harder to create. Verification requirements may be applied differently depending on rank. If these measures are genuinely deployed, the cost of creating a new account rises sharply. TPM 2.0 is a hardware security standard that enables device attestation. Once an account is bound to hardware, re-registering after a ban becomes far harder.

That is the part Riot wants you to remember. Here is the part I want you to remember.

There is no false-positive rate. There is no description of an appeals mechanism. There is no third-party audit of the 300,000 figure. Every quantitative claim in this story comes from a single source, and that source is simultaneously the rulemaker, the enforcer, the publisher of the statistics, and the commercial beneficiary of enforcement. In traditional sports, a body that investigates, judges, and publishes its own rulings is always required to have an independent arbitration layer. Here there is none.

That national U19 tournament taught me a lesson: an editor's silence is a crime. Silence before a 300,000-account ruling is the same. Nobody asked Riot what standard classified a hitchhiker, what the error rate is, and how a wrongful case gets corrected.

There is another hole. These two titles in mainland China are operated inside Tencent's ecosystem, with separate anti-cheat and account-verification infrastructure. The material does not specify whether the 300,000 figure includes China servers. If it does not, the 140 million denominator is wrong, because a large share of League of Legends players sit in that ecosystem. The 0.2% ratio then stops holding as a comparison.

As for the boosting market, I do not believe it disappears. It reprices. Demand remains: rank prestige, seasonal rewards, the buyer's ego. Supply remains: players at the bottom of the esports pyramid need income. When Riot raises the cost of account creation, the price of boosting services rises first, and activity may then migrate to titles with softer enforcement. That is the standard outcome of supply-side enforcement in gray markets.

Fans hate the truth, but I did not go on air to be loved. The reality here has two sides. Riot was right to tighten the ranked ladder. And Riot is grading its own exam.

If you want a verifiable prediction, here is what I will watch over the next 6 to 12 months: whether Riot turns the 300,000 figure into periodic reporting with trend lines and an error rate; whether TPM 2.0 and hardware authentication are actually deployed beyond testing scope and which rank threshold is applied first; and whether gray-market boosting prices rise and activity shifts to other titles.

An empty stadium, yet I still hear my own echo. The ranked ladder has no stands, but every account locked by a decision nobody audits is an echo. Everything I know about sports, I learned from my mistakes on air. Riot should learn the same lesson.